Font Rendering - Mac vs Ubuntu - <AUTHOR> http://arunoda.me/blog/font-rendering-mac-vs-ubunut.html <comment><USER3> What's happening here is freetype2 (and to a greater extent Windows) are grid- fitting the fonts. They anchor the font to the nearest pixel via a rather complex algorithm, and then anti-alias that. You can see exactly what's happening on Windows by turning off ClearType.

This results in a font that is sharper on screen, but is more jagged and doesn't resemble the print counterpart quite as well.

MacOS on the other hand renders the font as it would for print - <USER2> pixel boundaries - then antialiases that. On low DPI screens this results in a heavier feeling font, and some times artefacts where parts of the font get blurred out, but there's less difference between screen and print.

This was more useful when Macs were used heavily in pre-press, you'd want your display to match the print so you can avoid making proofs.

A few fonts include pixel alignment hints which Windows (but not freetype unless you compile yourself - Apple has patents on this) and MacOS can use to make a nicer alignment on screen, but since the libraries got better at auto- fitting these have dropped away. Take a newish font and put in on Windows XP with ClearType off to see how bad XP's was. Vista was better and 7 is pretty similar to MacOS when there are no hints.

It's not so relevant these days, but I don't imagine Apple changing. I'd expect Apple to move to high DPI screens over the next few years where this isn't an issue.

<comment><USER4> >This was more useful when Macs were used heavily in pre-press, you'd want your display to match the print so you can avoid making proofs.

It's also useful if you just prefer it that way. Strong hinting discards most of the original character of the font, but a lot of people find it easier to read. I think strong hinting looks like garbage, but this is a matter of opinion.

<comment><USER5> Clearly it's a matter of opinion. But I don't think your explanation makes any sense -- surely the presence or absence of a clear edge to the outlines is part of the "character" of the font too, no? The font designers didn't _intend_ for it to be blurry...

<comment><USER4> What I mean is that hinting reduces the distinctions between fonts far more than mere antialiasing does. Or, equivalently, hinting discards more information.

</comment></comment></comment></comment><comment><USER6> This is well-known and by design.

Mac renders fonts optimized for "correctness", which can appear fuzzy at low resolution. Their new hi-res (~200dpi) screens solve the problem, you get correctness and legibility.

Windows and Linux tend to optimize for screen legibility at low resolution, resulting in increased sharpness. At hi-res, they'll likely not look as correct as the Mac rendering.

<comment><AUTHOR> That means this is a well known issue?

<comment><USER3> definitely a well-known, it's been the case ever since MacOS had antialiasing.

It's unlikely to be 'fixed' as it's a different philosophy between the OSs.

<comment><USER6> Also, as I alluded to in my previous comment, as resolutions increase in the future, the Mac OS approach is more correct in the long run. Though, it has come with the cost of fuzzy fonts and squinting for the last decade.

<comment><AUTHOR> Seems like that's why they are investing more on Retina displays.

<comment><USER7> It's probably the vision that they had planned for years. Isn't that where we all want to go? I'm hoping that "Retina" becomes the new standard everywhere within the next few years.

</comment></comment></comment></comment></comment></comment><comment><USER8> No discussion of font rendering in Linux is complete without a hat tip to infinality, which aims to provide much better font rendering. infinality started out as a patch to freetype, and was recently merged in, which is quite exciting.

<comment><USER9> I hadn't heard of infinality, but a quick search led me to <http://www.infinality.net/blog/>

Ironically, the website is quite hard to read, thanks to a kind of simulated macular degeneration effect of drop-shadow glow around each letter. It amused me.

I can't find many examples of the effect of the infinality patches, though. Is it just a single-axis hinter?

<comment><USER10> Last time I configured Infinality I remember the example config file being very well explained about the possible options. Try installing it and reading your /etc/profile.d/infinality-settings.sh

</comment></comment></comment><comment><USER11> This can be changed on OS X with a

      defaults -currentHost write -globalDomain AppleFontSmoothing -int [value]

I personally use a value of 1. There's an entire article on this at [http://osxdaily.com/2010/02/18/change-font-smoothing- setting...](http://osxdaily.com/2010/02/18/change-font-smoothing-settings/)

<comment><USER12> This is a different thing: it disables subpixel rendering. Doesn't affect hinting.

</comment></comment><comment><USER13> BTW, everything looks so big on unbuntu 12.04 compared to win xp on my laptop at 1280 x 800 px res. Is it normal ? even reducing the font size on ubuntu to 10px does not change much. I can't see as much thing on the screen on ubuntu compared to win xp, playschool like. Not very convenient for surfing or coding.

</comment><comment><AUTHOR> I found some command on the web to change the font smoothness. Here is it and with option 1. It looks quite great than earlier.

defaults -currentHost write -globalDomain AppleFontSmoothing -int 1

<comment><USER14> Are you sure? It appears not to work on Lion.

      2012-10-10 21:29:32.922 defaults[24228:707]
      Domain AppleFontSmoothing does not exist

<comment><AUTHOR> I'm on Lion too. It works for me. Look here - [http://osxdaily.com/2012/06/09/mac-screen-blurry-optimize- tr...](http://osxdaily.com/2012/06/09/mac-screen-blurry-optimize-troubleshoot- font-smoothing-os-x/)

I steal it from there.

<comment><USER15> How can you tell if it is working? I don't see any difference (even after `killall Finder`).

</comment></comment></comment></comment><comment><USER16> To get a similar font rendering on Windows take a look at: <http://code.google.com/p/gdipp/></comment>


Why is the 'race to 5G' a race? - <AUTHOR> https://www.theverge.com/2019/5/23/18637213/5g-race-us-leadership-china-fcc-lte <comment><USER2> One data point: FOMA [1] in Japan was the world's first commercial 3G service to launch. Was it the "winner" of that "war"? No, it was basically an incompatible fork of UMTS [2] that in the end was used by nobody except NTT Docomo, who had to retool a few years later at considerable expense to be compatible with the global standard.

[1] [https://en.wikipedia.org/wiki/Freedom_of_Mobile_Multimedia_A...](https://en.wikipedia.org/wiki/Freedom_of_Mobile_Multimedia_Access)

[2] [https://en.wikipedia.org/wiki/UMTS](https://en.wikipedia.org/wiki/UMTS)

<comment><USER3> This answer and the answers below ignored one simple point: 5G is a global collaboration (3GPP), not a regional experiment, which includes operators around the world and vendor around the world (not true, few from American..). You can basically call 3GPP the dictatorial organization, simply it is the only organization truely working on the cellular technique.

More importantly, it is getting stronger, and the ecosystem getting more diversified as more OTT and devices vendors like Google, Tencent, Alibaba, Apple, all joining in.

Face it, US is being left behind.

<comment><USER2> FOMA was an UMTS implementation also shepherded by 3GPP. This didn't stop it from being incompatible.

Put another way, the W3C is supposed to set global standards for web browsing, and we all know how compatible browsers are...

<comment><USER3> True. But note that in 3G and 4G period, there are a number of systems that are not compatible to each other, like UMTS vs CDMA, LTE vs WiMAX, while 5G is the global one.

</comment></comment></comment></comment><comment><USER4> 5G-NR standard only gives a 15-20% gain in data thoroughput over the same bandwidth as compared to 4G LTE. The vast majority of the increase in thoroughput has to come from the millimeter wave bands. Think about streetlights to get an idea of coverage and propagation. Now think about running internet fiber to every streetlight. It's quite a task. It'll only be done (and has only been done so far in the USA) in areas that require high bits/khz/km^2 like entertainment stadiums.

Additionally, almost no two countries actually have overlapping 5G bands. It's a mess of competing standards. So it'll be different frontend modules for controlling the antenna arrays required on the handsets (high power usage and space requirements) due to the integration required. Handsets are going to have to get bigger. Unlikably big and specific to region.

And beyond that the 5G setups being implemented now aren't stand alone. They're both LTE and Non-Standalone (NSA) 5G. The 5G just provides extra bandwidth and isn't used as a control for the handsets. It more than doubles the complexity of setups because of the trouble RF designers have to take with harmonics and intermodulation. All the competing national freq band standards mean different filtering solutions.

The future will not be evenly distributed.

<comment><USER5> >5G-NR standard only gives a 15-20%

15-25% is _fucking_ _huge_. Even a few percent increase would be worth it for telcos.

<comment><USER6> 15%-20% might be huge for Verizon's CFO and shareholders, but it's inconsequential for consumers who are currently being sold some terabit-IoT- self-driving-car-VR-surgery yarn in an effort to get governments to give handouts of property and spectrum to anyone waving the magical 5g sauce.

<comment><USER7> It's also inconsequential for everyone who has a data cap on their phone plan. Running out of data 20% sooner isn't a win for people who can't afford a luxury plan.

<comment><USER5> This is absolutely a 100% silly way to look at it. The same amount of data is used even if you had slow or fast internet.

</comment></comment></comment></comment></comment><comment><USER8> Two points:

1\. The article's point is that the "The Race to 5G is BS" and not "5G is BS". Please adjust.

2\. I can try to offer an answer to the author. History has shown that a novel piece of technology often leads to innovation. Dial-up led to BBNs and the Web, broadband led to audio and video content delivery, and so on. Winning the "race to 5G" means the US will be the first to innovate in systems that take advantage of faster wireless broadband networks. That's important. IMO.

<comment><USER9> >Winning the "race to 5G" means the US will be the first to innovate in systems that take advantage of faster wireless broadband networks. That's important. IMO.

I'm not really sure if being the first is important or even beneficial. If that were true the United Kingdom would still be the world's superpower and myspace would still reign supreme. Being first is mostly an unthankful job because you're the one who does the most work while everyone else can copy.

<comment><USER10> > I'm not really sure if being the first is important or even beneficial. If > that were true the United Kingdom would still be the world's superpower

Or, you know, Persia, or Akkad. There have been many firsts.

<comment><USER11> Industrial Revolution I imagine.

