J: an alternative to cd that learns where you spend time - <AUTHOR> http://github.com/rupa/j/tree

<comment><USER3> This is nice.

Kind of but not really in a similar vein: I have 'sd' aliased to a small script that goes to the 'next interesting directory', where an 'interesting directory' is one with a visible non-directory or more than one sub-directory. So, for instance, if you're sitting at foo, and underneath you is bar/baz/bat/bit.txt, 'sd bar' will bring you all the way down to bat, and then 'sd ..' will pull you all the way back up to the previous interesting directory.

Just to keep from getting lost, it does a pwd when it gets where it's going, and because typing ls after cd had burned itself into my muscle memory, it goes ahead and does that, too.

It's a small thing, but I really like it for hopping around source trees in languages that use directories to denote package structure.

<comment><USER4> Post like you just did should have a mandatory link to the code :)

<comment><USER3> There's a python portion: <http://pastebin.com/f16aae31d>

And a small bash function (since you can only change your shell's pwd from the shell itself):

<http://pastebin.com/f5d93d12a>

<comment><USER4> Thanks!

</comment></comment></comment></comment><comment><AUTHOR> For any zsh users out there, I made a couple changes so it works in zsh: <http://github.com/burke/j>

<comment><USER5> Perfect, that's just what I was looking for. Thanks!

</comment></comment><comment><USER6> Very neat tool. I saw this when it was mentioned on a post I made not long ago.

If you want something you can simply add to .bashrc, here are some bash functions to also help jump around to directories you want: <http://mattie.posterous.com/some-handy-bash-commands>

There's a link there for the "up" command (taking you to some directory higher in your path with that name) and also for "down" (similar downward) and "cdd" which just does a rapid use of locate to find the first directory that matches.

</comment><comment><USER7> why not use CDPATH?

At work, I have the interesting heads of our source tree in CDPATH, so I can get to most directories I care about by typing their short names.

For instance [http://www.macosxhints.com/article.php?story=200503181431142...](http://www.macosxhints.com/article.php?story=2005031814311425)

<comment><USER8> Because you don't have to teach it, it just learns.

<comment><USER7> With J I have to visit directories to add them to my index. This ramp-up is annoying.

With CDPATH, I index it all at the beginning. If I find a new major head in my directory tree, I just add it.

<comment><USER9> It would be nice if it could look through .bash_history when it's first run, or something.

</comment></comment></comment></comment><comment><USER10> Ok, I feel like an idiot. When it says "source this into your .bashrc" what does it mean?

I know where .bashrc is, but simply pasting it into the file seems like .. the wrong way to do it. Couldn't really find an answer on Google

<comment><USER11> Add a line to the end of your ~/.bashrc file with:

        . $HOME/.bash/j.sh

(Change that path to point to wherever j.sh is, though ~/.bash is probably a good place for it.)

<comment><USER10> Thanks so much! Makes sense

</comment></comment></comment><comment><USER12> <http://www.commandlinefu.com/commands/by/senthil>

second one, simple - <USER2>

</comment><comment><USER13> My version: <http://akkartik.name/bash.html#cd>

But this is nice and self-contained.

</comment><comment><USER14> awesome. huge timesaver. wish it could for for cp paths too

<comment><USER15> you could add a completion for cp commands just like in the last line of j.sh

          complete -o dirnames -o filenames -C "j --complete" cp mv

or something similar.

</comment></comment><comment><USER16> I prefer the proggit headline: "Where the fuck has this been for the last 30 years? A cd command that learns."</comment>


Show HN: Basic Open Source Ticketing System Using Gmail API - <AUTHOR> https://github.com/nutanc/gmail_tickets

<comment><USER2> Good App for email ticketing.

</comment><comment><USER3> Nice..can you put a demo up?

<comment><AUTHOR> Have put up a quick demo at [http://gmail.ozonetel.com/gmail/login.html](http://gmail.ozonetel.com/gmail/login.html). There is no password protection. To test, choose some random username and provide access to gmail api(obviously, dont put your actual gmail id as your username just to be safe :)). You can then view your mails. I will clean out data everyday.

<comment><USER3> cool :) have you thought in making it a b2b?

<comment><AUTHOR> Sort of. We are currently testing it out for some processes in our company,Ozonetel. We will most probably provide this as an add on for for contact center solution Cloudagent,[http://ca.ozonetel.com](http://ca.ozonetel.com). But personally I would like to see how this project grows out in the open and what new things can be done with this.

As next steps, I want to add support for inboxapp and also analytics</comment></comment></comment></comment>


Here's How Police Get a Suspect's Facebook Information - <AUTHOR> http://mashable.com/2012/12/18/police-facebook/ <comment><USER2> Twitter are fairly transparent in their policies. You should read this if you want to get a sense for how a large social network can operate with "best practices" -- at a level that's practical anyway -- with respect to protecting user information: [https://support.twitter.com/articles/41949-guidelines-for- la...](https://support.twitter.com/articles/41949-guidelines-for-law- enforcement).

Of particular interest is their link to <http://www.law.cornell.edu/uscode/text/18/2705>, the part of the Stored Communications Act that allows a gov't entity to prevent the network from telling the end user about investigations under certain rules.

You should also take a look at the EFF's best practices stuff, such as <https://www.eff.org/wp/osp> (dated).

</comment><comment><USER3> The article only covers the police. I wonder what the potential differences there are that could be in effect for other agencies in the US or international forces. Is there still a real black back door for the right level of clearance ?

<comment><AUTHOR> Well other international forces could break in to those back doors. Or maybe facebook could gladly allow them in. As they say nobody is above the law!

</comment></comment><comment><USER4> "Police need a subpoena in order to access "basic subscriber records" including name, length of service, credit card information, email address(es), and a recent login/logout IP address(es). For the next level of information, including message headers and some IP addresses, a court order is required"

Those are the "basic" records?

<comment><AUTHOR> "For the real bounty -- messages, photos, videos, wall posts, and location information -- a search warrant is required."

Wondering why 'credit card information' is considered a basic record!</comment></comment>


Identifying and Eliminating Unintentional Ambiguity in Written Communication - <AUTHOR> https://graphthinking.blogspot.com/2020/09/identifying-and-eliminating.html <comment><USER2> > When responding to an email that has multiple questions, indicate which > question is being responded to.

I had a boss who would respond with "yes" or "that's fine" to an email with several questions. I guess he thought he was being concise, like famous CEOs. It was frustrating.

Now even in personal emails I try to do max 1 question per email, and if it's more than a couple sentences I repeat the question as the last line of the email.</comment>


Idea: an open platform for generating custom legal contracts - <AUTHOR> http://openideas.ideon.co/2011/cure-for-jurisdyslexia-discovered? <comment><USER2> I suggested this to a lawyer I respect once and he suggested I write a program to do my programming.

We discussed the concept in depth, and it might be more complex than you realize. Templates are one thing, but you probably can't "mixin" different clauses without generating legalese based on inter-clause dependencies...

<comment><USER3> Or it might be as easy as writing a compiler. These things are hard to prejudge.

<comment><USER4> Compiler writing is easy? No. (I've built compilers for large subsets of C and Java, as well as my own languages)

Lord help you if you try to write a perfectly conforming compiler for C++ (has it ever been done?), and the U.S. legal system is _at least_ an order of magnitude more complex than that.

<comment><USER5> To make that task even more complicated, people don't agree on what many of the rules are. Your "law compiler" would have to take in input and have output that's maybe this, or more likely this, but it could also be this...

</comment></comment></comment></comment><comment><USER6> Docracy (<http://docracy.com>) is a repository of crowd-sourced legal documents, designed for scenarios such as this. As others mention, it is very difficult to reliably construct working contracts from a cookbook of clauses. A sounder approach is to have a variety of complete templates, along with some community discussion and social proof of their worth.

</comment><comment><USER7> One thing to remember is that contracts depend on trust. Not only between you and the party signing, But also between you and your lawyer.

To succeed, the service would have to be trustworthy enough that I wouldn't feel the need to have a lawyer "double-check" the contract first. You could argue that just having a lawyer proofread the document would be far less costly though I guess.

It will take a lot of trust to get a service to the levels of trust required for some contracts. One mistake and you could be screwed.

</comment><comment><USER8> Lawyers sort of have this stuff already. They tend to be fill-in-the-blank templates originally built around WordPerfect.

But the law is, dare I mention this, heinously complex. Why? Because the _world_ is heinously complex. Law has to deal with everything and everyone; its subject domains cover all human activity.

One of the reasons lawyers stick to lawyerly gobbledigook is risk management. Various phrases and terms are embedded in lawyer-drafted documents because their meaning has been tested in court. They're known forms of words with known legal consequences.

If you turn law into a write-compile process (I once proposed this[1] and I was not the first), you run a series of new risks. The most dangerous being: which document is the "real" contract? Even if you include language saying "the generated document", too bad, the court might not agree.

Remember: every software system grows progressively more complex as it a) grows the boundaries of its domain coverage to remedy impedance mismatches and b) discovers strange and nasty corner cases.

Well the law is analogous, with the difference that the law has been hacked on for (in common law countries) for nearly a thousand years, including some very large patches.

It's complex because it's essentially complex.

[1] <http://clubtroppo.com.au/2007/08/25/programming-in-legal/>

</comment><comment><USER9> I've put many hundreds of hours into making my forms simple and to the point. I've considered dropping them into a public github repo, under a simple attribution license. I'd really like to have other people fork them and make pull requests for corrections/improvements.

Is there any interest in that?

</comment><comment><USER10> A company called Microsystems used to have a product named D3: <http://www.microsystems.com/pdfs/d3-success-stories.pdf>

Unfortunately, they had to discontinue the product, in part due to a patent dispute Microsoft lost about how it uses XML in Word, if I remember properly.

