Off-the-Record Messaging Protocol v3 - <AUTHOR> https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html <comment><USER2> This OTRv3 document has been available since at least 2012(?), so I'm not sure why there's a sudden interest in discussing it, but here was our analysis of OTRv3 at Open Whisper Systems:

1) The introduction of SIGMA in the switch from OTRv1 to OTRv2 significantly reduced the "deniability" properties of OTR. The protocol does some explicit things to provide "full" deniability, but in OTRv3 only people who've actually had a conversation with Alice can produce a complete forged transcript with Alice. More details: [https://whispersystems.org/blog/simplifying-otr- deniability](https://whispersystems.org/blog/simplifying-otr-deniability)

2) OTRv3 doesn't work in asynchronous environments. It depends on a reliable and synchronous transport that delivers messages in-order. The messaging landscape is increasingly asynchronous, so OTRv3 is a difficult fit for modern messaging protocols. More details: [https://whispersystems.org/blog/asynchronous- security](https://whispersystems.org/blog/asynchronous-security)

3) The OTRv3 "ratcheting" protocol is slow. It uses what we refer to as a "three step ratchet," which provides less-than-ideal forward secrecy and "future secrecy" semantics. More details: [https://whispersystems.org/blog/advanced- ratcheting](https://whispersystems.org/blog/advanced-ratcheting)

We sought to improve on OTRv3 by addressing these issues in the TextSecure V2 protocol, which we believe builds on the work of OTR to provide enhanced and simplified deniability, an asynchronous-friendly environment, and optimal forward and future secrecy semantics: [https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2](https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2)

It also now supports group messaging and multi-device messaging, but we'll cover those in a future blog post.

<comment><USER3> That is cool and all, but let me explain why I still prefer OTR.

OTR is a library that works with many different clients (pidgin, miranda, irssi etc.). While as far as I know your stuff is pretty much baked in your products. Correct me if i'm wrong please.

And I think that is exactly the problem. I've heard of TextSecure and looked at it, but I never bothered to try it. Because it only seems to work with SMS and MMS (at least that's what it advertizes). Now in Switzerland we have the situation that a single SMS costs still about 10 cents (in USD and CHF). But since I've got a traffic flat obviously I'd prefer to send messages over the internet. I've used WhatsApp in the past, and it really was a great replacement for SMS. But I've uninstalled it over privacy concerns.

I realize I'm kinda going off-topic, but I will take this chance to tell the people who could fix this mess where my problems are.

\- TextSecure is still bound by phone number. So you can't use TOR to hide your identity. Since it's using SMS you can't deny you ever talked to someone. Your ISP can disprove that.

\- Again - there is no library to just leverage your protocol, even if it's better than OTR.

Why can't we just have federated XMPP servers that use whispersystems crypto protocol and maybe some XMPP extensions or a custom protocol to push from the XMPP server to cellphones without battery drain.

If I could, I would fix this. But I don't trust my crypto skills. I could never design a secure protocol from scratch. So _PLEASE_ create libraries regular devs can use to make the world a better place. (OTR does this! At least I would think I do have enough knowledge to use libotr correctly.)

Edit: Looking at the TextSecure code there is Push Notification stuff. So does this use SMS or a messaging server on the interwebs? I'm actually confused now.

<comment><USER4> You should take a look at Threema. That does exactly what you describe afaikt - except XMPP, its a walled garden - using NaCl.

Edit: I should probably elaborate:

\- It uses the internet connection to transfer messages

\- You can choose not to publicize your phone number and solely exchange keys via QR-codes.

\- It uses NaCl which utilizes a permanent Diffie-Hellman key exchange to derive a symmetric key for authenticated encryption. If you can decrypt your messages, then you can forge them.

\- There is no desktop client yet, but it is on the far agenda.

\- It is not an open protocol.