<comment><USER10> England may have been the first to start powering machines with large-scale coal mining, but was it the first to start making iron tools? :D

</comment></comment></comment></comment></comment><comment><USER12> Ehhh, my opinion is that 5G is bullshit _for consumer internet_. Actual 4G (as opposed to whatever your carrier has in your area) is supposed to be capable of up to gigabit speeds, but that's obviously not happening many places, if anywhere due to a variety reasons. However, even so, 4G with good implementation and penetration would be fast enough to stream or download anything reasonable on mobile devices for quite a few years yet.

5G, however, is not bullshit _for IoT_. If you've ever tried to build an IoT device that uses 4G, you know it generally sucks. 5G will, if they actually build to the flashy spec, fix a lot of issues around latency, cost, and power to send/receive "thing" data.

<comment><USER13> "5G, however, is not bullshit for IoT"

I humbly disagree because IoT itself is BS.

We've been talking about it for a decade, and I don't have any use for it, nor do most folks. The ideas are nice, but practicalities are not there.

There's a lack of standards, no consistent 'home hub', not enough use cases for expensive gear, security problems galore.

The 'beachhead' for IOT has thus been Google/Alexa, which are really Cloud services and don't integrate very well locally.

Theoretically, I can see my fridge telling me what to order, my microwave knowing how long to cook etc. etc. but I'm wary that any of it will come to fruition for a long time. But I'm not that concerned because I don't care.

I think IoT needs a 'killer app' that everyone 'needs' which paves the way for everything else.

 _Nobody_ was building anything for the data networks when BlackBerry came along with an addictive product. It was not until BlackBerry was printing money that Apple and Google took notice and thus justified massive investment in their mobile offers.

<comment><USER14> Yeah, I think IoT is mostly bullshit that doesn't add much/any particular value. But you know what I do need? Windows in my house that either close automatically when it rains, or when I tell them all to via an app or something. Then I can open all 20 of back up when I want. or maybe open them 5%, or 20%, or all the way, or drop half way, and open the bottom halfway. Know why this will never happen? It's expensive to manufacture & install, the profit margins are way low, and it needs to be secure, meaning it should never call home to google. The opportunity cost of doing that is too high vs. just making some useless gimmick that sends user data back to Big Ad Tech so they can farm it in their high profit margin ad business... That, and maybe I'm an old fashioned edge case that just likes fresh air when the weather is nice. And I live where I could use this for most of the summer, as it's not usually too hot, and it rains all the fucking time.

<comment><USER15> I'd love to buy something like this. I'd also love window shades that opened shortly before my phone's current alarm. These are both projects I have planned for whenever we end up owning a house, but I'd love to be able to buy something off the shelf if it had an open api, and preferably didn't require an internet connection.

There are a couple window shade options out there, but they didn't appear to be very open when I looked briefly. Maybe there's some older-style zigbee stuff that I missed.

</comment></comment></comment></comment><comment><USER16> 5G boxes will be on "every street" meaning that real-time triangulation of devices and thus citzens will have exact precision. Whoever wins the race to 5G will be the one who writes the protocol and thus it will be tailored for their backdoors in the code. The US wants their backdoors in the code, not China's.

<comment><USER17> > Whoever wins the race to 5G will be the one who writes the protocol

A common standard is already decided, the race is just to deployment.

Does the US manufacture any 5G network equipment anyway? I thought it was all Ericsson, Nokia and Huawei

<comment><USER18> The US is completely out from network air interface competition. It's only Ericsson, Nokia and Huawei and ZTE.

Qualcomm and others manufacture components.

</comment></comment></comment><comment><USER19> 5g just means you can blow your entire data plan in 5 minutes if it even works. 4g is fast enough where they could actually just lie and sell you 4g service by labeling it 5g you likely wouldn't notice because YouTube already runs great on 4g.

<comment><USER20> This is the big one imo. 4g is so fast compared to data caps that it might as well be unlimited speed because downloading anything big enough to make the speed matter would use your entire months data allowance in minutes.

Until data caps are significantly higher I don't see 5g as anything other than a marketing name from people who want to sell new phones.

<comment><USER21> That's like arguing that improvements in mobile CPUs don't matter because if you continuously pegged your CPU, you'd quickly run out of battery. Most consumer usage is bursty. In the era of single web pages that take up 5-10MB, going from 30 Mbps to 300 Mbps offers a marked improvement in user experience.

<comment><USER22> Also, the the overall available bandwidth of the system is one of the key factors behind the data cap, so we can expect the cap to increase in general when 5G rolls out. That means this line of"current data cap makes 5G useless" thinking is short-sighted.

<comment> cadence- So you think wireless companies will spend billions of dollars upgrading their infrastructure to 5G only to later increase your monthly caps so that you will be able to pay less monthly? Keep dreaming. The reality is that they will use 5G to increase your monthly payments somehow.

<comment><USER17> > increase your monthly caps so that you will be able to pay less monthly

You're not going to pay less monthly because you're going to want to stay on the higher caps when the experience is better. YouTube will no longer be capped to 480p so you will use more video streaming bandwidth, etc.

The wireless companies are also looking to eat the wireline companies' lunch. They want you to cancel Comcast for 5G. For that they'll have to have higher caps.

<comment><USER23> For that, they'll have to get rid of caps. At least for me; I dont have one. And none of this "first 25gb is fast" nonsense. Wifi is where I dont have to worry about how much data I use, so I can download my 30gb vm image. By doing so, I only have to buy a gig of data a month and only use 200mb of that. 5g has the capability to handle it, or if it doesn't, maybe it's not the future after all. At least not for home internet.

<comment><USER17> For power users like us it will never be a replacement. But I know plenty of people who already use 4G as their home internet. The complain about congestion during the evening and hitting their cap at the end of the month, and some switch to fiber. Going from a 30 GB to a 300 GB cap, they would be serves perfectly.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> The real end game of the race to 5G is increased unavoidable surveilance on the general population.

5G won't provide better speeds as much as increased bandwith. Instead of IoT devices requiring a connection to your WiFi network (and thus your consent) to phone home, they will send your data over 5G, with sim cards paid for by selling your data to advertisers.

Ubiquitous internet access has a lot of exciting potential but inevitably it will make the mass surveillance problem even worse

<comment><USER25> I don't understand the value proposition of this from a marketing point of view. > sim cards paid for by selling your data to advertisers

Are advertisers seriously going to pay for the subscription of the SIM card of "the shiny new"™ IoT fridge or is this a hope of the telcos? Because if anybody expects me to pay for the connection of the abovementioned fridge, I'm out and I'm missing something.

<comment><USER26> The recent articles about US telcos selling location data suggest that they are in on the deal. Thus, telcos might as well make deals with IoT fridge companies to give them the data plans for free for trading in the data.

</comment></comment></comment><comment><USER27> I'm expecting higher costs for the consumer, increased data plan costs, new phones, less coverage. All sounds positive to fund these new networks nobody is asking for.

<comment><USER17> Did higher data plan costs happen in the transitions from 2G to 3G and 3G to 4G?

<comment><USER23> 5g is a massive capex on the part of telcos due to density requirements orders of magnitude greater than 2,3,4g. Unit on every block kind of density is significantly cost increase; no way around higher prices.

</comment></comment></comment><comment><USER28> Oh ho ho. Next you're going to be questioning the "race to AI". It's like you want to be forced to read articles about raccoons with distemper, instead of buzzwordy tech FUD pieces, on slow news days. Is this what you want? Is it possible, dare I say it, that you might even want want us to lose the race to racing? Why are you rocking the boat?

</comment><comment><USER29> 5G is not that much for consumers but for industries [1]. There is a number of industry use cases that are just impossible for anything other than 5G. For example, self driving cars, virtual /augmented reality, support for huge numbers of IoT devices (ie. smart city).

Also, 5G is not just higher speed / reduced latency. The core network is way more flexible than 4G. This can allow it to provide guaranteed service to specific users, like first responders. That way first responders will be able to use the way cheaper and feature rich commercial networks instead of dedicated networks as it is the case now.

The first countries to have 5G infrastructure will be able to have faster developments on these sectors.

[1] The only major difference for consumers, given how they currently use their mobile devices, is that now everyone at a live concert will be able to stream it to instagram. I do not know if it a good thing though.

<comment><USER30> 1\. What does 5g have with self driving cars? And specifically what does lack of 5g do to make them any more or less possible?

2\. NO wireless service provides GUARANTEED anything. To anyone. That's not how physics works

<comment><USER31> Absolutely agree with your second point. If only marketing had gotten the memo ...

Regarding your question, self driving cars have to interact with their environment. Receiving a message that indicates there is a vehicule of x,y coordinates may be better than trying to figure it out on your own using sensors. Getting the message in a timely fashion is essential, otherwise it is practically useless. 5G could be the communication channel for the message to transit, given that 5G aims to achieve lower latencies that 4G.

<comment><USER32> > Receiving a message that indicates there is a vehicule of x,y coordinates > may be better than trying to figure it out on your own using sensors.

True, but that only requires the ability to communicate directly with cars near you. That's 100% doable with even 20th century technology. Something like 5G is not necessary for this at all.

</comment></comment></comment></comment><comment><USER33> The one issue at stake that I can think of is the manufacture of the underlying hardware infrastructure. The risk associated with relying on hardware manufactured in China for critical infrastructure seems to be of some concern for the US government. It's probably unlikely in any case, but importing Chinese-manufactured 5G modems for phone handsets would potentially pose an issue, so would using Chinese-made hardware for telecom infrastructure.

I don't think this has any bearing on what telecom companies offer consumers, or those other aspects of the '5G race'. Nonetheless, falling behind Asia in developing this technology might have other consequences.

<comment><USER34> The proper answer to losing the technological race for hardware development is to accelerate your own.

But instead the US government are doing their best to hobble China.

</comment></comment><comment><USER35> Has anyone found any decent reporting on how the rollout of 5G in USA is progressing? South Korea has been rolling out 5G and I found a decent article that highlighted numbers and issues.[1] But for USA all I see is marketing propaganda from the Telcos.

[1] [https://www.fitchsolutions.com/corporates/telecoms-media- tec...](https://www.fitchsolutions.com/corporates/telecoms-media- technology/south-korea-5g-rollout-key-highlights-progress-so-far-24-05-2019)

</comment><comment><USER36> One of the large Australia carriers is promoting 5g as a "paid add-on".