A solution like this needs to be flexible and allow the logic to be diverted by humans, but is a brilliant thing for real estate and other industries that are full of common books of contracts and rules.

</comment><comment><USER11> We're doing this right now at <http://www.iubenda.com> and Privacy Policies are our starting point. Anyway, I can assure you that's far from being simple :) Here you can see a sneak peek of the upcoming new version: [http://www.iubenda.com/blog/2011/10/12/a-brand-new- version-s...](http://www.iubenda.com/blog/2011/10/12/a-brand-new-version- sneak-peek/) :)

</comment><comment><USER12> Not sure how far off the mark this is, but Paperlex[1] could be interesting to check out.

1\. <https://paperlex.com/>

<comment><USER13> I second <https://paperlex.com>. I was at GA/NYC a week or two back when they publicly demoed for the first time. It was very impressive. Think markdown for legal documents. The most interesting thing about it, imho, was not the structured templating but the counter party signature mechanics. All done online and driven by the data in the document.

</comment></comment><comment><USER14> As far as legal contracts and forms for start-ups go, Orrick offers a "start- up tool kit": [http://www.orrick.com/practices/corporate/emergingCompanies/...](http://www.orrick.com/practices/corporate/emergingCompanies/startup/index.asp)

I'm not sure if their license allows you to modify and redistribute.

</comment><comment><USER15> I had similar idea, most of the time I get cookie-cutter contracts and having a service that would provide additional value as vault would be useful

<comment><USER15> to which Paperlex seems to answer almost exactly... good work

</comment></comment><comment><USER16> What about <http://contractual.ly> ?

</comment><comment><USER17> making a contract is fine but how can you enforce effectivly against someone who breaches the contract, imho a effective system would be able to produce initial drafts of litigation documents based on the contractual clauses breached, otherwise people will just break the contracts willy-nilly and you'll be forced to enter litigation yourself, or take your computer generated documents to a lawyer</comment>


Google Now has been updated, finally has a widget :-) - <AUTHOR> http://www.techradar.com/news/software/applications/google-now-widget-wanders-in-with-search-for-android-update-1131189

<comment><USER2> "Please don't do things to make titles stand out, like using uppercase or exclamation points, or adding a parenthetical remark saying how great an article is. It's implicit in submitting something that you think it's important."

"Otherwise please use the original title, unless it is misleading or linkbait."

<http://ycombinator.com/newsguidelines.html>

<comment><AUTHOR> Edited immediatly, but my previous title: ~"most awesome app has been updated" really reflects my personal opinion about the app.

Perhaps you have never tried it :)

<comment><USER2> I did, and I even agree with you, but it still makes a bad title. ;)</comment></comment></comment>


Cancer flashlights, solar leaves, and other killer new ideas from innovators - <AUTHOR> http://www.theatlantic.com/business/archive/2011/11/americas-next-killer-ideas-from-google-under-armour-and-more/249037/#.TtOTQMs49h4.hackernews <comment><USER2> "Indium is also a rare earth element, making it scarce and expensive."</comment>


WordPress theme boilerplate, now with responsive(+lazy-loading) image helpers - <AUTHOR>

The repo for the boilerplate is: https://github.com/MozaikAgency/wp-theme-bootstrap The helper mentioned below: https://github.com/MozaikAgency/wp-theme-bootstrap/blob/master/theme/library/class-ri.php Code demoing how the helper would be used: https://github.com/MozaikAgency/wp-theme-bootstrap/blob/ccdfb983676a94b5ff74e9ad4371c2cabd25d432/theme/page.php
Apart from the core feature of the theme starter, which is the robust build process, the theme boilerplate also comes with a small but growing library of helper classes for developing modern themes with WordPress.
The latest addition to this library is a small responsive images/background-images class which leverages the responsive images spec (polyfilled via picturefill (https://github.com/scottjehl/picturefill)) and the WordPress custom media sizes to make it a little easier to implement responsive images in your WordPress theme. The helper also supports aFarkas' lazySizes javascript library (https://github.com/aFarkas/lazysizes) to optionally lazy-load specific images. Finally the default configuration of the theme boilerplate also includes anselmh's object-fit polyfill (https://github.com/anselmh/object-fit) to allow you to use the object-fit css properties on your images. (btw please vote for this feature to be included in IE Edge!: https://wpdev.uservoice.com/forums/257854-microsoft-edge-developer/suggestions/6263790-object-fit-and-object-position)
That's all. We use this boilerplate at work everyday on new projects. Hope you find it useful/interesting! <comment><AUTHOR> All links in above txt:

1\. The repo for the boilerplate is: [https://github.com/MozaikAgency/wp- theme-bootstrap](https://github.com/MozaikAgency/wp-theme-bootstrap)

2\. The helper mentioned: [https://github.com/MozaikAgency/wp-theme- bootstrap/blob/mast...](https://github.com/MozaikAgency/wp-theme- bootstrap/blob/master/theme/library/class-ri.php)

3\. Code demoing how the helper would be used: [https://github.com/MozaikAgency/wp-theme- bootstrap/blob/ccdf...](https://github.com/MozaikAgency/wp-theme- bootstrap/blob/ccdfb983676a94b5ff74e9ad4371c2cabd25d432/theme/page.php)

4\. Resp images polyfill - PictureFill: [https://github.com/scottjehl/picturefill](https://github.com/scottjehl/picturefill)

5\. lazy-loading content js lib - lazySizes: [https://github.com/aFarkas/lazysizes](https://github.com/aFarkas/lazysizes)

6\. object-fit polyfill - Object-fit: [https://github.com/anselmh/object- fit](https://github.com/anselmh/object-fit)

7\. Vote for object-fit to be included in IE: [https://wpdev.uservoice.com/forums/257854-microsoft-edge- dev...](https://wpdev.uservoice.com/forums/257854-microsoft-edge- developer/suggestions/6263790-object-fit-and-object-position)</comment>


The Great Vim / Textmate Debate: Opinion #56 - How to make Vim more accessible - <AUTHOR> http://blog.cflewis.com/the-great-vim-textmate-debate-opinion-56

<comment><USER2> Defaults: Agreed, though those of us who have been on vim for a long time obviously have a .vimrc we carry around. It'd be nice to have a better set of defaults.

Plugins: Vimballs already solve this problem largely.

Automatically in insert mode: Oh gosh no. The only case where you'd want to start in insert mode, I'd guess, is a new file. If you're opening an existing file, you're not going to start wanting to type at the beginning of it. Generally the first command in a file is a search or jump to line.

The author mentioned that he wanted a plugin that can quickly comment a line. There's more than a few ways to do this manually in vim that is quick. For example, to comment a block:

^<ctrl-v><n>jI# <ctrl-[>

where <n> is the number of lines to comment. You can also easily write a command in your vimrc to comment the current line in one keystroke.

<comment><USER3> Thanks for that tip I would just have Visual mode, select lines, I, and then #, Esc Esc

I need like a vim tip a day or something to show me more of these tricks.

<comment><USER4> The vim users mailing list is extremely lively and full of little tidbits like this. I highly recommend following it.

<comment><USER5> You might also be interested in #vim on freenode. Get all your questions answered in real time.

<comment><USER6> I second this, the people in #vim are awesome and usually very quick to answer your questions. It's also one of the friendliest channels I've been in, for what it's worth.

</comment></comment></comment></comment></comment><comment><USER7> Warning: Mini Rant

It's funny that out of nowhere, all these ruby developers jump on the band wagon after reading a few blog posts. Then they immediately complain about it being so terrible.

The original version of vi was written in 1976. The first version of vim was released in 1991.

The 19/34 year old defaults of vim/vi aren't good enough for the hipster rubyists. However they seemed to be just fine for the hundreds or even thousands of systems developers and hackers who developed the foundation for the systems the take for granted. Rubyists are the loudest, most complaining, annoying group of egotistical developers to have ever existed. Vim is an editor, not emacs, not Textmate. There is no reason to use it or blog about it, or utter it's name if you don't think it fit's your work flow. Really, 99% of people don't care about your opinion on vim at all.

Also a small observation: Every Textmate user I have ever met (who all also happen to be rubyists) depends too much on "bundles" and snippet features.

<comment><USER8> > _The 19/34 year old defaults of vim/vi aren't good enough for the hipster > rubyists. However they seemed to be just fine for the hundreds or even > thousands of systems developers and hackers who developed the foundation for > the systems the take for granted._

Yes, because as we know these hackers have empty .vimrc files. No sirree, just the defaults thanks!

<comment><USER9> I do. The only time I set a .vimrc is on Debian-derived distros where they don't set nocompatible or syntax on.

vi has good defaults. If I used emacs, I'd have to drag around my config everywhere to set usable keybindings. With vi and vim I can just use the defaults everywhere.

<comment><USER10> I've gotten to the point where I'd rather use vi than MS notepad, but I'm still better with vanilla Emacs.

</comment></comment></comment></comment><comment><USER11> A few people have mentioned vimballs as a plugin solution. There are (at least) two other potential solutions for plugin handling: Pathogen and Vimana. Pathogen is what the blog author is actually using already, but he didn't realize it initially. He refers to a .vim repo on Github that "does some magic where [it] puts each plugin in its own directory under /~.vim/bundles/." What he describes here is based on Tim Pope's Pathogen: basically a plugin to manage all other plugins. I've been using Pathogen for a bit now, and it's excellent. Another solution is Cornelius Lin's Vimana, which I've heard very good things about, but I haven't tried. Some links below.