Personally I don't think XMPP is a good basis for an asynchronous, encrypted network protocol. It is extremely verbose and the extension that would make it tolerable to use with unstable internet connection and multiple clients are not supported by enough clients and servers. Also it misses an encryption standard for asynchronous communication. And again I think OTR is not a good basis for that. For example afaik there are no mechanisms for recipient key selection in a non-interactive way.

PS: I would greatly appreciate some markdown dialect for the Hacker News posts, if only to typeset lists.

</comment></comment></comment><comment><USER3> When I saw this I really hoped I would click the link and it would say there that OTRv3 supports group chats now. Sadly that is not the case. But support for multiple logged in clients and a key for file transfer or voice is also cool.

I would hope that means that libjingle based voice chat's can soon be OTR'd too? Now pidgin just needs a decent interface for them...

Then we convince everyone to use XMPP (or google and facebook to [re]enable XMPP federation) and we can finally drop Skype.

 _wakes up from his dream_

<comment><USER5> A WhatsApp client with OTR would be sweet as well.

<comment><USER3> Technically there is no reason why it shouldn't have one.

If WhatsApp would just try to make their XMPP costumizations a standardized XMPP extension and enable federation on their service. Finally we have unified Instant Messanging.

 _dreams again_

(btw there's nothing stopping you from adding OTR support to one of the open, reverse engineered, whatsapp clients)

<comment><USER6> > (btw there's nothing stopping you from adding OTR support to one of the > open, reverse engineered, whatsapp clients)

Except, you know, DMCA notices: [https://github.com/github/dmca/blob/master/2014-02-12-WhatsA...](https://github.com/github/dmca/blob/master/2014-02-12-WhatsApp.md).

Yes, this is complete bullshit. Especially how they try to use a DMCA notice for trademark infringement.

</comment></comment></comment></comment><comment><USER7> I believe the weakest link in OTR is its Diffie-Helman key exchange. If you break that you get the symmetric key and can decrypt everything passively. OTR has been using a 1536 bit modulus for its Diffie-Helman exchange since 2004 [1] (The weakest one from RFC 3526 [2]). Seems they are still using the same one today.

In 2004 this was probably a fine choice, especially considering the tradeoff between CPU processing (usability) and security. But considering the NSA scandal, specifically them recording all encrypted communications forever, and Bruce Schneier increasing his key lengths [3], and the ability for CPUs to process higher keylengths without any noticeable slowdown, I don't feel confident it is strong enough today.

Other than this gripe OTR is amazing and everyone should be using it.

Edit: xnyhps's post [4] concludes that only a single "cracking" of the 1536 bit group would need to occur to then decrypt any past or future OTR conversation "instantly".

[1] [https://web.archive.org/web/20041215062523/http://www.cypher...](https://web.archive.org/web/20041215062523/http://www.cypherpunks.ca/otr/Protocol.txt) [2] [http://www.ietf.org/rfc/rfc3526.txt](http://www.ietf.org/rfc/rfc3526.txt) [3] [https://news.ycombinator.com/item?id=6376954](https://news.ycombinator.com/item?id=6376954) [4] [https://blog.thijsalkema.de/blog/2014/01/17/misconceptions-a...](https://blog.thijsalkema.de/blog/2014/01/17/misconceptions- about-forward-secrecy/)

<comment><USER8> OTR uses DH in a ratcheting protocol that requires attackers to continuously break new DH exchanges; it's not like TLS, where one exchange at the beginning of the session gives you the whole session.

Also, while a 1536 bit modulus isn't the best you can do in 2014 (we should all be using curves now instead of doing DLP crypto), it's probably not within reach of attackers right now. Effort doesn't scale linearly from those 1024 bit factoring problems.

<comment><USER6> > OTR uses DH in a ratcheting protocol that requires attackers to continuously > break new DH exchanges; it's not like TLS, where one exchange at the > beginning of the session gives you the whole session.