There is some marketing material saying it'd cost an extra $15 per-month on top of your normal plan's price. With "first 12 months free" to try it out. This is a 20-30% premium for average prices.

I can see the uptake of 5g in that case being less than 5%.

4g is already fast enough for most things, so very few will actually need faster.

I'm not sure if they are completely clueless thinking people will pay extra, or they are trying to discourage large uptake.

<comment><USER37> Pricing like this is not designed so that people actually pay for it.

Instead it creates 'value' which is given away with some other product. For example: Free 5G for all business customers, all customers on an $80 plan or above, etc.

It also helps smooth demand - I don't think Telstra have invested a lot in 5G.

</comment></comment><comment><USER38> This title does not match what is in the article at all. It's about the race to first, not the technology in general.

</comment><comment><USER13> The author has a point to suggest that 5G is overhyped.

Increasing data vastly will be nice, but it won't change anything fundamentally. I suspect usage will go up, caps will go up - but I don't suspect any new lines of business to come out of this.

A 'quicker 5G rollout' will not make any economy more competitive, or given them an advantage.

5G will require different tower configs and will be a pain for carriers.

I'm buying a new device right now and for the first time I'm looking to _downgrade_. I hardly use my data, and I could care less about all these stupid apps bothering me. I want a cheaper, simpler option.

5G will probably make 'dongles for your laptop' more in consumer range for prices, in which we may see people shift away from cable, that will be nice. And using that or pumping Netflix from my mobile to the screen might be nice.

<comment><USER35> Sorry, 'I don't suspect any new lines of business to come out of this.' is akin to '640K of memory should be enough for anybody' (falsely attributed to Gates)

There's a lot of speculation of what new lines of business and evolving lines of business spring from 5G capabilities.

[https://www.bloomberg.com/news/articles/2019-05-16/south- kor...](https://www.bloomberg.com/news/articles/2019-05-16/south-korea-s- embrace-of-5g-may-usher-in-an-era-of-robot-friends)

Other areas just off top of my head: Mobile gaming including Mobile VR, Autonomous Vehicles where lower latency promised by 5G is critical, and replacement of wired data services with wireless.

<comment><USER13> Mobile gaming and autonomous vehicles are already developing industries and will develop irrespective of the availability of 5G.

We're already not close to utilizing the full bandwidth power of LTE for example.

<comment><USER39> My Oculus Quest might well be soon saturating my 4G with h.265 or h.264 encoded VR streams; teleporting me and others all over.

</comment></comment></comment></comment><comment><USER40> It's really no different than winning the supercomputer race; there is no finish line and no end.

I'd rather have the USA take its time and develop mmWave 5G hardware than the lower frequency stuff Huawei is developing, as mmWave is far more interesting, technically.

<comment><USER41> But which US companies would be working on developing that tech?

<comment><USER40> Anokiwave and Qualcomm, off the top of my head. TI has a mmWave in CMOS process, so I can see them getting in on it.

<comment><USER41> I'd never heard of that first one. Is it supposed to be an anagram of Nokia, are they related?!

<comment><USER40> No relation that I know of; it's a US company making IC for sub array beamforming.

</comment></comment></comment></comment></comment><comment><USER42> Not even a full finished roll out in LTE in rural areas. Telecoms don't want to lower prices for us, so 5G is going to sell at a premium to consumers. This race about "who control 5G controls the world" is ridiculous.

<comment><USER18> Rural areas will benefit from Low-band FDD 5G.

</comment></comment><comment><USER43> The ironic part is that mobile 5G is basically pointless. Fixed 5G could provide competition to cable companies if it actually works, but mobile 5G's range is so short that anywhere with mobile 5G will be getting several hundred mbps on 4G from the same site and fiber improvements necessary for 5G that 5G itself is pointless. The upside is that the areas that get a dense small-cell buildout for 5G will have way better 4G service as a result that virtually everyone can use as soon as the cells go up and the fiber is lit up for them.

</comment><comment><USER18> Home markets are important for new technologies and services that build on the top of the new infrastructure. US companies and startups are not going be first to innovate 5G technologies and services if their home market is behind.

The US tech sector is already out from the main 4G/LTE/5G air infrastructure business except for components and mobile phones. There is only Eriksson, Nokia, Huawei and ZTE, Samsung is #5 with very tiny market share.

<comment><USER32> > US companies and startups are not going be first to innovate 5G technologies > and services if their home market is behind.

That answer is really just begging the question. Why is that so important as to require such a huge push as a "race" implies?

</comment></comment><comment><USER44> This is similar to new car sales being an early indicator of a recession. Government answer in the wake of a coming recession? Subsidize cars.

Winning 5g race is an indication of technological leadership. But you cannot help win it forcefully. You should just watch it respectfully and draw forward looking conclusions.

Of course some people can use it instrumentally to get benefits or desired decisions.

Anyway - congrats to the winner.

</comment><comment><USER45> [https://theamphour.com/430-shahriar- discusses-5g/](https://theamphour.com/430-shahriar-discusses-5g/)

I am a bit confused, according to the preceding link, 5G can't be at all used like 4G, in particular it can't be used from a base station to a mobile phone. Can someone explain a bit more?

</comment><comment><USER46> Being able to burn through Verizon's 22GB "secret" data cap on my "unlimited" plan in ten minutes instead of 70 minutes at normal 4G speeds is not an upgrade in any way. Meanwhile I still can't send a text message or check my email when visiting my parents' house out in the boonies. 5G is a scam.

</comment><comment><USER47> Isn't parts of the US network still on CDMA? The reason Europe has had lower prices is because we have been better at infra-carrier standards and co- opetition / lowering transaction costs. Perhaps before that the Nordic Mobile Telephone (NMT) is a great example for others to lead by.

</comment><comment><USER32> It's not really a race. It's more like a scam.

The telecoms and equipment manufacturers want to make it seem like a race in an effort to make people demand 5G, to increase the amount of subsidies as much as possible.

</comment><comment><USER48> Not even a full finished roll out in LTE in rural areas. Telecoms don't want to lower prices for us, so 5G is going to sell at a premium to consumers. This race about "who control 5G controls the world" is ridiculous.

</comment><comment><AUTHOR> I've read L5 autonomous cars are contingent on 5G and others say it's not a factor. What's the consensus here?

<comment><USER49> Sounds like there isn't a consensus according to your own statement.

Waymo is running on public roads right now without 5G.

IMO: if 5G is required for an "autonomous" car it can't qualify as L5. That's a remote controlled car not an autonomous car...

</comment></comment><comment><USER50> Sadly I see only one killer feature in all 5G phones: foldable screens.

<comment><USER51> What on earth does one have to do with the other

</comment></comment><comment><USER23> I've seen "millimeter wave" in tsa and heard it takes a picture of you without clothes, though they now supposedly obscure it. Creepy as all get-out. Anyway, could a hijacked 5g unit do this? Seems like a serious concern.

<comment><USER32> > could a hijacked 5g unit do this?

No, for two reasons. First, the mmwave scanners require more power than 5G cell sites will provide. Second, the transmission of the radio signals is only half of the equation for this sort of thing. The other half is the sophisticated receiving systems that are required, and that 5G cell sites won't have.</comment></comment>


Ask HN: Incorrect user name and/or password - <AUTHOR>

Is not specifying whether a user has entered an incorrect user name or an incorrect password done for security reasons or is it jut bad UX? If it is done for security reasons, how much and in what way does it contribute to security? <comment><USER2> If the motivation is security than the effectiveness of the extra security is questionable. Even if a system uses this type of error message to stop people from testing for existing accounts the user signup or password reset pages will almost always tell you if an particular username is being used.

</comment><comment><USER3> Looking at security of a website, it has to be just the way it it. It should not prompt whether or not username or password is incorrect..and if it does, then it would be vulnerable. It prevents hacker to know about whether he has got right username or not? If he knows that then he can tryout various passwords using the username he guessed earlier.

</comment><comment><USER4> If I enter username_x and password_x as my parameters, and you say "the username is right, but the password is wrong", than as an attacker, I've just learned that a user account exists named username_x.

If I'm being malicious, this could give me better access to focus on password cracking, since now I have a known-good account to work against. I might design a system that just goes through a dictionary list of usernames until I get a decent list of users, then loop through them with password attempts.

Let's say I'm not an attacker, but an overly curious friend, boy/girl-friend, or employer of a particular user. If I try 'bmelton' as a username on, say, Monster.com, and my employer gets as message saying "the username is right, but the password is wrong", then my employer now knows that I'm a user on Monster.com. That might not be the end of the world, and is easy to explain away, but lets say the website is "hot_chicks_that_aren't_your_wife.com", and your girlfriend finds you have an account on there.

This is potentially compounded if you're using email addresses as usernames, since I could easily point to 'some other' Barry Melton[1] and say that 'bmelton' must be his account, but that's harder to pull off if it is my email address.

In short, it's a security issue that also happens to be bad UX. Perhaps if your website has no negative connotation (e.g., freekittensforcharity.com), then it doesn't matter, but you're still slightly more vulnerable to password attacks as I described in the first scenario.

[1] - <http://www.counterculture.net/thefish/>

<comment><AUTHOR> But as slg mentioned below, it's trivial to check if a username/email is registered through the forgot password page. So some snooping significant other can still find out if they really want to.

<comment><USER4> The more secure systems I've been to don't acknowledge whether or not the account exists. I've actually seen a message that said something like

"If an account exists for that email address, it will receive an email shortly."

As I said (or meant to say) earlier, how anal you are has a little bit of luxury dependent on the nature of the site. If it's a social network, it's probably fine to show that usernames exist (unless their profiles are specifically flagged to be private), as part of the site shows that their usernames exist already. I could easily harvest usernames on HN here without ever having to test against the password form.

If your site is of a more personal, sensitive, embarrassing or whatever other situation you can concoct, then of course you'd want to adjust your username/password strategies accordingly.</comment></comment></comment>


Ask HN: Covid-19 on Children - <AUTHOR> Anyone with links about how children are faring with the new coronavirus? There is a lot of information about how the elderly and those with underlying conditions but none whatsoever that I can see about children. Are relatively health children able to withstand this new disease just like relatively healthy young adults? I know it is too early for evidence at this point. However, any leads would be appreciated. <comment><AUTHOR> Since asking this question, I have been searching online and found the following articles.