<http://github.com/tpope/vim-pathogen>

[http://tammersaleh.com/posts/the-modern-vim-config-with- path...](http://tammersaleh.com/posts/the-modern-vim-config-with-pathogen)

<http://ithaca.arpinum.org/2010/06/28/vim-updates.html>

<http://github.com/c9s/Vimana>

<comment><USER12> There are other similar solution for handling "bundles" (or plugins distributed as git repositories):

tpugin (on demand path manipulation): [http://github.com/tomtom/vimtlib/blob/master/macros/tplugin....](http://github.com/tomtom/vimtlib/blob/master/macros/tplugin.vim)

scriptmanager: <http://github.com/MarcWeber/vim-addon-manager>

</comment></comment><comment><USER13> So I know this won't be popular, but I've got to say it.

I'm baffled at these text editor debates.

It's almost like developers think that code-input is a significant part of their job. It's not. It's just some accidental complexity that goes with the territory. Speeding up your text-wrangling ability won't do anything to help you be a better/faster developer.

I use vim all the time (as well as a bunch of others) and yes of course it was an unnecessary pain-in-the-ass to learn. It's all mindless rote learning that doesn't prove anyone's smarter than anyone else either. My theory is that people won't admit this because they're already invested and on the other side of the steep learning curve.

The bottom line is that there's no editor that will make you a better programmer. If you're worried about quick input, you're probably banging out boilerplate and not working at the right level of abstraction.

<comment><USER14> Totally disagree. The kind of shoe you wear is conceptually orthogonal to your job of walking from one place to another. Practically, however, your choice will drastically impact your comfort, walking range, and possibly even overall health.

So pick an editor (or set of editors) that fits, is comfortable, and lets you walk, run, jog, and sprint.

<comment><USER13> I actually agree with everything you've said there. I just don't think the top editors are different enough in feature-set to make it matter much.

Your choice of text editor is just a micro-optimization. As much as I'd like, there isn't one that will turn me into the code-whisperer.

<comment><USER15> Sure it wont make you a code whisperer, but once you find an editor that works with your way of thought, you find some crazy cool stuff does happen. For me, it has become as if my editor is directly connected to my brain. If i want to go to a function definition, it just happens. If I want to search, i find myself a the target without every thinking "now i need to do a search". When refactoring I can move chunks of code around, and refit everything to the new pattern without any thought of the text level changes. This is brought by knowing a good tool well combined with knowing the code base and language well. However, without the tool I couldn't be nearly as effective.

</comment></comment></comment></comment><comment><USER16> I did not know there was a "great" debate between Textmate and Vim. I would expect the camps to be rather far apart. It would be nice if the "new" version of Textmate would come out. It seems to be floundering.

<comment><USER17> I think it's just a hot topic currently in the Ruby community because there is so much blogging and memes take hold faster than in other developer communities.

That said, I am a ruby developer on OS X, and I have been using TextMate as my primary editor even though I cut my teeth on basic vi usage 15 years ago. The fact that TextMate 2 is suffering serious second-system syndrome is undoubtedly a big part of why Vim is getting so much mindshare.

TextMate is an amazing editor, and in my (limited) experience, certainly one of the few in the last 2 decades to even attempt to challenge emacs/vim on their own turf (ie. lightweight powerful editors). But ultimately I think a one-developer closed source model will never be able to create a third truly great editor.

The main factors driving me towards vim are maturity and general editing optimality.

Maturity because vim has been around and is open source, so millions of wrinkles have been ironed out: very few crashing bugs, good performance on large files, handles edge cases well and has settings for probably anything you'd ever need, etc.

Optimality because vi attempts to allow editing with the fewest number of keystrokes. Becoming fluent in vi means that for any type of text editing you can make any desired change in a near optimal number of keystrokes. It's a pretty safe bet that no one will ever come up with a more optimal editor for such a wide range of tasks. Sure IDEs have a high local maxima, but they fall off quickly as you jump to files that fall outside known semantics. TextMate gives you a middle ground for writing quick snippets and commands, but I'm starting to question the long term value of that versus the benefits of universal availability and just taking some time to find good plugins for various language-specific development.

<comment><AUTHOR> I definitely felt somewhat pushed by the mythical creature that TextMate 2 is. This isn't to say I have any outstanding critical issues with TextMate as it is, more that I feel like I've plateaued with it, but I know there's a faster way of doing things by watching Vim masters at work.

Katz's post was the catalyst to pushing me to actually go and try it; he seemed like he was a similar mindset to me, and his success spurred me on.

</comment></comment></comment><comment><USER18> Regarding the plugin issue, the solution is already around, .vba files: <http://vimdoc.sourceforge.net/htmldoc/pi_vimball.html>

Actually, the doc says that you need to do the following:

      vim someplugin.vba
      :so %
      :q

With macVim, I found that simply double clicking the .vba in finder does everything needed.

</comment><comment><USER19> I recently converted from various other graphical IDE's (Visual Studio and Eclipse) to start using exclusively Vim to develop with, and I'm loving it.

I don't think it really needs to be made more accessible, but what would have been AWESOME would be to have known about vim-tutor. I only just found out about it after I've spent a few weeks working in Vim, and have largely passed the time when vim-tutor would have helped. It REALLY should be on the main vim screen, not in the help.

Maybe I'm weird in that I have an inherent distrust the help in open source apps. Most of the times, they seem to be archaic, and targeted at the very advanced users (see man pages).

Thankfully, I've passed the initial stumbling-around period, and now know that the help is actually written in a very readable format. Maybe all that needs to happen is for that to be better communicated.

\-- Ayjay on Fedang

</comment><comment><USER20> Funny timing, I just started my annual "gonna try to switch from TextMate to vim" last night.

It seems like every time I do this the amount of time I use vim gets longer and longer (went from a few days to a week to a few weeks to a month). Every time I learn more and more things that make me edge toward switching to vim full-time. I've got pretty much all the basics down, and I think I might stick to it this time.

The things that are helping me out the most this time are: increasing my system key repeat rate, lowering the repeat delay, and buying PeepOpen <http://peepcode.com/products/peepopen>

<comment><USER21> For the next step, I highly recommend Vimperator plugin for Firefox. It uses Vim keybindings and really gets your fingers used to using the letters for commands instead of ctrl+keys.

</comment></comment><comment><USER22> _This was all the proof I had previously needed that Vim wasn't for me; the only command I ever learnt previously was :!q._

I guess he wrote a shell script at ~/bin/q that killed Vim processes?

</comment><comment><USER11> A sidenote, but for people who are following the Vim 7.3 betas, 7.3e (which is meant to be the last beta - this is last call for problems) was out yesterday. I've been using 7.3 a little, and persistent undo (undo history between editing sessions) is very nice.

Announcement and how to get it: <http://xrl.us/bhvizi>

</comment><comment><USER23> I wonder what things would have been like if they'd used BBEdit for that Rails screencast, way back when.

</comment><comment><USER24> Does vimtutor not come with MacVim? It would have alleviated some of his issues.

</comment><comment><USER25> But Vim is IMO ugly. Even Emacs looks so much better.. Vim is so.. character based.

</comment><comment><USER26> Sounds like the "more accessible" version of Vim is Emacs.</comment>


The Social Responsibility of Business Is to Increase Its Profits [pdf] - <AUTHOR> http://www.umich.edu/~thecore/doc/Friedman.pdf <comment><USER2> This only works in an ideal world where all of the externalities are understood, people have a good understanding of what they're buying, regulatory capture doesn't happen and lower quality (cheaper) essential services are available.

Some examples of this creating serious problems:

housing (only the most expensive housing that can be sold/rented gets built.)

push notifications (it costs very little for apple to run their push service and they could allow users to select a different one if it really was expensive. The result of only allowing paid notifications is that most people can't subscribe to notifications they want, from people, and instead get marketing spam "reminding them the app is installed." This has badly distorted the evolution of the internet and I would argue is a big reason there are no longer any popular open chat protocols.)

Just about any kind of chemical plant/farm (until recently the public didn't really understand how nasty some of these pesticides were for example, not to mention that these farms tend to abuse antibiotics and become breading grounds for antibiotic resistant bacteria.)</comment>


Pipeline and chain operators (|| and &&) now in pwsh - <AUTHOR> https://github.com/PowerShell/PowerShell/pull/9849 <comment><USER2> Oh, this is my PR!

Also worth taking a look at the RFC[0] and the original issue[1].

Just to address some questions in the comments:

These operators had no equivalent in PowerShell previously, but they'd always been planned from the outset. If you look at the diffs in the parser, one of the things taken out is a comment where we parse `&&`/`||` saying something like "we should implement this for v3" (I can't seem to get a link on my phone but don't have a computer handy). In [1], mklement0 gives an excellent history of the request for these operators. I owe a blog post on this, so hopefully I can expand upon that.

Also, the pwsh/PowerShell thing exists partially because of needing to exist side-by-side with Windows PowerShell and partially because it wasn't always clear that PowerShell 7 would be the direction of PowerShell into the future.

As a result, pwsh refers to PowerShell 6/7\. PowerShell 6 was called PowerShell Core, but since PowerShell 7 has restored compatibility with a lot of Windows functionality, we've dropped the Core for PowerShell 7. And since PowerShell 5.1 and below are bound to Windows, they're now qualified as Windows PowerShell.

Finally, a lot of users call PowerShell `posh`, but that was already the name of a shell in the Linux ecosystem, and after an early lesson with clobbering native utilities with aliases on *nix, the PowerShell team wanted to be good citizens.

Feel free to fire any questions at me too!

[0]: [https://github.com/PowerShell/PowerShell- RFC/pull/192](https://github.com/PowerShell/PowerShell-RFC/pull/192) [1]: [https://github.com/PowerShell/PowerShell/issues/3241](https://github.com/PowerShell/PowerShell/issues/3241)

<comment><AUTHOR> `node` had something similar - there was already a package called `node` (I think it was something to do with ham radio) on some distros.