Please correct me if I'm wrong, but as far as I know the required effort to break multiple DH exchanges doesn't scale linearly in the number of exchanges. A single successful index-calculus attack on the used group will make breaking additional key exchanges much easier.

<comment><USER9> You're not wrong. The current state of the art puts the precomputation step at complexity L_n(1/3, 1.923)§, and additional individual discrete logs at L_n(1/3, 1.232). So individual logarithms are still subexponential and nothing to scoff at, but they do become easier, yes.

Ignoring constant factors, for a 1536-bit prime this would mean cost ~2^102 for the initial precomputation, and ~2^66 for each individual log.

§ L_n(a, c) is the usual exp(c(1 + o(1)) (log n)^a (loglog n)^(1-a)).

<comment><USER10> > The current state of the art puts the precomputation step at complexity > L_n(1/3, 1.923)§, and additional individual discrete logs at L_n(1/3, > 1.232).

Could you cite that? Not skeptical, just interested.

<comment><USER9> Razvan Barbulescu's PhD thesis [1]. Note that the best asymptotic complexities are a little different: the 'best' is really L_n(1/3, 1.902), but that variant is hopeless in practice (it would require truly gigantic inputs for it to pay off). Similarly, there is a "discrete logarithm factory" method, based on Coppersmith's factorization factory, but that also has very large initial costs that make it not very attractive in practice.

[1] [http://tel.archives- ouvertes.fr/docs/00/92/52/28/PDF/these_a...](http://tel.archives- ouvertes.fr/docs/00/92/52/28/PDF/these_avec_resume.pdf)

<comment><USER10> Much appreciated =). I looked for references after reading the parent discussions and xnyhps's blog post but was unsuccessful.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Not that I mind more people knowing about OTR, if you've seen OTR before, this isn't new: v3 of the protocol is the current version, but we've had it for a while now (Pidgin plugin has supported it since Sep 2012).

</comment><comment><USER12> OTR is designed to help Alice to repudiate her messages when an archive of her conversation is taken by FBI from Bob's computer.

Alice might say: "Look, anyone could sign those messages as the keys were in the clear!"

Judge will reply: "Unfortunately, the collected evidence is quite believable and we have a couple of parallel constructions in place, so you don't have a chance."

I don't believe in a technical possibility to disprove someone in a court of law. Law is not mathematically defined, but interpreted quite frivolously depending on how much out of favor with the state you are.

I'd rather focus on better protecting one's identity and carefully choosing who to speak with in the first place. I'm afraid, OTR is just wishful thinking. (However, technically it's pretty cool.)

<comment><USER13> I'm afraid you've misunderstood it.

The goal is to be no less non-reputable than unencrypted plaintext is— It's a rather large shock when using encryption increases you risks, and OTR prevents this.

It, obviously, cannot make anything more reputable than plantext was.

</comment></comment><comment><USER14> OTRv3 was released in 2012. Can a moderator please add [2012] to the title?

</comment><comment><USER15> Sadly, Adium trunk is still on libotr 3.2.1 (OTRv2) which gets so confused if either party is using multiple simultaneous logins that I just disabled it for most of my contacts who are on a mac.

<comment><USER6> Adium 1.6 will include libotr 4, it's already implemented in the nightlies.

</comment></comment><comment><USER16> Wikipedia has a good ELI5 diagram of Diffie Hellman, which OTR uses: [http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exch...](http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange)

</comment><comment><USER17> I think Open WhisperSystems' Axolotl is superior to OTR now on several levels:

[https://www.whispersystems.org/blog/advanced- ratcheting/](https://www.whispersystems.org/blog/advanced-ratcheting/)</comment>


Microsoft Defender ATP for Linux is now generally available - <AUTHOR> https://techcommunity.microsoft.com/t5/microsoft-defender-atp/microsoft-defender-atp-for-linux-is-now-generally-available/ba-p/1482344 <comment><USER2> I'm at a loss trying to capture the absurdity of this, but I'll try.. Smith finally escaped Oceania and made a nice home for himself in a free land with free peoples. One day agents from Oceania show up at his door. "No hard feelings bud. In fact we brought a gift. We think it will help you. We want to install these little black boxes all throughout your home." Smith is all ... "ok".