1: [https://www.sciencedirect.com/science/article/pii/S168411822...](https://www.sciencedirect.com/science/article/pii/S1684118220300396)

2: [https://onlinelibrary.wiley.com/doi/full/10.1002/jmv.25740](https://onlinelibrary.wiley.com/doi/full/10.1002/jmv.25740)

3: [https://wwwnc.cdc.gov/eid/article/26/6/20-0301_article](https://wwwnc.cdc.gov/eid/article/26/6/20-0301_article)</comment>


Firefox for Mobile now supports NoScript, PrivacyBadger, HTTPS Everywhere - <AUTHOR> https://blog.mozilla.org/addons/2020/04/14/april-extensions-for-firefox-preview/ <comment><USER3> So many people complain about Firefox (current) being "slow", "clunky", have "bad performance" etc. I feel like I'm the only one who is completely fine with performance of this app? I've switched to FF on android fully 3 years ago, first on a phone with SD821, now with SD855. I realize that these are flagship SoCs, but I see people with high-end phones complain about it too. As a control - I also use old and modern iPads with stock Safari. I honestly don't get what the complaints are exactly, it opens as fast as any similar app, all UI controls are responsive (there are some animations, but they are intentional), scrolling is always smooth.

<comment><USER4> If you think Firefox for Android is fast, have you tried Firefox Preview? It's like twice or three times faster.

<comment><USER5> Sadly, Firefox Preview is not currently free software, which is a showstopper for many. In particular it cannot be obtained through F-Droid:

[https://github.com/mozilla- mobile/fenix/issues/162](https://github.com/mozilla-mobile/fenix/issues/162)

<comment><USER6> There is an unofficial repo, if you simply care more about using F-Droid/de- Googling than it being free software, specifically.

[https://gitlab.com/rfc2822/fdroid-firefox](https://gitlab.com/rfc2822/fdroid- firefox)

<comment><USER5> Thanks. I haven't downloaded it to check, but from the GitHub issue I mentioned above that repo just contains a copy of the official Mozilla .apk, which contains com.google.android.gms and com.google.firebase. So it's not so good for "de-Googling".

I'm a lot less interested in the mechanics of using F-Droid than I am in the no-malware guarantee that F-Droid effectively provides.

</comment></comment></comment></comment></comment><comment><USER7> Holy cow - I am a regular user of Firefox on Android, and I just installed Firefox Preview - it's obviously a stark improvement. The lack of noscript and darkreader kept me from trying it before, but now I'm wishing I had tried it earlier.

<comment><USER8> Mine has an annoying quirk. When I switch to Firefox and type something in the address bar it doesn't work. It still seems to be trying to load the page from last time I was in the browser and forgets my query entirely until it has finished whatever is on its todo list then I can use it. Hopefully this is fixed soon, it makes casual searches annoying.

<comment><USER9> I had this problem as well. After I cleared out my old tabs (99+) it disappeared. Might have been correlated.

<comment><USER8> Unfortunately this has happened since I installed it, and I rarely open many tabs on my phone. It's mostly for quick lookups when I'm out or cooking which makes it a problem.

</comment></comment></comment></comment><comment><USER10> Tangential comment for those using iOS:

It sucks that this cannot be available on iOS because of Apple's restrictions.

But I'm happy with Firefox Focus, which is my daily driver browser on iOS (and what I'm using to write this too). It has a built in content blocker. It doesn't upgrade HTTP requests to HTTPS, like Brave does.

For ad and tracker blocking at the DNS level, I use NextDNS with some blocker lists enabled for my account (I recommend you check it out). It has made things better on other apps too.

<comment><USER11> > It sucks that this cannot be available on iOS because of Apple's > restrictions.

Apple users have exactly what they want. It doesn't "suck": it's the very definition of walled garden. Your device is not yours, you are just allowed to play in there, under adult supervision. If you do not want walled gardens, just stop paying for them.

<comment><USER12> No, not all Apple users have what they want.

There is no "just stop" for people who need or want capabilities that only Apple devices have, but don't want the walled garden. It is not a free choice, not what those people want, and therefore sucks.

The brutal fact is there are only two mobile OSes where essential apps are available (such as banking), and Android being the other one, is not suitable for all users and has its own walled garden issues.

</comment></comment></comment><comment><USER13> So they are hand-picking extensions now? Is this trend going to continue (i.e. they continue to add more but still with a manual process) or they're aiming to be on par with the old Firefox (supports most of extensions automatically)?

<comment><AUTHOR> AFAICT the intent is to eventually support the full WebExtensions API, i.e. every extension that runs on Firefox 57 or later. From an older blog post discussing this:

 _" We're happy to confirm that GeckoView is currently building support for extensions through the WebExtensions API. This feature will be available in Firefox Preview, and we are looking forward to offering a great experience for both mobile users and developers. Bringing GeckoView and Firefox Preview up to par with the APIs that were supported previously in Firefox for Android won't happen overnight. For the remainder of 2019 and leading into 2020, we are focusing on building support for a selection of content from our Recommended Extensions program that work well on mobile and cover a variety of utilities and features."_

[https://blog.mozilla.org/addons/2019/10/23/fx-preview- geckov...](https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckoview- add-ons-support/)

<comment><USER14> The answers here seem to suggest otherwise.

[https://blog.mozilla.org/addons/2020/02/11/faq-for- extension...](https://blog.mozilla.org/addons/2020/02/11/faq-for-extension- support-in-new-firefox-for-android/)

My guess would be that they'll try to make it curated-only unless users complain too much. Or maybe allow other extensions behind serious warning screens.

If that ends up being the case, depending on their review process, it kinda sucks for any potential new extensions created _after_ the ecosystem lockdown, that won't get a chance to attain enough popularity to be relevant - <USER2> Mozilla agrees to do a review for any project that asks, which doesn't seem likely.

<comment><USER15> Would also be bad for all extensions Mozilla does not allow in their extension store.

All software stores can be pressured to remove content. Keeping the ability to load non-store extensions fixes that specific deplatfoming problem.

<comment><USER14> The basic assumption is that users are dumb when it comes to security, and if there is a way to install malware, they _will_ be tricked into installing malware (even with no vulnerabilities in the host software itself). Especially since there is such a thing as warning screen fatigue, which makes people not pay attention and just click through due to the sheer amount of benign(ish) warning screens they regularly deal with ([https://en.wikipedia.org/wiki/Alarm_fatigue](https://en.wikipedia.org/wiki/Alarm_fatigue)).

Making them explicitly type out "YES I AM AWARE THIS EXTENSION COULD EASILY CONTAIN MALICIOUS CODE AND I TRUST THE SOURCE: " \+ the domain name, in all caps before proceeding could be enough to catch most cases (unless too much legit software gets forced behind such warnings, where it would lead to that fatigue problem again).

Desktop Chrome doesn't let you have an outside extension without showing a warning on every single startup (even if it's an extension you are currently developing), but that could be because on a desktop OS, other applications could add such extension into Chrome without a user action. On mobile, where apps are isolated from one another, that problem doesn't exist, so maybe such strict restrictions shouldn't be necessary.

<comment><USER15> I don't think any of this is necessary.

I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far.

On hindsight it looks like a balancing act where single features are evaluated for their danger, etc.

Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc.

We're pretty much at this point now regarding browsers on Android, where there's only Chrome and it's skins (that let you do nothing) and Firefox.

I can't believe the sensible thing to do would be to cut uncurated, non-store extensions from Firefox as well.

It would be a huge loss for the whole ecosystem just to make a few Firefox installs (from an already small install base) a tiny bit less compromisable.

<comment><USER14> _> I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far._

It's not just a saying, it's supported by real-world situations that actually happened, and that you can be pretty sure will happen again. That's the context for the decisions that platform owners have to make.

E.g. not too long ago, Dark Reader users received this notice [https://darkreader.org/blog/attention/](https://darkreader.org/blog/attention/) about malware clones of the real extension that apparently thousands of people had installed (from the stores). It is events like this that influence these decisions.

 _> Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc._

That's basically the Apple mindset. It's a well known fact (e.g. his biography) that Steve Jobs didn't even want _any_ third party apps (other than super limited web-"apps") on iOS initially, and had to be convinced otherwise.

<comment><USER15> But I didn't argue that they shouldn't do it because we don't know whether people will compromise themselves.

I argued they shouldn't do it despite knowing that people will have the ability to compromise themselves.

<comment><USER14> Well, their goals are clearly different. From the FAQ linked above, it is clear they want to have some control over "the experience", which is mentioned a lot.

If too many users install a crappy, buggy extension that slows everything down, they know _they_ will get a reputation for being a buggy and slow browser, regardless of whether it's their fault or not. It also creates incentives for extension authors to follow best practices where possible.

For people who really care about choices _for themselves_ , it's an open source project, it's not that hard to make an unrestricted fork under a different name that automatically tracks the upstream (as long as Android sideloading stays intact, plus it could also be published in Play Store as long as you don't use any of their trademarks). As far as I know there is nothing unique in the official branch that you would miss out on (when compared to e.g. missing out on Netflix or voiding warranty with custom ROMs - there are no such tradeoffs with simply using a fork of a browser).

It only creates a much higher barrier to adoption for unapproved extensions (because you now have to convince users to install another browser), so many developers simply won't bother, but that's not an issue if I understand your argument correctly.

<comment><USER15> > Well, their goals are clearly different. From the FAQ linked above, it is > clear they want to have some control over "the experience", which is > mentioned a lot.

Even without the linked FAQ it appears to be pretty straightforward that Mozilla values control given that they're about to change an open, decentral system to a tightly controlled curated app store.

It's just that this wasn't always the case. See, for example, point 5 of their manifesto where Mozilla states: "Individuals must have the ability to shape the Internet and their own experiences on the Internet." or in point 6 where they emphasize: "decentralized participation worldwide"

> If too many users install a crappy, buggy extension ... they will get a > reputation for being a buggy and slow browser ...