Did you ever talk to the owner of `posh`? [https://www.commandlinux.com/man- page/man1/posh.1.html](https://www.commandlinux.com/man-page/man1/posh.1.html) Or think about using the `alternatives` system (which handles 'sendmail' 'node' and other shared names)?

<comment><USER2> (Sorry for the late response. Currently on vacation without a laptop.)

I wasn't on the team when that change was made but I think it was discussed in [0].

I'm not certain, but I suspect the reasoning went that a new name was needed to not clash with `powershell.exe` but it wasn't certain to be `posh`. So unlike `node`, which had a clashing name from the outset, PowerShell never used or owned `posh`, making the choice of `pwsh` a simpler way to avoid clobbering another tool (and the subsequent complexity of the processes you mentioned).

[0]: [https://github.com/PowerShell/PowerShell/issues/4214](https://github.com/PowerShell/PowerShell/issues/4214)

</comment></comment></comment><comment><USER3> I've had to implement quite a bit of powershell scripting in my new job. I've always thought that their philosophy of "everything is an object" made sense, but looking at powershell scripts has always somehow made my skin crawl, probably because it's so different from years of ingrained bash scripting.

There's definitely a learning curve (and it's harder to find information online), but once you get used to it, it's actually a pretty pleasant, cross- platform scripting experience. I'd definitely say that I'm comfortable doing more advanced scripts in powershell than I ever was in bash. If I had to use anything more complex than a for-loop in bash, I would reach for a "proper" programming language - but I can do quite a bit more in powershell without having to switch.

<comment><USER4> I think the verboseness is a huge turn-off for beginners --- it's like a mix of C# and bash. The general prevalence of uppercase characters (I believe it's case-insensitive like a lot of Windows things, so I don't really understand why they had to capitalise words which are already hyphen-separated) also adds to the overall "clumsy" look.

In contrast, bash scripting is basically entirely lowercase with very minor exceptions.

<comment><USER5> A notable thing about unix commands is that they're usually very short: "cd", "ls", "grep", "sed", "cat", etc. This is obviously a remnant of earlier times, but I actually think that it serves the unix command quite well even today. These are commands you want to type quickly and many right after another. Powershell's "Get-ChildItem" and "Select-String" are annoyingly verbose in comparison.

<comment><USER6> Get-ChildItem is gci. For Select-String I don't think there is a shorter version. Many of the commands have shorter aliases they are just not as intuitive.

/r/PowerShell is really helpful if you are stuck also there is a Slack POSH group that is really helpful.

<comment><USER7> "sls" is select-string.

Get-Alias to see them all. "get-alias -Definition Select-String" to look for one for a specific command.

</comment></comment></comment></comment></comment><comment><USER8> Pwsh = Powershell. I use it from time to time yet the short name didn't click when I read title.

<comment><USER9> I thought the short-form most people used was `posh`, personally, but I might be wrong.

<comment><USER10> pwsh is simply the name of the binary of PowerShell Core. They gave it a different name to allow side-by-side installation, and to align with other shells on *nix (sh, bash, zsh, fish, ...)

</comment></comment></comment><comment><USER11> I'm not familiar with the usage of "pipeline" in this context. Could a kind soul elaborate? These look like boolean operators to me.

<comment><USER12> Comes from unix. You "pipe" the output of one program to the input of another. In unix shell scripts it's common to use `|` symbol for this in shells. It's just a different paradigm of composing scripts that can be quite natural.

Chaining means you run one command followed by the other, so "&&" could be read as "and then"

<comment><USER11> Right but Powershell has '|' for piping objects between commands. What does || do that the current operator doesn't support or is it just another way of saying -or?

Edit: nvm, I see below these are emulating the behaviour expected from bash. I guess it's called the pipeline operator because it uses the pipe symbol rather than doing any piping.

<comment><USER2> In my RFC I dubbed them (&& and ||) the pipeline _chain_ operators because you use them to chain syntactic pipelines together conditionally.

The POSIX shell spec calls them AND-OR lists, which I didn't think was as descriptive.

To explain the pipeline idea a bit better, there are two ways of seeing a pipeline (in PowerShell or in a POSIX shell). One is at runtime; a command executes, taking its input from an input and spitting it out to an output. Chain a few commands together hooking the output of one to the input of another and you have a pipeline. (In POSIX shells of course these in/out locations are file descriptors, whereas in PowerShell they're memory locations.)

But also a pipeline can refer to the syntax of a pipeline; something like `ls | grep "* .txt"` is a pipeline in terms of the POSIX shell grammar. Similarly in PowerShell, `gci | ? Name -like "* .txt"` is a pipeline syntax. And since you can chain these pipelines together with && and ||, I called the operators "pipeline chain operators".

BTW, if you ever want to look at the abstract syntax tree of a PowerShell command, it's very easy to do by wrapping it in a scriptblock and grabbing its AST:

       $ast = { gi file.txt && rm file.txt }.Ast
       $ast.EndBlock.Statements[0]

<comment><USER11> Interesting. Thanks for the detailed response!

</comment></comment></comment></comment></comment><comment><USER13> I'm surprised these weren't supported until now. Or maybe they were with a different syntax?

<comment><USER14> First few lines of the link answers that question:

cmd1; if ($?) { cmd2 } = cmd1 && cmd2

cmd1; if (-not $?) { cmd2 } = cmd1 || cmd2

Just your usual Powershell verboseness.

<comment><USER15> Their logical operators page says it also supports -and and -or. I can't tell if _" cmd1 -and cmd2"_ would have already worked. It sounds like unadorned "cmd1" didn't return the equivalent of $? before this PR.

<comment><USER7> No it wouldn't work, cmd1 would return the stdout output of cmd1 if you could do that at all, but it would really try to use -and cmd2 as parameters to cmd1.

<comment><USER15> Interesting. Switching back and forth from Powershell and bash must be hard. Also $? has the exact opposite meaning in a Unix shell. $? as zero indicates success.</comment></comment></comment></comment></comment>


How we pronounce WWW in English: a brief and unscientific survey - <AUTHOR> http://charlieharvey.org.uk/page/how_we_pronounce_www <comment><USER2> Why say it at all? It's sort of a given at this point.

Very few sites fail to appear if you drop it entirely since they have DNS pointers for both ways.</comment>


Savitech USB audio drivers install a new root CA certificate - <AUTHOR> https://www.kb.cert.org/vuls/id/446847 <comment> ryan-c The "Universal ADB Driver" for Android devices[1] also installs a root CA, however it instead generates the CA during install, signs the driver, deletes the private key, then installs the CA and driver.

1\. [https://github.com/koush/UniversalAdbDriver](https://github.com/koush/UniversalAdbDriver)

<comment><USER2> What good is a root CA with no key?

<comment><USER3> It is actually clever:

\- generate a fake CA and use it to sign your driver on the fly;

\- add the generated root CA to the trusted list

\- delete the private key so that nobody else can sign anything with this CA

\- now windows will happily consider this driver as worthy of trust and install it.

<comment><USER4> That sounds very un-clever (edit: I mean by Microsoft). Why couldn't malware do the exact same thing?

<comment><USER5> It absolutely could. The alternative is that Microsoft has complete control over what software can run on any Windows PC. It turns out that people who want this ("Man. I wish I could only run programs chosen by the monopoly supplier") already have an iPad so this basically just creates a backlash.

I know what you're thinking "Oh, well there could be an exception for when you need it, you'd just use admin to authorize it or something" and that's exactly what this is.

<comment><USER6> > The alternative is that Microsoft has complete control over what software > can run on any Windows PC.

That would be the relatively little known (and new) Windows 10 S, where only apps from the Windows Store can be installed or run. Designed for security (?) and to compete with Chromebooks.

See also Windows RT

<comment> m-p-3 I can see some scenarios where this would be desirable. Like my grandparents, who basically just wants to browse Facebook, etc.

Since they have a Chromebox, I do not have any calls regarding viruses or their computer being slow, etc.

<comment><USER7> But the desirability is proportional to the level of moderation of the store and Microsoft's is complete shit: it's full of not-quite-malware and not- quite-scams.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I am not saddened by this event, but by the fact that such occurrences will only add momentum to the movement to lock down computing devices and take freedom away from their users:

[https://news.ycombinator.com/item?id=12061320](https://news.ycombinator.com/item?id=12061320)

Those worrying about security should remember that device drivers already run in ring 0 and can do anything they damn well please.

Thus I say: Good on Savitech for not being afraid to rebel against; and fuckings to the corporatocracy that is certificate authorities and the authoritarian security industry.

<comment><USER9> I do not know what to do anymore.

I am with you here, as I've been for many years (you link to a comment of yours that links to a comment of mine, for that effect). I'm even fond of saying, "security vs. fun - pick one". But I start to increasingly understand the arguments from the other side.

Consider: what I consider an essential "fun" of computing is being able to alter software running on my machine as I see fit. If I want to make it so that Windows Notepad is pink, or supports Emacs shortcuts, I should be able to mess with both binary on my hard drive _and_ running process in memory, because it's my computer and my rules. But the same mechanisms allow an evil person to make _my mother 's_ Notepad look like her e-mail account login screen and exfiltrate data from that. I dream of having an OS as malleable and tightly integrated as Lisp Machines were, but I wouldn't dare connect it to the Internet these days.

So what can one do? How to approach it? Is there even a way to create a computer that both respects the end-user as its rightful owner and can be safely used to conduct business and pleasure on-line? I honestly don't know if this is even possible in principle. If it is, I would appreciate being pointed towards possible solutions, because this - I believe - is a case worth fighting for.