<comment><USER3> It's probably more "Our customers have policies/certifications requiring they have antivirus software everywhere, even if that's stupid. We could tell those customers that we can't offer a solution and they'll go somewhere else. Or we could make the thing they 'need' and get their business". Not very absurd at all.

<comment><USER4> Can those customers not install ClamAV? Does that not count as anti-virus?

<comment><USER5> If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits.

At the same time, ClamAV has a terrifying CVE track record.

There's no upside, and all downside.

<comment><USER6> As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly.

Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up- to-date and have the correct software and signatures installed.

That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.

<comment><USER7> > Microsoft Defender may not be open source, so you have to trust that what > you're running really is Microsoft Defender and that it's behaving > correctly.

That's true of everything installed on a system - if you don't control the software you're running, Defender is the least of your worries. Unless you're doing a full analysis of every binary you're trusting the source.

</comment></comment></comment></comment></comment></comment><comment><USER8> Whilst I've never been a Microsoft user, it's refreshing to see these moves. For decades they've been an opponent of anything being OSS, let alone running on OSS. While the move isn't for everyone (heck, not me) it's still a very positive step, pretty much in line with Nadella's underlying strategy vis-a- vis Microsoft's newfound growth.

Security mandates such as PCI mandate running anti-virus and friends on a per host basis. They demand a 24-hour event review, FIM, etc. If tools like this come to Linux, it'll make it significantly easier for many organizations to start complying with these mandates. To be clear - these organizations already take security at best as a suggestion - these tools help reduce the barrier to entry so that at least the basics can be addressed.

I'd imagine that well over 95% of Linux users would never run Microsoft tools on Linux. At the same time, for those Windows shops that are experimenting with Linux, or need to support a few workloads, can't afford the dedicated expertise (yet) this is definitely a step forward to help them.

<comment><USER9> > If tools like this come to Linux, it'll make it significantly easier for > many organizations to start complying with these mandates.

You said a lot more than you probably intended. Microsoft created the Microsoft-loving, Linux-hating trade press in the 90's. Consultancies fell into line, and started pushing the theory to uncritical IT management that if you had a computer connected to the corporate network, it had to run a virus scanner. Period; full stop. Regardless of operating system.

I've never met anyone in corporate IT who actually does the math, and determines whether a particular threat vector is worth the cost of the preventative measure. The philosophy in the 3 Fortune 250's I've worked for has been: if it exists, it must be purchased/used/applied. In the 90's, yes, every WINDOWS computer connected to the corporate network needed the corporate AV running on it. Linux? Mac? Not so much. Even if they managed to get compromised, the chance that they would infect a neighboring computer were very small. These odds didn't justify the expense or the hassle of needing them to slaved into the corporate AV solution, no matter how much Microsoft diverted attention away from the very special problem that Windows has always posed from a security standpoint, how much they paid the trade press to paper over it, and how much they partnered with consultancies to push that line. They didn't care about the mainframe, did they? They didn't care about the Unix workstations, either. But Linux? It was the devil.

We have come full circle. Microsoft is trying their hardest to astroturf the message that WSL enables a lot of development workflows for which Windows has been a poor choice of late, and this requires them to "love Linux." So now Microsoft MUST release their Defender product for Linux, in order to be taken seriously BY THE VERY CULTURE THEY CREATED. As a guy who run Linux on the desktop for 19 years, and got my corporate IT (in the 90's) to consider Linux all the way to the point of them looking into a virus scanner for it (finding that Symantec didn't support it, and dropping the idea), the irony here is both delicious and sickening at the same time.

As I keep saying, I'll believe Microsoft "loves" Linux they day they create Office and an AD client for it.