I have two concerns with this argument: The first is practical:

Is that a big problem? Are there numbers about large amounts of sideloaded extensions causing the reputation of firefox for android to drop? AFAIK sideloading is neither very common nor particularly rich of scandals. And even your earlier example was concerned with malicious extensions in Mozillas own extension store.

The old "Firefox for Android" enjoys a 4,4 star Play Store rating, compared to Previews also excellent 4,2 Star rating.

The second one is ethical:

Mozilla does not try to be the most successful browser _at any cost_. They provide valuable capacities to the Android ecosystem and drastically increase software freedom on the platform. If their goal were popularity, they would be much more successful by adopting Chrome under the hood and spending all their money on marketing.

Even your later argument features the condition "as long as Android sideloading stays intact" which itself already shows how dependent on a few central features the platforms freedom already is.

> it's not that hard to make an unrestricted fork under a different name

I don't see how trusting users to recompile an unrestricted firefox fork goes well together with not trusting users to sideload a browser extension.

> As far as I know there is nothing unique in the official branch that you > would miss out on.

Right now it's soft paywall blockers that are left out. (They just change referrers and cookies for specific sites.) But potentially it's all extensions, since Mozilla the corporation can be pressured into legal compliance.

In the future this might very well interfere with peoples ability to avoid censorship.

At the time at which centralizing a system is suggested it's almost never problematic, because problems only get apparent after centralization went into effect.

<comment><USER14> _> Are there numbers about large amounts of sideloaded extensions causing the reputation of firefox for android to drop?_

I'm not aware of any, but that could be because alternative browsers are not that popular on mobile in general.

The reputation of Android itself has definitely suffered due to sub-par apps (battery draining, slowdowns etc.) and downright malware (sometimes promoted via Google's own ad network).

 _> And even your earlier example was concerned with malicious extensions in Mozillas own extension store._

It seems they disabled sideloading on their desktop browser some time ago, so that was the only way it could've happened anyway.

[https://blog.mozilla.org/addons/2019/10/31/firefox-to- discon...](https://blog.mozilla.org/addons/2019/10/31/firefox-to-discontinue- sideloaded-extensions/) [https://blog.mozilla.org/addons/2020/03/10/support- for-exten...](https://blog.mozilla.org/addons/2020/03/10/support-for- extension-sideloading-has-ended/)

I don't know whether they currently do any review for extensions in the store (even automated one), or just manually ban bad actors.

(There is an additional reason to disable sideloading on desktop that I mentioned in a previous comment - other destkop apps installing shit without user action/approval, which cannot happen on mobile due to app isolation).

 _> I don't see how trusting users to recompile an unrestricted firefox fork goes well together with not trusting users to sideload a browser extension._

\- Their name wouldn't be on it. To publish in Play Store, a fork would have to scrub all Firefox branding from the app (see Iceweasel), and would then assume all responsibility.

\- Let's be honest, in practice, such a fork would be mostly used by highly technical users who are more likely to know what they're doing. Non-technical users would be far less likely to install it than some random 3rd party extension they come across. The Firefox name is fairly well known outside of tech circles. The name of some random fork would not be.

 _> In the future this might very well interfere with peoples ability to avoid censorship._

I agree that there is a risk that their official binary distribution could gain exclusive abilities in the future which are not part of the open source version (at which point Firefox would technically no longer be open source, e.g. Chrome vs. Chromium). Care should be taken that that doesn't happen.

Anyway, at the moment I'm far less concerned about extensions that they specifically want to ban/censor, and far more about 3rd party developers potentially losing the ability to innovate, _if the review process is only practically available to popular established players_ (who got popular while the ecosystem was still open) - because then how would a new project even get to that phase? That may or may not be an issue though, we'll see how it turns out.

<comment><USER14> Update (can't edit the comment on HN anymore):

So I misunderstood (only skimmed through) those 2 links about desktop Firefox sideloading, they use a different meaning of that term than what it commonly means on Android.

They only blocked 3rd party apps from installing extensions by themselves (which is good). User-installed extensions from outside of the Mozilla store are still allowed on desktop Firefox.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I read "for mobile" and was hopefully this would be for iOS as well but really it's "Firefox for Android"

And now all the Apple fans can tell me why it's so great that only WebKit is allowed on iOS. I'd like to run those extensions an on iOS browser and others but to do that I'd have to actually be able to ship a different browser engine.

<comment><USER17> I would be fine with Firefox for iOS not having access to extensions (after all, Mozilla can't help it Apple's app store policies won't allow that), but they could at least have some mercy on iOS users and just build in adblocking.. the web is borderline unusable without it.

<comment><USER18> This is the exact reason why I use Brave on IOS, it has built-in adblocking that works really well.

</comment></comment></comment><comment><USER19> I'm frustrated by the amount of versions of the Firefox browser that there are in the play store: five. It's not immediately clear which one is the closest to trunk.

Beta? Nightly? Preview? Preview Nightly? (The other one is the stable branch)

<comment><USER20> It'll be simpler once the switch to the rewrite (currently called "Firefox Preview") is done. Then _presumably_ we'll just have:

"Firefox" / "Firefox beta" / "Firefox nightly for developers"

"Firefox Focus"

<comment><USER21> The private windows in Firefox Preview behaves exactly like Firefox Focus. You can open links by default in a private window in settings.

I'm not sure if this means that Focus will be deprecated in favour of Preview, or will it remain a stripped down version of Preview.

<comment><USER12> Exactly like?

I'm under the impression Firefox Focus on Android uses the native (Chrome) renderer, not the the Gecko engine.

<comment><USER21> That was accurate until Focus v6. Since then, Focus switched to GeckoView, which is somehow different than Gecko, though I don't know how.

</comment></comment></comment></comment></comment><comment><AUTHOR> I was one of the people criticizing Mozilla for forcing Mobile Firefox users to upgrade to the newly-rewritten codebase while it still lacked support for any extension other than uBlock Origin, so I was pleased to see that they're making progress on supporting other highly-requested extensions.

<comment><USER22> The normal mobile Firefox still supports all extensions, you are not forced to run a GeckoView one yet.

<comment><USER23> They just transitioned Firefox Beta over to GeckoView, so the next version of non-beta will be GeckoView too, AFAIK.

</comment></comment></comment><comment><USER24> For someone who want firefox to success, I still am not happy with the performance of firefox preview.

Currently there is kiwi browser on Android not sure if they have for ios as well, which is chromium based and support extensions.

Recently the developer also make it open source. Shout out to the devs. [https://github.com/kiwibrowser/android](https://github.com/kiwibrowser/android)

<comment><USER25> Kiwi is the only one I'm aware of with a real dark/night mode for the entire browser. I was sold just on that.

<comment><USER26> Opera has the same functionality for dark mode.

</comment></comment></comment><comment><USER27> I got super excited until I realized this was only for Android.

<comment><USER28> An actual firefox for iOS is disallowed from by the app-store rules.

<comment><USER29> There is a Firefox Focus though: [https://apps.apple.com/us/app/firefox-focus- privacy-browser/...](https://apps.apple.com/us/app/firefox-focus-privacy- browser/id1055677337) I use Firefox Focus almost every day, mainly for "focused" browsing, i.e. one page at a time, no tabs; without tabs and the urge to open links you really get to focus on the current page more. It has some content blockers capable of blocking ads and trackers too, although in my regular browsing I use 1Blockers for configurability (say, disable cookies on news sites).

<comment><USER30> _> There is a Firefox Focus though_

It's still built on WebView.

<comment><USER29> Yes. But this article is about the browser called Firefox, not the rendering engine called Gecko. It is somehow common for HN commenters to conflate these two, or think that the rendering engine is the "soul" of the browser, a view I do not agree with.

</comment></comment></comment></comment></comment><comment><USER31> I'm lost now, there is firefox, firefox klar, firefox preview, firefox focus... what's going on there?

<comment><USER32> There are currently 3 Firefox browsers on Android

1\. Firefox: end-of-life browser built on legacy Firefox engine

2\. Firefox Preview: work in progress, soon to replace the old Firefox, rebuilt from scratch on new engine

3\. Firefox Focus: a minimal/reduced/simplified browser first developed to pilot the new engine

Klar is just the German name for Focus.

<comment><USER22> There are more than these 3.

For example Firefox Lite: [https://play.google.com/store/apps/details?id=org.mozilla.ro...](https://play.google.com/store/apps/details?id=org.mozilla.rocket&hl=en)

<comment><USER32> Thanks for this. I'd never heard of "Firefox Lite".

It appears to be an "Emerging Market Experiment" run by Mozilla Taiwan[0]

It also appears to be heavily based on or be a fork of Firefox Focus/Klar[1]

[0] [https://github.com/mozilla-tw/FirefoxLite](https://github.com/mozilla- tw/FirefoxLite)

[1] [https://github.com/mozilla- tw/FirefoxLite/pull/2/files](https://github.com/mozilla- tw/FirefoxLite/pull/2/files)

</comment></comment></comment></comment><comment><USER33> I so wish we could have this on iOS...

<comment><USER34> Its incredible how microsoft got in loads of legal trouble for bundling IE with windows but Apple got away with banning alternative browsers.

<comment><USER35> There are viable alternatives to Apple devices while Windows absolutely dominated. However, I kinda wish that there were some antitrust laws around vertical integration.

<comment><USER14> Also, commercial browser vendors were much more of a thing back then, so there was someone to complain.

</comment></comment></comment></comment><comment><USER36> Confused, I have been running NoScript in Firefox on Android for months now. What has changed?

<comment><USER37> This is referring to the rewritten Firefox for Android, codenamed "Fenix."

<comment><USER38> Firefox preview.

<comment><USER39> Which features a more Rust-heavy rewrites included in GeckoView via their Project Quantum work on desktop.

[https://www.infoq.com/news/2019/08/geckoview-firefox- preview...](https://www.infoq.com/news/2019/08/geckoview-firefox-preview/)

[https://old.reddit.com/r/firefox/comments/ep3tbx/eli5_what_h...](https://old.reddit.com/r/firefox/comments/ep3tbx/eli5_what_happened_to_the_gecko_rendering_engine/feh2h2c/)

<comment><USER37> That stuff was also included in Fennec (the current Firefox for Android).