<comment><USER10> The problem is that "end-user" means two very different things. Most hackers still think of "end-user" as you and me (note the answers you're getting), and this is why Free Software is losing battles left and right, particularly in mobile. Stallman's comments re: iPhone, for example, demonstrate that as an industry and advocacy group we still don't _really_ understand this.

We have to accept that those who _need_ rigid, inflexible computing to protect them far outnumber us. People don't care if they can rewrite Notepad or read its source code, they care that Facebook works and that they don't get viruses or added to a botnet. The _only_ way to develop a healthy advocacy here is to understand that the hacker ideals and customizability that we expect of a computing system really make us a vanishing minority and acknowledging that for the now-average user, those ideals make less and less sense as time goes on. We had our run, then everybody else found computers. Times change. It's not bad.

Is there a way to create your computer? For us, probably. For them, I'm increasingly believing it isn't. This isn't a knock against anyone, just an acknowledgment that there are almost certainly two answers to this question and Free Software ideals and beliefs aren't equipped to handle the much, much larger answer. Proprietary operating systems, walled gardens, Internet centralization, it plays toward all of the ideals Free Software has been holding dear for decades. We have to evolve our thinking, I'm afraid. The less we acknowledge that perhaps Free Software is wrong for the average user, the less we will have a voice at the table; eventually, nobody will listen at all.

Hell, many cars don't even allow you to work on them any more. Look at Teslas, higher-end Audis, etc. I offered to change my neighbor's oil in his Audi and he got scared about his warranty.

<comment><USER9> Heh.

It's good you brought up cars, as they're a perfect example of conflicting needs. Cars are now computers on wheels, and while I'd love to drive a car I personally modded at firmware level, I would also be against allowing such cars on public roads. One, hackers make mistakes, and two, malicious actors would trick regular people into modding their cars to further their malicious goals. Both reasons create public hazard. Which is obvious in case of cars, but less obvious with computers connected to the Internet.

At this point I fear we might need to fork computing entirely - let the regular users live in "hell" of propertiary, locked down _services_ they don't actually own, while ourselves, we get the "heaven" of free software... that's pretty much not allowed to interact with regular users. I don't see how to keep the two worlds as one, because all features meant for hackers can also be used by malicious actors to pwn people.

Consider e.g. dev console in a web browser. All is cool, because regular users don't know what F12 does and wouldn't even think of pressing it. But then Facebook and others have to put Self-XSS measures into place, because a malicious actor can _tell_ a regular user what F12 does, and how it "can" let them see who viewed their Facebook profile...

I hate the idea of split world. It means I won't be able to e.g. automate my banking or pizza delivery, because those things will have to go through "dumb" computing, to avoid self-pwnage risks. It means that eventually I won't be able to even get a general-purpose computer, because the nature of niche markets is that they generally _don 't_ get served with good stuff at accessible prices - they either get served at exorbitant prices, or don't get served at all.

So I don't want that split world. I want an alternative to fight for. But as I previously wrote, I can't see any.

<comment><USER11> I am of two minds of such a split world, as all too often it means that when a geek is called on to fix something for the rest of us, they invariably can't because they can't get the right access.

Never mind that i fear that the black hats of the world will always find a way to break the sandbox of the "safe" computers, and thus we are effectively fucked. Because now they have access on a level the rest of us do not, and thus can't counter their actions.

BTW, i do believe Cory Doctorow has done a couple of speaking tours on this under the titles "The coming war on general purpose computing" and "The coming civil war on general purpose computing".

The first being about government demands for a computer that do everything but some naughty action, and the second about well meaning geeks locking down computers to make them "safer".

</comment></comment></comment></comment></comment><comment><USER12> Why does Windows allow programs to install root CA certs without separate user intervention (beyond the initial "grant admin permissions" dialog)?

<comment><USER13> Maybe it's time for desktop operating systems to adopt permissions systems like smartphones. Permission for network access, permission for non-current user files and registry, permission to install certs.

<comment><USER14> The problem is how do you educate users on these prompts.

On smartphones permissions are pretty obvious (Camera, Contacts, Location, Pictures) but even they sometimes have consequences beyond the obvious.

How would would one even begin to word a certificate store permission so that the average person would understand the consequences of it?

<comment><USER15> I consider myself tech savvy (by no means do I understand that much more than an average user). When I tried to enable my company's mail on my personal iPhone, I was prompted to install a certificate. In my haste I thought it was just a certificate for *.my-company.com domains, but iPhone showed me a message in the likes of "the owner of the certificate would be able to read/modify all my network communication, monitor/install/uninstall all apps I have... " and so on. That was enough to stop me in my tracks and now I'm waiting for a company phone instead.

<comment><USER6> That's pretty common, and is one of the reasons for some of the third party exchange clients on Android devices. At least one of the early ones (Nitro?) maintained its own separate data store for email and possibly other things so that when policies were used to wipe data it could wipe only the data in that app instead of the entire device.

The counter to that is that now I believe there are a bunch of Exchange clients on Android that will simply ignore server policy or where handling of policy can be controlled in the settings, which kind of defeats the point.

The original point of all those policies was to be able to erase supposedly secure content if the device was lost or if someone left the company for whatever reason.

Edit: the Exchange client I was thinking of is TouchDown, now owned (and EOLed) by Symantec but I believe originally from NitroDesk.

</comment></comment></comment></comment></comment><comment><USER16> I would honestly be more worried about the root CAs which are enabled by default in the most popular OSes and browsers, with root CA privileges for government of China controlled entities, Turkish government entities and unethical/shoddy root CAs such as Symantec. The Netherlands recently passed a law allowing the government specifically to use false keys and run MITM on crypto, which brings into question all .NL based CAs.

<comment><USER17> Do you have a reference to this law in The Netherlands?

<comment><USER18> There is an upcomming advisory (i.e. non-binding) referendum about this law coming up. Specifically, the referendum is about reversing the law.

Notably, some parties in the newly minted government have declared their intention to ignore the referendum. They back this by two arguments "It is needed for security" and "We are going to remove the advisory referendum anyway, so we get to ignore this one".

That second point is kind of interesting, because the referendum is possible due to a rather new law. We had one before that went rather poorly, so now we want to get rid of it.

The actual law is here [1] this site [2] advocates for the referendum. I'm afraid I don't know of any english sources.

Quoting from the law, and applying my own translation

>>

Article 45. Member 1

The services are authorized to:

a. (Basically, do exploratory searches of networks)

b. Use false signals, false keys, false identity or intervention by third parties to gain acces to automated systems. This can be done with the help of technical tooling.

Article 45. Member 2 The authorization from member 1b above also authorizes:

a. The defeating of any security measures

b. Installing technical measures to reverse encryption on data stored or processed by automated systems. c. (references article 40)

d. To copy data stored or processed by an automated system.

Article 45 Member 2 (summarized, the government needs to give written permission for any of the above to happen)

>>

This seems to be the referenced passage based on a preliminary search.

[1] [https://zoek.officielebekendmakingen.nl/kst-34588-A.html](https://zoek.officielebekendmakingen.nl/kst-34588-A.html)

[2][https://sleepwet.nl/](https://sleepwet.nl/)

<comment><USER17> Thanks, I did not realize the "sleepwet" also authorized defeating encryption.

</comment></comment></comment></comment><comment> brian-armstrong So this is a CFAA violation, right? When will we finally hold someone accountable for blatant security issues like this?

<comment><USER19> In this specific case (installing a root certificate) I would say it's not actually a CFAA violation because they're not "obtaining information", "defrauding", or "intentionally causing damage". You might be able to argue that installing the driver on a "government computer" produces a violation of 18 USC 1030 (a) (3), but the rules for a mere "protected computer" which covers most internet-connected personal computers are actually not strict enough to cover this.

[https://www.law.cornell.edu/uscode/text/18/1030](https://www.law.cornell.edu/uscode/text/18/1030)

<comment><USER20> "Whoever [...] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [...] shall be punished as provided in subsection (c) of this section."

"[T]he term 'protected computer' means a computer [...] which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States"

"[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"

<comment><USER21> Law is a different language. While it may read like computer code; it isn't. Well, it is but it's as if "goto" and ";" had different meanings depending not only on the last keyword used, but also on the mood of the computer. I wish a straightforward reading was possible but it's often not.

<comment><USER20> Some parts of the law are easier to appreciate if one considers vagueness and ambiguity can be features instead of bugs.

<comment><USER18> Those exact ambiguous laws are the ones that are abused most easily. There is a hard balance between being general enough to cover bad things, without being so general as to allow authorities to prosecute anyone on some charge.

</comment></comment></comment></comment></comment></comment><comment><USER22> It seems unacceptable to me that the updated drivers do not automatically uninstall the CA. How is an ordinary user meant to navigate the certificate store and delete the CA?

</comment><comment><USER23> Phrased differently: operating system Microsoft Windows allows silent installation of Root Certificate during installation of unrelated USB driver installation, despite featuring a micro-kernel design.

</comment><comment><USER24> Can someone explain root certificates to me and why this is an issue? I know they sign certificates with a private key at a high level, but don't get the implications of that generally.

<comment><USER25> Anyone who installed this audio driver could have all their https traffic intercepted by Savitech.

<comment><USER24> Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?

<comment><USER26> They would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.

</comment></comment></comment></comment><comment><USER27> Is there software that will check the certs on my computers to make sure no software has done this?

<comment><USER28> Well you can look at the certificate store by running certmgr.msc, but it's a dangerous game - do you trust Go Daddy, COMODO or Symantec any more than you do Savitech? They have all at one point or another given reason to not even entrust them with organising a piss-up in a brewery.

Other applications like Firefox have their own independent root CA store.

<comment><USER5> Mmm. I think the brewery test is an unfair comparison. Our problem is not that the major CAs are hopeless. If they were hopeless we'd have abandoned PKIX years ago. Instead the problem is that they're good but not as good as we'd like.