<comment><USER10> > As I keep saying, I'll believe Microsoft "loves" Linux they day they create > Office and an AD client for it.

Microsoft is a company, suggesting a company "Loves" anything is a misnomer. I say this because I sort of disagree here, but only kind-of.

Microsoft embraces ("Loves") the parts of Linux which are compatible with Microsoft's strategy. Linux on Azure is getting quite huge, it's the difference between Azure existing as a profitable business for Microsoft and Azure being a cost center. Microsoft does a fair amount to embrace Linux on the server, they support Docker, they do a lot of work with Node, and have a fair number of people onboard doing Linux specific _stuff_.

Linux AD & Office are only really important to desktop deployments and Microsoft has zero strategic interest in the Linux Desktop. If Microsoft were to port Office & AD to Linux Desktop, it would be an act of charity. If Microsoft is doing charity work, there are a lot of projects I'd like to see them invest in before AD and Office on Linux.

<comment><USER11> I believe porting MS Office to Linux would be a death sentence as all companies would install Ubuntu and Office and call it a day.

<comment><USER12> And interrupt their mostly nontechnical employees' productivity to learn a new OS, for a negligible cost savings? Good luck getting that past a board of directors.

</comment></comment></comment></comment></comment><comment><USER13> Previous startup I was at had deployed the MacOS version of this and the entire Eng department had to petition to get it removed.

It randomly picks files to send to MS for analysis and hijacks 50%+ of the CPU to do it.

I legitimately don't understand what it's trying to accomplish other than another being a telemetry vacuum for MS.

<comment><USER14> Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.

<comment><USER15> > Very nature of this kind of software. Over years I have never seen a proper > antivirus software work without coming on my way. Of course I have not used > all of them but only the most popular ones. Locking files, 100 percent cpu > usage, false positives are some known issues. In the last 5-6 years I have > never seen it correctly report a threat, but that is just for me. I am sure > it is working fine for some.

We use [https://www.crowdstrike.com/](https://www.crowdstrike.com/) and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).

<comment><USER16> Does anyone know how it works with such low overhead? What's it doing differently?

</comment></comment></comment></comment><comment><USER17> I don't think people ITT understand what Defender ATP is supposed to be. It's not just an AV, but rather also has the ability to do threat protection across all your assets in the company.

It can analyze an attackers moves within your network, figuring out what files they accessed, ways they pivoted, and other stuff. So not only would it detect that you got compromised, but the display will show you likely paths, names of users that are also compromised, mitigation steps, deployed persistence measures, etc.

So for Defender ATP to work optimally in a deployment that leverages linux nodes, or has users using linux as their daily driver, you need to support linux.

<comment><USER18> Your statement would have been valid a few years ago. But now all AV providers also offer what you are talking about. AV+EDR with advanced threat hunting UI. So when you say AV today you should really think the other stuff as well.

<comment><USER19> They provide it but often not in the same product capacity, a common structure would be Sophos & CarbonBlack - two separate products by different companies. Additionally they'd need a third product to cover the *nix estate.

Defender, in its current state, rolls all of the above into one at a relatively competitive price point. Additionally, it receives new detections built off all the telemetry they get as a result of Windows Defender existing on almost every Win10 OS on the planet.

This leveraging of data on such a scale is letting Microsoft quickly become the market leader for threat detection & response.

</comment></comment></comment><comment><USER20> Well, I downloaded the .deb file for MDATP, and right off the bat in the installation scripts, it's posting telemetry (literally, LogTelemetry in the scripts) to [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) Then poking around in the giant .so and executable front end, you find a ton more.

What's it sending? Fucked if I know. I figured they couldn't help themselves, though.

</comment><comment><USER21> I swear Microsoft are slowly putting all of the pieces in place for Windows LX, which will be a Linux distribution.

<comment><USER22> If they truly wanted to go that route I think they'd just acquire canonical.

<comment><USER23> Why do you have to jinx it?