GeckoView is completely orthogonal to Project Quantum. (I work on the GeckoView team).

</comment></comment></comment></comment></comment><comment><USER40> Does anyone know if this version of Firefox for Mobile can use self-hosted sync servers (even if using Firefox accounts)?

According to this GH issue[1] it is possible at least for the sync server part (not for the full account management), but I don't know if it made it into a stable release.

[1] [https://github.com/mozilla- mobile/fenix/issues/3762](https://github.com/mozilla-mobile/fenix/issues/3762)

</comment><comment><USER41> Will this new firfox support the full web extension API? That is, will it eventually run any web extension currently on addons.mozilla.org?

<comment><AUTHOR> That appears to be the intent, yes. [https://blog.mozilla.org/addons/2019/10/23/fx-preview- geckov...](https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckoview- add-ons-support/)

</comment></comment><comment><USER42> I got my hopes up a little too quickly.

Turns out "now" => "soon". The extensions in question, linked in the post, still display the same message of not being available for Android, and the article says the change will be within a few weeks:

"These add-ons will be available in Firefox Preview within the next 2 weeks."

<comment><AUTHOR> Note that this blog post was from April 14, I (the submitter) went looking for it after my copy of Firefox notified me of the change a few days ago. I am indeed using the nightly branch, but I find it to be quite stable.

<comment><USER42> Thanks, I didn't notice the date of the blog post and certainly didn't mean it as a personal affront because I appreciate the post. I'm going to switch to the nightly branch to try it out!

</comment></comment></comment><comment><USER43> Firefox is my browser of choice on desktop and the new mobile version is brilliant but I badly need an extension that will reverse light background websites to be dark. This is the only thing blocking me adopting it as mobile browser of choice.

<comment><USER44> Have you tried dark reader?

[https://addons.mozilla.org/en- US/android/addon/darkreader/](https://addons.mozilla.org/en- US/android/addon/darkreader/)

</comment></comment><comment><USER45> I'm pretty confused as to what I'm running, then. I always had Firefox Beta installed, and a month or so ago it got updated to what I think is Preview -- different UI, URL bar on the bottom, only uBlock Origin supported. Just checked right now, and the last update was April 21, but in my Addons list, it's still showing Privacy Badger and HTTPS Everywhere in the Unsupported list.

<comment><USER46> Wait a bit for the roll-out to complete. I find it's usually a couple days between announcement and an update hitting my phone.

<comment><USER45> Ah, I see. Seems like that announcement was three weeks ago, though.

</comment></comment></comment><comment><USER47> Will search shortcuts be fully operational before 1.0?

</comment><comment><USER48> I fear they're going to force it as the release version while supporting just 1% of most used extensions, forgetting that it's a fat-tailed distribution. I use video background fix to play youtube with a minimized browser (no I don't want to use a separate app if I don't have to).

At that point I'm just going to switch to Brave.

<comment><USER49> You don't have to, but using YouTube through the NewPipe app is light years ahead in terms of experience. You can listen to videos and playlists, program which videos will play next, reorder videos that are going to play, no ads. When playing on the background only the audio track is downloaded which is easier on your battery and internet connection. The UI is smooth. The app itself is lightweight. It remembers your history and search history but this happens locally on your device. It also supports PeerTube and SoundCloud. You can watch videos in popup mode though I never do that. The fullscreen player has vlc-like controls to easily change the brightness and volume level. I could go on and on. All that with completely free software.

Experience on the mobile website is shit in comparison especially on slow devices. I use Firefox mobile with the same extension + ublock origin but, as someone who hates installing apps when websites should do, do yourself a favor and don't ditch Firefox for Brave, try NewPipe, it's worth it :-)

Same thing for the Slide app to go to Reddit by the way.

</comment></comment><comment><USER50> I think I have a PTSD and I get scared of Firefox announcements. I feel like it is a Russian Roulette of speed improvements or random removal of features.

This looks very positive but I don't understand it, I have the extensions installed on my mobile since ages. So I look at the text and it says that it is based on recommended extensions. Recommended on what criteria I always wondered ? Business or security friendly? Or user friendly? How come uBlock is not recommended? That means that "recommended extensions" is not only a label for user assistance but also part of Firefox strategic decision making, oh my.

Is it a ploy to finally embed them to the severely limited IPhone experience as preexisting features rather as extensions, a long con to bypass Apple restrictions through initial Android introduction?

As I said I don't see what will change for me, I have already installed them for years. And they will stay installed until they become unavailable due to one strategic decision or another.

<comment><USER20> This is for Firefox Preview (preview as in "for testing"), a rewrite of Firefox for Android. It will eventually be renamed to Firefox for Android.

<comment><USER50> Yes it is clear that it will replace Firefox for Android, and as I said my main hope is that it will do so without deprecating parts of current functionality (especially regarding extensions) as it happened with previous main updates.

</comment></comment></comment><comment><USER51> Need Stylus to make 'collapse comment' buttons on HN adequately sized and quit sniping them.

</comment><comment><USER52> Tried Search by Image extension and it is great!

My major complaint is the tab management and the New Tab page. To be honest it is the worst I've ever seen. I hope that Mozilla invest much more on UI/UX.

<comment><USER53> Your comment isn't worth much if you don't say what you don't like about it. It's not perfect but to me it's pretty good.

</comment></comment><comment><USER54> The HN title is misleading, this is specifically about Firefox Preview, not Firefox Mobile which has supported these extensions for a while now. It should be edited.

</comment><comment><USER55> No uBlock Origin? It is much better compared to NoScript.

<comment><USER56> uBO was previously and is currently available. These are newly added addons

</comment></comment><comment><USER20> Oh dear, they really shouldn't use a gif[1] to demonstrate performance. The low frame-rate makes it look like the UI is stuttering.

[1]: [https://microsoft.github.io/microsoft-ui- xaml/img/performanc...](https://microsoft.github.io/microsoft-ui- xaml/img/performance2-min.gif) (drawing a heart over a picture of a dog)

</comment><comment><USER57> Any plans for any of these features without installing extension? Possibly by enabling menu option.

</comment><comment><USER58> Anyone know where to get the APK without building yourself or using Google services?

<comment><USER59> Use F-Droid. Firefox (and FF Klar) is available there.

[https://search.f-droid.org/?q=firefox](https://search.f-droid.org/?q=firefox)

(edit: confusion)

<comment><USER5> I don't see FF Preview in there. Nor would I expect to, as it is not currently Free Software:

[https://github.com/mozilla- mobile/fenix/issues/162](https://github.com/mozilla-mobile/fenix/issues/162)

<comment><USER59> Sorry, my bad, I get confused between the various versions :)

<comment><USER5> Easily done! This comment should be pinned to the top or something:

[https://news.ycombinator.com/item?id=23089413](https://news.ycombinator.com/item?id=23089413)

</comment></comment></comment></comment></comment><comment><USER60> Finally complete Dark mode with addon for mobile. Now I can forget Chromiums.

<comment> yjftsjthsd-h That's worked in the non-preview (old) version of Firefox on Android for ages. (Speaking as a happy user)

</comment></comment><comment><USER61> Mobile browser development should be the actual focus of Mozilla team.

</comment><comment><USER62> I like Firefox' design philosophy where you're bragging about how many third- party extensions a new version of your app supports.

Another vendor would be bragging about how much of third-party functionality they have built in.

</comment><comment><USER63> Does it have per-site process isolation yet?

</comment><comment><USER64> It is much more polished compared to the regular Firefox for mobile. But it is still very slow (network, the UI is very smooth) compared to all other browsers. And I can't force myself to just a handful of extensions when other browsers support all of them. So more waiting I guess.

</comment><comment><USER38> For iOS users wanting _similar_ functionality: use Safari's content blocker API.

The app HTTPS4All uses the same rule set as HTTPS everywhere:

[https://github.com/bouk/HTTPS4All](https://github.com/bouk/HTTPS4All)

For script blocking, AdGuard for iOS supports custom rules. Try:

      *$script

And to whitelist:

      *$script,domain=~example.com,~example2.com

Kind of a hassle. Mozilla _could_ just include something like this in their iOS browser skin of Safari.

<comment><USER65> Afaik Safari's content blockers don't work in iOS's Firefox.

Has this changed?

Also browser extensions aren't allowed on iOS due to Apple's policy. AFAIK you can't build your own browser engine that does JIT, you can't do remote code execution.

<comment><USER38> Correct, Safari's content blockers only apply to the Safari app. But Mozilla _could_ use their own content blockers in the Firefox iOS app (which is just a skin of Safari).

And yes, Safari's content blocking is very limited. You couldn't inject any of no-script's neutered scriptlets, for example.

In this sense, Android has an advantage over iOS because it isn't so restrictive.

</comment></comment></comment><comment><USER66> Hmm. Every Firefox browser I've downloaded from Mozilla and sideloaded onto my LineageOS devices has always supported uMatrix, HTTPSEverywhere and NoScript.

<comment><USER67> non-firefox preview browsers are on life support.</comment></comment>


A Primer on Type Systems - <AUTHOR> https://www.cs.uaf.edu/users/chappell/public_html/class/2018_spr/cs331/docs/types_primer.html <comment><USER2> I really liked this brief overview of type systems overall, but I especially liked that the author took the effort to move away from the terms "strongly typed" and "weakly typed". Too often these terms cause confusion. Even worse is when people confuse them for "statically typed" and "dynamically typed" (respectively), leading to people making claims like "Python is weakly typed" and "C is strongly typed" (which, depending on your definitions, are not true statements).

This material wasn't covered in my core curriculum for my CS degrees, which I think is a shame. Some students might find this stuff interesting, and I think introducing it to undergrads at least a little bit and saying "By the way, this is a thing you can research" could help some students with breaking into the academic side of CS.

<comment><USER3> It's more interesting to answer two questions:

1\. Can I easily subvert this type system?

2\. Can I make this type system map to concepts in the problem domain?