We are looking for somebody who can run aforesaid event fifty times a year for the general public without anybody falling in any of the machinery. In hindsight drunk people in an industrial workplace was a mistake, and so we can and should demand they do their best to make it safe, but perfection just isn't to be expected.

</comment></comment></comment><comment><USER29> >Microsoft provides guidance on deleting and managing certificates in the Windows certificate store

Microsoft should mark these as malicious and quarantine them using their built-in AV. If the end user needs them he can remove them from quarantine. Posting advisories no end user will ever see isn't helping much.

</comment><comment><USER28> The only version of Windows XP that enforces driver signing is the unicorn 64 bit one, surely they didn't develop the driver for that?

And what kind of odds do I get on the certs having a EKU for anything but driver signing?

</comment><comment><USER30> Why are they allowed to bundle malware in their drivers? Why is this not illegal?

<comment><USER31> A CA certificate by itself is not malware? Am I missing something?

<comment><USER32> malware is certainly a strong term, and generally the definition seems to include computer code, which would exclude installing a certificate.

However, once you have installed your own root CA certificate on a computer means you can read all HTTPS traffic originating from that computer, and fake responses. Likely, thanks to having installed that certificate you can read someone's emails, move money out their bank account, and view any files they have stored online.

The effect of installing a certificate is broadly similar to the effect of installing a keylogger, and in neither case have you been given a right to do so. In both cases you have altered someone's computer in such a way that you are able to read their encrypted communications, which is certainly in the spirit of what malware means to me.

I'm sure that the intent in this case was not malicious, but we would not accept software installing a keylogger because they wish to measure your typing speed, and we should not accept this.

<comment><USER30> >I'm sure that the intent in this case was not malicious

What other explanation is there? Is there a valid reason for an audio driver to silently install a CA cert?

<comment><USER5> As described above, some versions of Windows require drivers to be signed proving who made them. For this to work Windows needs a list of CAs trusted to issue the certificates. Whether "I am not paying somebody £100 for a cert" constitutes a valid reason is arguable. But that seems to have been their plan here.

</comment></comment></comment></comment></comment><comment><USER33> Alright, so if we get tons of install of our root CA cert. Can we start a new CA?

<comment><USER34> Yes, but CAs can charge money based on (more or less) number of CA root cert installations on the target devices for a company.

Some of your competitors have had their current root certs in device preinstalled for a lot longer than you. Entrust and GlobalSign have 2048 bit roots with Not Before before 2000.

If I'm going to go with a Johnny come lately root, I may as well use LetsEncrypt because it doesn't cost money. Also, audio drivers may get you desktop share, but getting into the platform store on mobile is a lot harder.

<comment><USER5> The major trust stores partition their trust of a root by purpose. So Microsoft's trust of a particular root for signing certs that are used in driver code signing is separate from not only Apple's trust of same but also Microsoft's trust of that root for signing TLS certificates. Let's Encrypt doesn't ask for any "trust bits" besides the Web PKI, ie TLS certificates and that's completely deliberate.

Purposes other than TLS server and /maybe/ S/MIME are not subject to any meaningful public oversight, you are entirely trusting Microsoft. Which for drivers, or Xbox games is probably fine but it's worth keeping in the back of your mind.

</comment></comment></comment><comment><USER35> Is there a list of trusted CA certs that we could use to scan to see if we have any that may not be trusted?

<comment><USER36> You can use sigcheck -tv (sysinternals) to test against Microsoft's list.

I prefer RCC (root certificate checker) and have used it in the past, but the website seems to be suspended.

</comment></comment><comment><USER37> Curious as to why EMC got notified 20 days before anyone else...

</comment><comment><USER38> One more reason to add to the innumerable list of why not to use windows.

<comment><USER39> A bad actor could just as easily post a script as "Show HN" with some cool stuff in it that you install via:

        curl https://example.com/some_script.sh | bash

A lot of people don't check those. Use the non-OSS nvidia or ATI drivers? You have binary blobs (don't for ATI btw, the OSS ones are 10x better). Use bluetooh/Wi-Fi on Linux, congratulations you are using closed binary blobs.

I still love Linux, but I don't hate windows. We're not in the 90s. Bill Gates isn't master of the Borg.

<comment><USER38> I think you underestimate the insidiousness of such systems, and your response is completely logically fallacious, and doesn't support your conclusion whatsoever. So if I installed a random script via curl (I prefer wget) and because there are still some proprietary hardware that needs closed source binary blobs... That suddenly means GNU/Linux and windows are on the same footing? No, not at all, and I'm tired of hearing that trite and clichéd response. The four freedoms matter.

No, its not the 90s. Now its worse!

</comment></comment></comment><comment><USER40> This, and all other thousands of cases of malware in the universe should mean something for those who defend "native" apps over webapps.

<comment><USER41> Including the various browser-based javascript malwares?

<comment><USER40> I want to know more about that.</comment></comment></comment>


Eran Tromer's Attack on Ray Ozzie's CLEAR Protocol - <AUTHOR> https://www.cs.columbia.edu/~smb/blog/2018-05/2018-05-02.html <comment><USER3> By the article's description, CLEAR is a "trusted computing" approach - <USER2> enforcement can control things about the phone that the user cannot.

Aside from the particular attack described, such systems are both inherently undesirable and unlikely to stop serious criminals while decreasing the security of the casual user.

see: [https://www.gnu.org/philosophy/can-you- trust.en.html](https://www.gnu.org/philosophy/can-you-trust.en.html)

<comment><USER4> If two people are allowed to talk privately in person, and if that right extends to the digital realm, then strong encryption is a must. In a world with CLEAR people would just send ephemeral messages. Unless we fundamentally assert an individual's right to privacy we'll just end up in a crypto arms race.

</comment></comment><comment><USER4> What about CLEAR makes it novel beyond the blown fuse (which doesn't actually impact the threat model anyway)? AFAICT it's literally just single key escrow where the vendor is the escrow service... why is it getting so much attention?

<comment><USER5> Doesn't seem novel to me either.

RFC 1925 point 11 applies.

</comment></comment><comment><USER6> While the situation described here has measures that can be taken to prevent, the entire system is trivially compromised by the fact that the consumer controls the software. All a bad actor needs to foil this entire schema is to unlock the phone and program it so that whenever it is asked for a device unlock request, it will simply factory reset the hard drive (or even more covertly, reimage it to a different drive). With this approach, the criminal reveals nothing and law-abiding citizens are open to multiple undiscovered attack vectors.

<comment><USER7> This is covered in the article:

 _Another problem is that CLEAR phones must resist "jailbreaking", i.e., must not let phone owners modify the operating system or firmware on their own phones. This is because CLEAR critically relies on users not being able to tamper with their phones' unlocking functionality, and this functionality would surely be implemented in software, as part of the operating system or firmware, due to its sheer complexity (e.g., it includes the "device unlock request" screen, QR code recognition, crytographic verification of unlock codes, and transmission of data dumps). In practice, it is well-nigh impossible to prevent jailbreaking in complex consumer devices, and even for state-of-the-art locked-down platforms such as Apple's iOS, jailbreak methods are typically discovered and widely circulated soon after every operating system update._</comment></comment>


Unicorns to Chew an $80B Hole in the Surface of Stocks - <AUTHOR> https://www.bloomberg.com/news/articles/2019-01-22/unicorns-are-about-to-chew-80-billion-hole-in-surface-of-stocks <comment><USER2> This article is slightly ridiculous. Traditionally it's been a _good_ thing when lots of companies IPO, and the article acknowledges that in the 3rd paragraph, and then spends the rest of the article trying to convince you that it's actually a bad thing and the financial apocalypse is nigh.

I'm not quite sure what's a better explanation: news media have discovered that fear is the only thing that generates clickthroughs, or writers in the news media are themselves afraid (because the Internet has commoditized their profession) and are passing that fear on to readers. Either way, seeing articles like this is one of the few things that makes me think that maybe the current bull run has a while to go.</comment>


She got ill when the pandemic hit – and still is, six months later - open-source-ux https://www.bbc.co.uk/news/stories-53948028 <comment><AUTHOR> Focusing on the long tail distribution in any disease isn't usually helpful for making policy. If you look at any disease the possible side effects and symptoms extend to an absurd array of often contradictory outcomes (constipation / diarrhea). But usually there is a majority of side effects, symptoms, etc. that can guide things.

With COVID the media scaring us is never ending. Anecdotally the people I know who got the disease ranged from "mild cold" to "bad flu" and I don't personally know anyone that died, although there are many of course.

We also don't know how many deaths caused by COVID were actually caused by COVID. For example, if you die of a heart attack then your corpse tests positive for COVID, it will be marked a COVID death but that is entirely unknown if COVID was the primary cause of the heart attack or even a contributing cause. We don't have much data, what we have isn't always reliable, and the media jumps on any news immediately to scare us as they do with any story they cover because they need clicks.

Sweden was criticized by almost everyone for being calm and staying open with reasonable restrictions. Their economy wasn't hit as hard. They had elevated deaths compared to some countries, but they certainly weren't the worst, and some of the countries previously praised as "gold standard" are now having outbreaks because we have no cure and the virus always seems to spread throughout the population anyways. Ideally we are getting herd immunity while the hospital system is not overwhelmed.

In summation, health authorities still don't know what is truly happening and any anecdotal data about people being sick for long period of time (like in this article) after getting COVID are rare situations at best or entirely unrelated (undiagnosed fatigue related illness) at worst.

<comment><USER2> This made Sweden's outcome sound a lot better than it actually is.

Here are numbers: Sweden still had an economic contraction of ~ -8.3% (Germany ~ -11.7%) while having 5.5 times (i.e. 550%!) the deaths per million inhabitants (Germany: ~ 110/1M, Sweden: ~ 575/1M).