<comment><USER24> Now we has. We're all doomed.

</comment></comment></comment></comment><comment><USER25> This requires a "Microsoft Defender ATP for Servers" license. But it isn't clear on how to obtain that

<comment><USER26> As far as I know, it's a corporate tier of the Defender only available to corporate volume license customers.

I guess it's similar to the way many vendors have a "EDR" version of the malware protection as opposed to the consumer version, which often reserve Linux protection for the former.

<comment><USER18> Yes, AT in itself is going to be shelf-ware soon. The data collected from Defender is much more useful in some of their other offerings such as in their newer SIEM.

</comment></comment></comment><comment><USER4> Is it open source? I can't find a GitHub link so I'm guessing it's not

<comment><USER27> An open source antivirus program is a bit oxymoronic. Sure, people can contribute new means of stopping more attacks, but it also shows attackers exactly how to evade it. So you'd be losing more than you'd gain in that situation.

<comment><USER28> Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism.

[https://en.wikipedia.org/wiki/Security_through_obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity)

Edit: Link

</comment></comment></comment><comment><USER29> What does this actually do? The marketing material is decidedly vague.

</comment><comment><USER30> Feels ironic for Microsoft to announce security tools for Linux. Have always thought MS should turn Windows back into a window manager, not a fully-fledged OS, and use Linux as the base under the hood.

</comment><comment><USER31> Seems like offsetting the potential for one kind of spyware in exchange for another.

</comment><comment><USER32> What is this even? Like Snort? I haven't been knowledgeable about the Windows ecosystem since the Web 1.0 days.

</comment><comment><USER33> Trying to bring the performance from Windows to Linux...love it ;)

EDIT: For the down-voter that was ironic, try copy lots of files from one Disk to another (in Windows) and during the copy-progress disable Defender...huge "performance" gain

</comment><comment><USER34> If MSFT figures out how to make this uninstallable on Linux, I will stop using computers.

<comment><USER35> You mean non-uninstallable?

<comment><USER18> No, he's a HUGE Microsoft fan :)</comment></comment></comment>


F*** Your College - <AUTHOR> http://titanhack.com/blog/index.php/2017/03/23/f-your-college/ <comment><USER2> _> Most jobs have completely unmeasurable contributions to the bottom line of the company (eg accounting, clerical, administrative, and such jobs). If you have a job like this, then get a hard skill such that your output can be measured directly. Learn to code, learn to sell, learn digital marketing lead generation, something._

Yeah bro! Forget your bachelor's degree in accounting, that has nothing to do with _serious business._ Serious business means one thing and one thing only: _JavaScript._

 _> If you're gonna be in $80k of debt you better be damn sure you're learning a hard skill that can produce value for employers. This is something that's simply not available in most colleges, so you're gonna have to do research and find somewhere like Full Sail, General Assembly, or TechLaunch (my employer) where it's actually possible to learn worthwhile things._

To summarize: don't waste your time with higher education. Spend your time learning to code, so that you can convince a person who wasted their time with higher education that you're worth keeping around.</comment>


High Energy Physics Community Statement - <AUTHOR> https://www.particlesforjustice.org/ <comment><USER2> > Strumia complains that he personally was not hired for a position that a > woman was hired for, despite having a larger number of citations than her. > He even compares his citation number to that of a (female) member of the > search committee for this job. [... but] almost 1/3 of Strumia's citations > come from being one of thousands of authors on the CMS Higgs discovery paper > [... and] the statistically insignificant 750 GeV fluctuation at CERN, which > disappeared with more data.

Yeah, saying your talk will be about "Bibliometrics data about gender issues in fundamental theory" and then spend parts of it attacking the hiring committee for lacking citation numbers is not really a _proper_ way to behave.

It seems winning the contest for the Iron Throne @ 750 GeV[1] got to his head and he concocted a cunning plan to strike back as the woman who bested him unfairly.