In C, the answer to 1 is "yes" and the answer to 2 is "to a limited extent". In fact, in C, you can subvert the type system so easily that it's considered impossible _not_ to, to the extent that using the standard library requires throwing type information away, by using pointers-to-void or generic "char" buffers, and as for the second... well, Apps Hungarian notation exists for a reason. (Systems Hungarian exists for a reason, too, but I'll try to keep the insults out of this post.)

[https://en.wikipedia.org/wiki/Hungarian_notation](https://en.wikipedia.org/wiki/Hungarian_notation)

The first question is interesting because it tells you if the type system can be used to enforce invariants, and the second question is interesting because it tells you if those invariants will be _worth_ enforcing. If you're writing in Standard Pascal, and your type system enforces array length as a part of array type, well, to quote a metal album: "So Far, So Good... So What?" What does that tell me about whether my program is semantically correct as regards the problem domain? Similarly with enforcing size specification types: Differentiating between a short, an int, and a long tells me Sweet Fanny Adams about what values of those sizes _mean_ in my program. Typing isn't "strong" if it's enforcing rules which ultimately make no sense, and if it's "sound", well, mathematical proofs of something I'm not interested in are themselves uninteresting.

<comment><USER4> >"well, Apps Hungarian notation exists for a reason. (Systems Hungarian exists for a reason, too, but I'll try to keep the insults out of this post.)"

Can you elaborate? I read the wiki page on Apps Hungarian. I am not following. How does/would this address issues with the type system in C?

>"Can I make this type system map to concepts in the problem domain?"

I didn't really follow your Pascal example explanation of this, you first mentioned "because it tells you if the type system can be used to enforce invariants." But the went on to talk about array lengths. How does whether or not the invariants are enforced by the type system help you answer the question of whether or not it maps to the problem domain? Might you be able to provide another example? Thanks.

<comment><USER3> > Can you elaborate? I read the wiki page on Apps Hungarian. I am not > following. How does/would this address issues with the type system in C?

Apps Hungarian allows you to encode information about the value a variable contains which you can't capture in the type system.

For example, imagine you're writing a program which handles user input. You need to distinguish between Sanitized Strings and Unsanitized Strings because if you don't, you open yourself up to security problems. Absent a way to extend the type system to put this information in a type, you do this:

        char *usStr; /* An Unsanitized String */

        char *snStr; /* A SaNitized string */

You add a couple letters to the beginnings of the variable names to encode what the type system doesn't.

You can see that if you have a line of code which says:

        snStr = usStr;

it is wrong, and your brain can print a full-color warning message with highlighting.

Bottom Line: Apps Hungarian makes it easier for _you_ to be the type checker.

> I didn't really follow your Pascal example explanation of this, you first > mentioned "because it tells you if the type system can be used to enforce > invariants." But the went on to talk about array lengths. How does whether > or not the invariants are enforced by the type system help you answer the > question of whether or not it maps to the problem domain? Might you be able > to provide another example? Thanks.

Array lengths are an invariant. They're just one I don't care about, because nothing in the problem domain is modeled by how long a given array is. The _contents_ of those arrays are much more important, and the types should vary based on that, instead.

A somewhat simplistic example:

You have a program which prints travel itineraries for people who must be addressed _correctly_ along the way, where _correctly_ means using their prenomial and postnomial titles. For example "Dr. Mary Richards, Ph.D." would be insulted to be merely "Mary Richards" or "Dr. Mary Richards, MD". You also have to print route information, which is a list of towns and states, like "Baltimore, MD".

Therefore, you have to ensure three things: Prenomials are always _prepended_ to names, postnomials are always _appended_ to names, and town names are always suffixed with state abbreviations. Oh, and if you print a name without prenomials and postnomials, you'll not escape unscathed.

Wouldn't it be nice if the type system were capable of keeping track of which strings were prenomials, postnomials, personal names, town names, and state abbreviations, to ensure you never try to append a state abbreviation onto a personal name, and never try to print a personal name alone? _Those_ are the kinds of _interesting_ invariants I'm talking about.

<comment><USER4> Thanks for the thorough explanations. This is really helpful. Cheers.

</comment></comment></comment></comment></comment><comment> munk-a Interestingly "statically typed" and "dynamically typed" are becoming less exclusive, there are code sniffers that can run static analysis of code to detect potential type incompatibilities during inspection and PHP even now has a group of parse errors that will be raised if incompatible classes definitions are detected i.e.

        class Foo { function do(): int { return 1; } }
        class Bar extends Foo { function do(): string { return 'a'; } }

while PHP will also do dynamic type checking during execution. I don't think this is surprising since static type enforcement has never been a requirement of a compiler/interpreter of a executable code page without run-time type checking - it's just a sort of bonus utility that is packaged into the process to make things easier. Whether your static code analyzer is in gcc or is just some separate utility it all works out in the end, so any sort of code linters are essentially doing a static type analysis (among other things, and usually language constraints prevent this analysis from being as much of a solid proof as languages designed to specifically be statically typed).

So I pretty strongly disagree that typing systems can either be static or dynamic, because I think the separation of manifest vs. implicit is a false one, lots of languages (again) support partially explicit type declarations while allowing some sort of support for a generic declaration.

<comment><USER5> Snigl [0] has statically typed function signatures, struct fields, bindings etc; but values still carry their type.

It also traces code before running it to eliminate as many type checks as possible.

The categories aren't very helpful from my perspective, same goes for compiler vs. interpreter. All it leads to is endless arguing about definitions and discouraging of novel approaches.

[0] [https://gitlab.com/sifoo/snigl#types](https://gitlab.com/sifoo/snigl#types)

<comment> munk-a I agree, and I don't think this is a bad trend, once upon a time I think static vs. dynamic was a clear distinction, that distinction is being worn down as we learn more about the value and costs of those approaches - and as that happens we're compromising the approaches to gain more of the value.

In PHP the (mostly _) JIT interpretation exposed a weakness where infrequently executed pieces of code were harder to have confidence in. Unit tests and such have raised our confidence but explicit typing can also raise our confidence in an easier manner, both are good to have but having access to more tools just makes our lives easier.

_ In fact PHP can be pre-cached in bytecode now (which is basically just a traditional compiled approach) and in the default run mode PHP code files are interpreted and then cached to minimize the number of times code needs to be interpreted. The lines between compiled vs. interpreted are getting really fuzzy now and were pretty fuzzy as far back as Java bytecode (which is as far as my memory goes, others may have a better handle on earlier experiments in partial compilation)

<comment><USER6> > I agree, and I don't think this is a bad trend, once upon a time I think > static vs. dynamic was a clear distinction

I think there's still a very clear distinction, but there's often value in having access to both in one language. The dynamic typing features can often make up for limitations of your type system, for instance.

</comment></comment></comment></comment><comment><USER7> C++ templates are not typed structually. The compiler does not assign types to them at all. Rather they are treated as macros and the type assignment and checking happens during the expansion. For example, one can write a template that has no valid expansion, but as long as nobody uses it, the compiler accepts it.

In sense templates are similar to dynamic languages. Except in C++ it is the compiler, not runtime, that evaluates the templates.

</comment><comment><USER8> > There does not seem to be any equivalent of the notion of soundness in the > world of dynamic typing. However, we can still talk about whether a dynamic > type system strictly enforces type safety.

My understanding is that there are well understood definitions of soundness for dynamically typed languages. The soundness theorem will generally be weaker ("your program will evaluate to a value or abort on a type confusion") but it is certainly possible to be sure a given dynamically typed language definition will never make mistakes like confusing an integer for a pointer. Though in the scheme of things such theorems are not much weaker than what you get for a statically typed language with exceptions ("your program will evaluate to a value with the given type or throw some exception").

<comment><USER6> It actually is significantly "weaker". You make the wrong analogy when you say the dynamically typed case maps to a statically typed one with an exception (which presumably is a value in your language).

The correct analogy is to a segfault, meaning the program exited abnormally because it's inconsistent in an important way. It's the reason statically typed languages are faster than dynamically languages: expressions have a fixed meaning than enables optimisation guarantees you can depend on.

</comment></comment><comment><USER9> As someone who is extremely unfamiliar with category theory, types, and C++, something is bothering me that I would love to have clarified.

Polymorphic function templates are introduced with addEm:

      template <typename T, typename U>
      T addEm(T a, U b)
      {
          return a + b;
      }

It seems to me that this is incorrect. From the Wikipedia page on C++ templates [1], a polymorphic function template is described like this:

      template <typename T>
      inline T max(T a, T b) {
          return a > b ? a : b;
      }

The first example seems to define a template so that the function takes two arguments of _different types,_ then relies on the compiler to reject inputs for `+' of types not defined for it. (This does not seem to track with the explanation following it, which indicates that addEm should take two arguments of the same type.)

The implication in the first example seems to be that if you want your template to be compatible with more than one type, you must explicitly indicate so in your template parameters. However, the Wikipedia entry seems to indicate that C++ implicitly instantiates object code for as many types as the template is called on at compile time, a function instantiated for each of the types (addEm<string>, addEm<int>, addEm<double>, etc.), and a compilation error resulting if inputs of different types are passed to the template.

Am I missing something? For reference, here is how I would intuit the first example should look, based on my current understanding.

      template <typename T>
      T addEm(T a, T b)
      {
          return a + b;
      }

I'll add that given my lack of knowledge of C++, it could well be that the template syntax allows types T and U to be the same in a particular instantiation of the template, but my understanding is that at least they _can_ be different, and why would you intentionally do that in this example?

1\. [https://en.wikipedia.org/wiki/Template_(C%2B%2B)](https://en.wikipedia.org/wiki/Template_\(C%2B%2B\))

<comment><USER10> I believe that your understanding is correct.

       template <typename T>

is a template with one "type parameter" (may not be the correct technical term), whereas

       template <typename T, typename U>

is a template with two type parameters, _and they can be different_. (That's why you give two parameters, so that they don't _have_ to be the same.)

<comment><USER9> I appreciate the sanity check with a depth and viscerality I can't properly express.

I also apologize to you and anyone reading for any inaccurate terminology on my part.