You can compare them to e.g. the UK or Spain though and justifiably claim that they had a far better economic outcome per casualty than them if you like.

Or compare them to e.g. Denmark or Lithuania and see that Sweden got 10 times the casualty rate _and_ a worse economic contraction.

Source: [https://ourworldindata.org/covid-health- economy](https://ourworldindata.org/covid-health-economy)

</comment></comment><comment><USER3> Far more plausibly she has a health anxiety and never had the coronavirus to begin with. She isn't well but it is most likely a psychological rather than a physiological condition.

<comment><USER4> Why is this more plausible? You don't know her, and are applying a psychological condition to her with no basis whatsoever. Just because you don't want to believe it's true, I assume?

My wife has something similar. Caught it in late February - at the same time as me - and _still_ has debilitating coughing fits some days, and no energy to move some days. Unless you're also going to tell me that's in her head too, and mine.

</comment></comment><comment><USER5> I was expecting a different story. This may or may not be covid related.

</comment><comment><USER6> A very long article describing an anecdote about a woman who is ill and has never tested positive for COVID-19.</comment>


Google China hackers stole source code - <AUTHOR> http://uk.news.yahoo.com/22/20100303/ttc-uk-china-google-fe50bdd.html

<comment><USER2> Does anyone else feel that this article is both poorly written and furthermore just bad reporting? I was curious about the original source, which I tracked down to a blog post by George Kurtz and several links on it [1].

It seems to only claim that source control services are a good target and are frequently configured with no security (which is A Bad Thing), but does not blame Perforce as an attack vector. The article implies, however, that Perforce was used as an attack vector which does not appear to be the case. Of course, it is very hard to discern what the article actually says when they spend one sentence per idea, with no further explanation or investigation.

[1]: [http://siblog.mcafee.com/cto/source-code-repositories- target...](http://siblog.mcafee.com/cto/source-code-repositories-targeted-in- operation-aurora/)

</comment><comment><AUTHOR> Stuff like this is why it's important for all developers to study computer security. It is possible to create computer systems such that malicious users are unlikely to break into them, even if they have the entire system's source code. For example, look at heavily used open source software.

It seems like a lot of developers write closed source, commercial systems with the assumption that malicious users will never see it.

<comment><USER3> Perhaps they don't have enough of an incentive to make it bullet proof. That or they aren't given enough time to do so. Let's admit it, we all make mistakes, and if you aren't given enough time to analyze your code, security issues might very well make it into production.

</comment></comment><comment><USER4> While reading that, for a moment I though that Google were using McAfee security and seriously pondered the wisdom in using their services anymore.

<comment><USER5> Nothing wrong with Mcafee enterprise. :-)

<comment><USER6> It's only trivial to bypass, nothing else wrong with it.

</comment></comment></comment><comment><USER7> It's not really stealing if Google still has the source code. Unless reading a book is now called "stealing a book".

<comment><USER8> Just like "stealing" company secrets isn't stealing? Are you implying that intellectual property can't be stolen?

<comment><USER7> Implying? No.

<comment><USER8> So, hypothetically speaking, you wouldn't mind if I broke into your house, duplicated every bit of data on your computer, and put everything not copyrighted by another company onto the internet for everyone to see?

<comment><USER7> Nobody said I would or wouldn't mind this, I just said it's not stealing. It's "looking".

But anyway, feel free to go ahead with your plan. But it might be a waste of your time; the bits on my hard drive are already public: <http://github.com/jrockway/>.

<comment><USER8> (not trying to start a fight, just pointing out) note that my point implies _all_ private communication as well. Cookies, email, chat transcripts.

</comment></comment></comment></comment></comment></comment><comment><USER9> Why is Google storing source code on 3rd party servers?!

<comment><USER10> The article never said that; just that they use Perforce.</comment></comment>


Data Science at Twitch – CEO Perspective: Emmett Shear Interview - <AUTHOR> http://www.datascienceweekly.org/blog/20-data-science-twitch-ceo-perspective-emmett-shear-interview

<comment><USER2> The interview is interesting in that it shows how data science is used in a startup context.</comment>


Finally, an ELECTRIC CAR with a useful range and speed! Thanks to ultracapacitors.  - <AUTHOR> http://features.csmonitor.com/innovation/2008/04/16/ultracapacitors-the-future-of-electric-cars-or-the-cold-fusion-of-autovation/

<comment><USER2> Ultracapacitors are cool, and may in fact be useful for this kind of thing, but in order to justify a headline like "Finally, an [x]" then you really need at least a working prototype of an [x], not just a press release that says "we're gonna be building an [x] any day now".

(See also: Moller Aerocar)</comment>


Google Drive Desktop – A cross-platform Google Drive desktop app made w Electron - <AUTHOR> https://github.com/alexkim205/Google-Drive-Desktop <comment><USER2> This not being an official release from Google, using this is potentially worse than giving someone your Google password without fully vetting it. There are some existing safeguards in place to make a password alone difficult to use, but the app itself would have signed in access to your account and the contents of files. You may think it's simple to watch the app for bad behavior and decide it's safe, but you wouldn't be thinking deviously enough.

Nothing against the developer as they may be trustworthy and honest, but don't make the mistake of assuming that someone bold enough to put out something that requires that much trust must by extension be worth trusting. People too often do.

<comment><USER3> Does it ask for your password? I'd expect it to use OAuth.

<comment><USER2> It wouldn't matter how you signed in for potential abuse to occur if the app itself is untrusted, unfortunately.

The repository doesn't include all of the code that gets included in the app, because it has dependencies. It links those dependencies on the github page, but you have to verify that the dependencies being linked to are the ones the build actually uses. Then check that you like what's in those dependencies. At first glance, a forked version of one of the dependencies is pulled from his own repository instead of the repository linked on the page, so you have to make sure you aren't vetting the wrong repository. Then the release archives package in Electron for you, so that's another thing you're trusting if you don't build it locally.

It doesn't mean anyone is doing anything wrong, but even if they have good intentions good people pull in bad dependencies occasionally too.

Developers as people are innocent until proven guilty. Software is guilty until proven innocent, especially if there's a higher chance of a security risk. Not everyone can assess that well for themselves.

<comment><USER4> > _It wouldn 't matter how you signed in for potential abuse to occur if the > app itself is untrusted, unfortunately.

> _The repository doesn't include all of the code that gets included in the > app, because it has dependencies.*

> _Software is guilty until proven innocent_

I'm not saying you're wrong about any of this, and I don't trust this app myself (mostly because JS dependencies are hard to trust for various reasons), but...

I also can't think of any usable app that meets your criteria for trustworthiness, including some made by Google itself.

At this point, building much of anything requires standing on a teetering tower of dependencies that users can't and won't audit.

The question becomes where one draws the line. I think drawing the line at "anything that touches my Drive files" is reasonable, but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. Although many things are browser-based now, many of us still do download native executable freeware from the web.

If you think I'm not offering a better perspective, it's because I'm not. You're right, but total security also currently means using very little of the software that's available to us.

<comment><USER5> These days, I'm very careful what gets downloaded on my computer for just that reason. Dropbox for the Mac is a security nightmare and Zoom was doing shady crap before like installing a web server to redownload itself if you uninstalled it.

On the other hand, I download all sorts of random crap on my iPad because the security model won't let apps do anything to shady without you giving it permission.

</comment></comment></comment></comment></comment><comment><USER6> It's a cool concept in theory -- I'd always thought I'd like using it.

But in practice, I realize I'm addicted to tabs. When working on 3 documents at once, I want them in separate tabs in the same window -- not 3 different windows.

Maybe I'm in the minority, but I'm actually at the point where I want things to go in the _opposite_ direction -- just turn all my _apps_ into tabs. (Like Chromebooks, I guess.)

Finder? VLC? Word? Preview? Spotify? Photoshop? My code editor? I just want them (or each document in them) as tabs next to other webpages and/or each other. (For Photoshop and code, I'll probably organize my own window/space for them, but still open up webpages next to my images/code.)

Having tabs _and_ a dock feels redundant in 2020, like two competing paradigms that just need to be refactored into one by now.

<comment><USER7> You need a window manager/virtual desktops, not the insecurity doing everything in the browser brings.

<comment><USER6> Well, to be more specific -- I want the OS itself to be a full-screen tab container with multiple spaces/desktops (and add tiling, and popping out tabs like floating windows, as advanced usage).

And then each tab is an app or app document window. So I could have a Chrome tab next to a Firefox tab if I wanted. Browser tabs would be peers next to other apps.

None of this is about security, or running apps in the browser. Just using tabs as the main concept for everything, rather than windows.

<comment><USER8> This bugs me too sometimes. It's incongruous that I can stack Gmail, docs, and my company's ticket system nearly into one tabulated window, but I have to use a completely different interface to access a local file browser, RDP, or the sniping tool.

It's funny, my version would probably just put every browser tab into a different window and just use a powerful window manager like i3 to deal with everything.

<comment><USER7> You're seeking for Dolphin or similar in a container, Guacamole for remote desktop.

These should at least get you pointed right.

</comment></comment></comment></comment></comment><comment><USER9> As a fan of the Google Play desktop app, these Electron wrappers around Google apps are really flaky and hard to maintain. Google is motivated to break these implementations since they live outside of their direct web ecosystem, and when they break it always takes some time to recover since it's open-source. So you end up still using the browser solution.

What's additionally weird is that you can pull your tabs apart into separate windows to replicate this exact behavior. It's hard to justify why I need an exclusive browser just for one app. For Play it's justified because of tighter integrations with the OS playback keys that the browsers historically have been flaky with, especially when you're using other apps.