[1]: [http://resonaances.blogspot.com/2016/06/game-of- thrones-750-...](http://resonaances.blogspot.com/2016/06/game-of- thrones-750-gev-edition.html)</comment>


UK child psychotherapist believes smartphones harm youngsters - <AUTHOR> http://www.telegraph.co.uk/news/health/children/11486167/Are-smartphones-making-our-children-mentally-ill.html

<comment><USER2> Claims of this sort have been made about every communications technology in history. The postal service allows young women to communicate with unsuitable men un-chaperoned. The transistor radio is bringing a tide of filth into the bedrooms of young people. Video games cause violence and impair social skills. In every case, those claims were accompanied by plenty of tragic anecdotes but little evidence; In every case, they were eventually found to be largely baseless.

Without any evidence, it seems perfectly reasonable to categorise this claim with the others. If this psychotherapist has concerns, then the appropriate place to raise them is in a scientific journal, not a national newspaper. Doing so is the only way to constructively address the issue, by providing other mental health practitioners with useful case studies and making a case for a systematic investigation. I have found no such publication, but I have found other articles making the same claim in the same newspaper, dating back over two years:

[http://www.telegraph.co.uk/technology/internet/9637676/The-i...](http://www.telegraph.co.uk/technology/internet/9637676/The- internet-can-be-a-dark-and-dangerous-place.html) [http://www.telegraph.co.uk/news/health/children/10234854/Han...](http://www.telegraph.co.uk/news/health/children/10234854/Hannah- Smith-has-shown-us-the-dangers-online.html)

<comment><AUTHOR> In general I tend to agree with your points, but we have also to take in account that the "time to market" of technology (in terms of adoption by a large percentage of the population) has decreased dramatically. So to take one of your examples: when radio was introduced, I doubt that 80% of teenagers got their own personal set before they had left home to go to college (or start working).

This meant that parents had some more time to get acquainted with the technology, and either decide it was not dangerous, or they could ban it if they thought it was really devil-spawned.

So while the complaints are probably similar, the actual scenario is different and would merit some consideration. I don't have offspring myself, but in my circle of friends this is something they have to worry about, and they are far from being luddites.

</comment></comment><comment><USER3> The introduction of the smartphone has changed children for the worse. The children now love luxury; they have bad manners, contempt for authority; they show disrespect for elders and love chatter in place of exercise. Children are now tyrants, not the servants of their households. They no longer rise when elders enter the room. They contradict their parents, chatter before company, gobble up dainties at the table, cross their legs, and tyrannize their teachers.

<comment><USER4> I don't understand modern children. They're all Greek to me.

</comment></comment><comment><USER5> Summary: a smartphone means you're always connected. This leaves some teenagers vulnerable to always-on bullying, especially girls.

It's hard to argue that this isn't a problem given the bullying directed at some adult women on the internet. It's also hard to know what to do about it; unilaterally _not_ allowing your child to have a smartphone when it's the means of communication among their friends guarantees social exclusion.</comment>


Why Facebook Is Rescuing Us - <AUTHOR> https://thereader.mitpress.mit.edu/why-facebook-is-rescuing-us/ <comment><USER2> It sounds like the cure is worse than the disease.</comment>


Lion/iOS 5 APIs included in latest GNUStep Objective-C Runtime release - <AUTHOR> http://lists.gnu.org/archive/html/discuss-gnustep/2011-11/msg00113.html

<comment><USER2> This sounds very cool, but note that this talks about the Objective-C _Runtime_ , which is the plumbing underlying Objective C.

Implementing all Mac OS X ObjC runtime APIs is great, but it's far from implementing the ObjC _framework_ APIs (Foundation / AppKit). In fact, most Cocoa code does not even use the runtime APIs explicitly (though the compiled code certainly does).

<comment><AUTHOR> This is very true, and may have seemed misleading.