</comment></comment></comment><comment><USER11> I have to post this parody lightning talk because Gary Bernhardt is hilarious and the slides demonstrate some of the (exaggerated) confusion around static vs dynamic types.

[https://www.destroyallsoftware.com/talks/useing-youre- types-...](https://www.destroyallsoftware.com/talks/useing-youre-types-good)

</comment><comment><USER12> I found this article helpful. Since C is a "strongly typed" language it helps to review what is meant by type. In addition, like #DonaldPShimoda, I liked that the author challenged to the existing notions of type. Good read.

<comment><USER13> By all definitions, C is not strongly typed.

The author just points to selected links, without going to the links themselves. If you go to the link he points you to [1] where C typing is defined, you find that two of the three links there that claim C to be strongly typed are broken and the third link immediately qualifies the assertion with: "To be precise, relatively strongly-typed app-specific dialects of the not-very-strongly-typed language, C."

[1] [http://wiki.c2.com/?StronglyTyped](http://wiki.c2.com/?StronglyTyped)

</comment></comment><comment><USER14> The way the author describes static and dynamic typing seems to imply that static == compiled and dynamic == interpreted. I probably misunderstand something, can someone help me clear things up?

<comment><USER15> Dynamic typing boils down to runtime tagging of any value that could be referred to by a "dynamically-typed" variable. That's not "interpreted" in a strict sense, but it requires dispatching on _every single value access_ , which will definitely affect performance.

</comment></comment><comment><USER16> This is an excellent article.

The only thing I'd want to see added to it is a section on gradual typing, a la Perl 6.</comment>


Silicon Valley hasn't innovated since 1978 - <AUTHOR> https://medium.com/@enkiv2/silicon-valley-hasnt-innovated-since-1978-f98f315f2bf <comment><USER2> > Name one thing in computing that showed up after 1978 that wasn't either an > incremental improvement on a pre-1978 technology or a crappier but cheaper > version of a pre-1978 technology.

Hey, that's Alan Key's shtick!

He even posted it on StackOverflow, at [https://stackoverflow.com/questions/432922/significant- new-i...](https://stackoverflow.com/questions/432922/significant-new- inventions-in-computing-since-1980) \- "Significant new inventions in computing since 1980". That's back when SO was cool. ;)

The answers I like best are "Damas-Milner type inference" and "NTP (1985) based on Marzullo's algorithm (1984)".

(Most of the answers on SO reflect a lack of knowledge of when some idea first started.)

BTW, since this author picked 1978, then VisiCalc (1979) is a good counter- example.</comment>


Falsehoods programmers believe about networks - <AUTHOR> http://blog.erratasec.com/2012/06/falsehoods-programmers-believe-about.html#.WA2xdpMrJ-V <comment><USER3> It'd be great if someone wrote three lines explaining why one would believe each of those, why it's wrong, and why that's important.

<comment><USER4> I tried to write up a little about the ones that I know something about, here it is:

      Data on the network cannot be altered.

False, if something goes through another device, it can be altered. Important because, well, man in the middle.

      Encrypted data on the network cannot be altered.

Same as the above. Harder, but still doable

      Data cannot be accidentally corrupted, because TCP has checksums and Ethernet has CRCs

This is about like saying "only 1 bit can be flipped at once, so parity checking will always catch it"

      If it's inside my perimeter firewall, that means I have total control over it (@armorguy)

Similar to the top ones, still harder, but it's a weak point if someone gets into your perimeter at all.

      Packets arrive in the order in which they were sent.

Completely false, though TCP will reorder them back to the original order for you.

      If you can't ping the target, then it doesn't exist. (@jjarmoc)

Trivial to make a host not respond to pings

      If you can ping the target, then it does exist.

Again, trivial to make a router or any device respond to pings for a lot of IPs

      TCP RSTs come from end-nodes.

Devices in the middle sending RSTs is really common, google "comcast rst packets"

      Bytes must be "swapped" from the network byte-order to the host CPU byte-order.

IP/TCP and such protocol bytes must be swapped. The only thing that cares at the application layer is the application code, it can just say "everything is little endian" and be done with it.

      It's an internal web app -- outsiders won't be able to discover where it is (@biosshadow)

if this is about a "exposed under an obscure name", the tools like fierce can probe for it. If it's exposed to the internet at all, consider it under attack at all times.

      The DHCP address will be the same after a reboot (@shewfig)

Not necessarily true, depends on the DHCP server and such.

      The DHCP address will remain the same until the next reboot.

You get a lease time, OBSERVE IT. Don't just keep using it cause you say "this is mine still!"

      Well, it'll last a long time between changes

One culprit is coffeeshops, there have been reports of coffeeshops with 30 minute lease times. I've seen cable modems hand out 30 second leases, but that was when it was still trying to connect to the cable side, so it wanted the computer to keep checking back

      The DHCP server and local router are the same (@schrotthaufen)

Not at all a requirement, and would cause your packets to go off into nowhere if you tried to rely on it.

<comment><USER5> > The only thing that cares at the application layer is the application code,

True, but...

> it can just say "everything is little endian" and be done with it.

... doesn't quite follow. If you're blitting integers directly, your code will break on either a big- or little-endian boxes. Better to pick a standard encoding and always serialize/deserialize properly whatever that means. That standard encoding may be little-endian (maybe better than big-endian - <USER2> systems are overwhelmingly more common on the desktop/server) or may be some packed representation. But ideally you could change the representation without changing application code other than the serialization/deserialization itself (which may well live in a library).

<comment><USER6> I had taken that to read that there are programs in the wild that assume hosts are little endian and always "swap" bytes as opposed to converting between the two orders (which might be a no-op on a big endian system).

<comment><USER5> Yeah, that's probably the case, and quite possibly what was intended. I think my elaboration deals fine with that case too, though.

</comment></comment></comment></comment></comment><comment><USER7> Also:

\- MAC addresses are unique.

\- LANs won't be bridged.

\- Spanning tree will converge quickly.

\- Quickly enough that it will beat BIOS getting to DHCP for netbooting.

\- There will only be one circuit in the network so you can disable spanning tree.

\- The path MTU will be at least 1500 (or 9000, or x).

\- Path MTU discovery will work.

\- Packets with DF bit set won't be fragmented.

\- ICMP won't be dropped.

\- Network circuits will be the same path in both directions.

\- There will be one NIC / a default route.

\- The domain name 'localhost' will always resolve to localhost, or 127.0.0.1.

\- A DNS responder exists on the network.

\- It is a good idea to try to resolve IP addresses as names.

\- A device will use IPv4 by default (some systems opportunistically look for A and AAAA addresses and try both).

\- All networks have a path to the internet.

\- There will be no proxy required, or

\- The proxy won't require a login, or

\- The proxy credentials won't have a backslash.

I'm diverging higher up the stack at this point so I'll stop.

<comment><USER8> > MAC addresses are unique

Or at least they're unique on a single machine... except for the various OSes and hardware platforms that have deliberately made all MAC addresses the same for a given machine.

<comment><USER9> Way back in the land before time, I acquired a number of old 486s and ISA NICs. Being a good Slashdot nerd, I of course thought "lets make a Beowulf cluster of these!"

So I've got the cluster set up, and it's mostly working. There's two nodes though that behave funny. Imagine my surprise when I try pinging one of them and get two responses per ping! Sure enough, two ISA NICs pulled randomly out of a box of garbage indeed had identical MACs. I learned a lot about IP and the MAC layer from that project!

</comment></comment></comment><comment><USER10> One that has bitten me:

"ACKs come from an end node"

Cellular carriers will ACK a packet destined for a device on their network before they have actually delivered it if they have the device registered and are confident they can deliver the packet "soon." I have seen packets happily being ACKed that are destined for a device that I just powered down. About a minute later the carrier starts telling the truth, but now you have no idea what actually got through to your device.

</comment><comment><USER11> The IP address returned from each hop on a traceroute is from the actual device that the ICMP packet was originally sent to.

<comment><USER12> > The IP address returned from each hop on a traceroute is from the actual > device that the ICMP packet was originally sent to.

Actually - the return packets are ICMP (TTL expired in transit), but the packets you send, _by default_, are UDP.

Traceroute can indeed be instructed to use ICMP though, but it's not the default on an any OS I know.

<comment><USER11> I knew someone would say this.

Windows not uses ICMP by default, but there is no switch to use UDP packets instead of ICMP packets.[1]

Yes, I'm well aware that UDP is the default on most Unix-based systems.

1\. [https://technet.microsoft.com/en- us/library/cc940128.aspx](https://technet.microsoft.com/en- us/library/cc940128.aspx)

</comment></comment></comment><comment><USER13> I would add "local networks are fast":

[https://people.eecs.berkeley.edu/~rcs/research/interactive_l...](https://people.eecs.berkeley.edu/~rcs/research/interactive_latency.html)

</comment><comment><USER14> Why is this listed under falsehood?

"Bytes must be "swapped" from the network byte-order to the host CPU byte- order."

Don't PowerPC and Sparc hardware require byte swapping(depending on what endian mode they are in)? Or am I misreading this?

<comment><USER7> Well, NBO is big endian and PPC/Sparc/MIPS were usually BE in servers, now in routers and TVs, and LE in printers... Though POWER8 switched to LE.

So you can (and I have) write programs for these BE systems that completely neglect to use swizzling. You will also see code that doesn't use the swizzling macros (htons, ntohs, etc) because they 'know' the packets need to be swizzled and they do it always, when they shouldn't on some architectures.

</comment></comment><comment><USER15> Seems to have missed the falsehood that everything on the network will respond really quickly and so it's fine to have loads of blocking calls on starting an application

</comment><comment><USER16> A few more:

\- Localhost is 127.0.0.1

\- A TCP SYN will also always result in a SYN-ACK

\- Ok, a SYN-ACK or a RST

\- Ok, ok, an out-going TCP packet will always result in a TCP response

<comment><USER11> "Nobody will ever be stupid enough to stick debug data in TCP RST payloads on a production system"

[https://support.f5.com/kb/en- us/solutions/public/13000/200/s...](https://support.f5.com/kb/en- us/solutions/public/13000/200/sol13223.html)</comment></comment>