<comment><USER10> Things breaking is the natural order of the world. No one needs an incentive to break anything, merely a lack of incentive to fix will suffice

</comment></comment><comment><USER11> Yet another way that Google's branding creates confusion. I read "Google drive desktop app" and my mind jumped to storage / files, not word processor.

In my mind, "Google drive" is storage, "Google docs" is word processing / spreadsheets etc. I have no idea why they brought docs into drive.

<comment><USER12> Isn't it just the author of this app (it doesn't look affiliated to Google to me)? Probably should call it Google Docs Desktop instead.

I don't find Google's official use of Drive and Docs confusing (there are some overlaps, but in a natural way).

<comment><USER13> Yep, this isn't affiliated with Google. Wouldn't be surprised if the author got a nice email from Google's lawyers if this gains enough eyes.

</comment></comment></comment><comment><USER14> ... An 18 MB animated GIF embedded in the project home page just to show me a demo video?

I suppose that's on-brand for an Electron app.

Snark aside, FFmpeg is your friend and a 1-liner plus a <video> tag will reduce this to less than a MB. Your mobile visitors will thank you!

<comment><USER15> GitHub doesn't do <video>.

<comment><USER16> While I believe GitHub won't stop you putting animated WebP images in, it seems Safari is the only major browser without support?

</comment></comment></comment><comment><USER17> This is handy.

Another alternative on Windows is to create a separate chrome profile and then create a desktop shortcut to that profile. Set the default page to be your drive in that profile

Here's an example shortcut "C:\Program Files\Google\Chrome\Application\chrome.exe" \--profile-directory="Profile 2"

Use that profile as your Drive app

<comment><USER18> When you create a new profile you're asked to put a shortcut in your desktop, you don't need to create it by hand.

<comment><USER10> Hmm, my machine doesn't.

</comment></comment></comment><comment><USER19> I think you're going to need a unique name for the app. Google and Google Drive are protected trademarks, so they wont let you use those. You're allowed to list the compatibility, but you have to make it crystal clear that this is an unofficial client.

<comment><USER20> I can only second this. From the title I inferred it's about a Google product. Is that a bug or a feature?

</comment></comment><comment><USER21> What is the deal with Google's syncing apps?

"Backup and Sync" still misses features like Files On-Demand/Smart Sync available in OneDrive/Dropbox and deleting files online pollutes the local trash/recycle bin on macOS/Window computers.

"Drive File Stream" actually has these lazily loaded file placeholders, but it is treated like an additionally mounted volume instead of a local folder somewhere on my local disks. It also managed to occupy over 60 GiB RAM for over a week during its initial sync which had lots of small files created by Arq Backup.

It seems like 'unlimited' cloud storage is foremostly limited by the performance characteristics of their sync clients.

<comment><USER22> I made the mistake of copying a node project I was working on.... holy cow does Backup and Sync choke on all those tiny JavaScript files.

It started syncing and just couldn't stop.

I had to delete or move all the Backup and Sync contents across my devices to get to 0 before it quit endlessly thrashing.

<comment><USER23> Dropbox still has the best sync tech and is the only one that can handle deep and numerous file hierarchies. The rest have better pricing and integrations like email/productivity apps.

<comment><USER24> Actually, Resilio is not any slower than Dropbox. Syncthing is also faster thans any commercial offering I ever tried. Even Nextcloud sync is fast after an initial init.

<comment><USER23> What exactly are you referring to? Upload speed? That's not the issue.

Dropbox is the best at crawling a very complex directory structure with millions of files and diffing it efficiently with the server and other clients, and then transferring all the individual changes. Nothing else comes close. And their write-ups show the work involved:

[https://dropbox.tech/infrastructure/rewriting-the-heart- of-o...](https://dropbox.tech/infrastructure/rewriting-the-heart-of-our-sync- engine)

[https://dropbox.tech/infrastructure/-testing-our-new-sync- en...](https://dropbox.tech/infrastructure/-testing-our-new-sync-engine)

<comment><USER24> Indexing. Dropbox is slower than Resilio in my experience, and for shares with 100k-1M files, many small.

But also throughput is good.

</comment></comment></comment></comment></comment></comment><comment><USER25> I guess I just don't get how this is different / better than making a desktop chrome shortcut that opens into a new window? It gives the appearance of running as an independent app.

</comment><comment><USER26> Respectfully... what is the point of this?

Performance will be similar to using Google Docs on Chrome. Memory usage will be probably worse since you are running another engine besides your browser.

Is it just for the convenience of not having to type the URL on your browser?

<comment><USER27> I'm guessing it's for people that want the Google products to be their main desktop office suite. Haven't looked into it, but maybe it can open .docx files etc. directly as the default app for it?

<comment><USER28> It still remains a shim over the stock Google Apps then, right?

<comment><USER27> Sure, yes.

</comment></comment></comment></comment><comment><USER29> What's the difference between using this and clicking on the new "Install" button in the URL bar? I have all of my Google apps available as system apps either using that button or using "More tools -> Create shortcut", which is probably one of the best hidden gems of Chrome (yes, even Gmail can run as a separate app and supports offline mode).

</comment><comment><USER30> Does this support the offline extensions, so that you can work seamlessly (mostly) if you're temporarily disconnected or without service?

(e.g. on a plane, if I ever take one again...)

</comment><comment><USER31> > Want a Microsoft Word-esque experience for your Google Drive? Or simply > looking to separate Google Drive from the other bajillion tabs that you > opened for your research paper? Look no further!

Well first of all, I'd pretty much rather have a shortcut that can be opened in any browser I'd want to use, than to download another copy of Chrome dedicated to running the Google Drive web app as its own 'app' using Electron.

Secondly, Chrome supports grouped tabs which allows you to organise your tabs anyway which sounds great over having 3 - 4 separate Electron apps trying to behave like MS Office (Just don't).

And last but not least, Unlike MS Office, this requires a persistent internet connection to function. So if your internet is down, your wonderful Google Drive electron app will look like this: [0]

[0] [https://twitter.com/rhysforyou/status/1260361296551178240](https://twitter.com/rhysforyou/status/1260361296551178240)

</comment><comment><USER32> Is it just me or does a 217mb download for a word processor with "save to network drive" seem like an awful lot?

</comment><comment><USER33> I used to use Fluid ([https://fluidapp.com/](https://fluidapp.com/)) when I had a company-issued macbook.

There was something similar for gnu+linux too (nativefier was the name iirc) that worked for a while but then stopped working.

It was very handy.

I kind miss those things because having certain websites in their own apps within their own browser was comfortable.

EDIT: I've tried [https://github.com/jiahaog/nativefier](https://github.com/jiahaog/nativefier) and it seems to be working again. Basically you can invoke it and pass it the url of any webapp and it will package an electron-based browser that loads your webapp on startup.

</comment><comment><USER34> So this is like Chrome but you can only open drive.google.com

ok

</comment><comment><USER35> I mean, I can't see this lasting longer than a year until Google decides to break something on their end. And for the love of God, stop using Electron.

</comment><comment><USER36> Still waiting for Google Drive official linux client...

<comment><USER37> Here you go: [https://github.com/jiahaog/nativefier](https://github.com/jiahaog/nativefier)

If you have a setup you like, save it a shell script. You'll have to rerun as google breaks it every six months or so.

<comment><USER36> Nativier wraps a website with Electron, and in the end it's not a native apps. What I mean is a Google Drive client like Dropbox client in linux where I can sync a directory in my computer, to a directory in my Google Drive. There are some unofficial Google Drive client in Linux like Grive2 ([https://github.com/vitalif/grive2](https://github.com/vitalif/grive2)), but like any unofficial apps, they are prone to break when Google update their API.

<comment><USER37> I was attempting to be snarky in my original comment, it was in poor taste and not too funny, apologies.

If you have not yet looked at rclone, it's worth exploring, they do a great job.

</comment></comment></comment></comment><comment><USER38> Its title made me think it's an official app by Google. Does'nt "Google Drive Desktop" infringe the trademark?

</comment><comment> c-c-c-c-c I dont think you need to worry so much about the name, look at Google Play Music Desktop Player. [https://github.com/MarshallOfSound/Google-Play-Music- Desktop...](https://github.com/MarshallOfSound/Google-Play-Music-Desktop- Player-UNOFFICIAL-)

</comment><comment><USER39> When I saw this title, I thought they brought Google Desktop, a utility that searches local files back from the dead.

<comment><USER28> Yeah that was an incredibly powerful tool, I used it every day back in the days.

</comment></comment><comment><USER40> This is a cool project, and the code does really stand out in terms of quality.

I wanted to do something like this for years, but never got the time to make it, so I'm glad to see someone did it.

However now I think this is not really relevant, thanks to PWA there's a better way to make Google docs apps feel native.

</comment><comment><USER41> It would be nice if it didn't do the 'unsigned app' dance on a Mac.

<comment><USER42> That's a Mac problem.

<comment><USER41> Thats a Mac and s/w developer account/licencing problem.

</comment></comment></comment><comment><USER43> Better make one for Linux :)

</comment><comment><USER44> Am I the only one who refuses to run Electron apps?

<comment><USER15> Nope.

</comment></comment><comment><USER45> Heh, on the day of a monopoly suit.</comment>


Alice Herz-Sommer: pianist and oldest known Holocaust survivor dies aged 110 - <AUTHOR> http://www.theguardian.com/world/2014/feb/23/alice-herz-sommer-holocaust-survivor-dies

<comment><USER2> if you haven't seen the documentary on this delightful woman, do yourself a favor and see what an extraordinary human being looked like, in this day and age, at the ripe age of 110 years.

the film is up for an oscar, and i can guarantee you that the immense applause for alice will be music to her ears in heaven.

-bowerbird</comment>