Although I should note that the frameworks are not "ObjC frameworks" per se, but rather the Cocoa/OPENSTEP frameworks—which are mirrored, for example, in Objective-C++, making them not exactly ObjC specific, philosophically. But you're absolutely right that this is the difference between being able to use Objective-C on Linux and being able to use Cocoa on Linux :P

</comment></comment><comment><USER3> This is cool -- I've long had a dream of using Obj-C as a system programming language on non-Mac platforms. To be productive you need a lot of things, like NSString and NSDictionary, however. There is GNUStep; is it sufficiently up to date? Has anyone done this?

<comment><AUTHOR> For system programming, that's probably feasible. GNUStep's implementations of NSString, NSDictionary, and other Foundation types are pretty solid (to my limited knowledge). That is to say, if you don't want to use anything beyond core Foundation classes (not CoreFoundation), GNUStep is probably sufficiently up to date to build cross platform system software. Conditional compilation makes this particularly feasible for lower level programming. Most people, of course, just want GNUStep to let them port their OS X apps etc. to other platforms.

<comment><USER4> Any idea why Apple hasn't open sourced anything beyond CFLite? Without multiplatform, objc's ecosystem doesn't get a real chance to flourish, so efforts like this one are great; but I don't get why Apple is making this so hard. Their open-source approach to webkit has proven so successful, yet they show no interest in applying the same pragmatism to objc.

<comment><USER5> Woah. What? The iOS market is a 2.5 billion per year and growing. It is not unusual to only have one type of build system[1] supported per industry (major product line)[2].

[1] Mac with OS X 10.7 with XCode 3 or 4 using iOS API's

[2] The industry is considered the iPhone/iPod/iPad app store only because the other markets, Android and Blackberry, have non interchangeable binaries.

<comment><USER4> _Woah. What? The iOS market is a 2.5 billion per year and growing._

No shit. I'm talking about Objective-C. If more developers could use it and more often, we'd have better libraries, better developers, a better community. Look at the momentum that C++ has despite its flaws.

If you doubt that ObjC developers would be interested in using ObjC but don't because using it on other platforms is too exotic, check this thread: <http://news.ycombinator.com/item?id=3205372>

_It is not unusual to only have one type of build system[1] supported per industry_

So what? Doing things because it's the usual thing to do is not Apple's way of doing things and it's worked for them. That's also why I'm surprised with this.

</comment></comment></comment></comment></comment><comment><USER6> I'm curious about the significance of this. I don't know anything about OS X or iOS development (or mobile development generally). Does this provide a relatively simple way to port apps to non-Apple platforms? Or is more needed than just a compatible Objective-C runtime? If, say, Android shipped with this library, would that make it pretty trivial to produce native apps for both iPhone and Android from a single codebase?

<comment><USER7> From the announcement: _Julian Mayer for providing a demonstration of the capabilities of the runtime by using it for the Linux port of Core Breach, a game written for Apple systems, which makes extensive use of Objective-C 2 features, including blocks._

<comment><USER8> How typical is Core Breach as a Mac application?

</comment></comment></comment><comment><USER9> Has anyone or can you even create an iPhone app or Mac os X app using this software instead of using the standard XCode development suite?

<comment><USER10> I think you'd eventually need to compile with the apple toolchain to get the code signing but other than that if the APIs are there you should be able to do a lot of the dev with GNUstep.

<comment><AUTHOR> This is technically, true, but...

 _> if the APIs are there ..._

The APIs are exactly what aren't there. That is, the runtime APIs are now there, but the framework APIs aren't.

GNUstep's runtime just gained some language/runtime APIs, that is very low level features that appeared in Apple's recent updates to their implementation of the Objective-C language & runtime. This is a very different matter from the gargantuan frameworks (Cocoa, AppKit, UIKit) which Apple has built atop Objective-C. These frameworks are the APIs that should be "there" to allow doing "a lot of the dev with GNUstep"— an they are a long way from being implemented by GNUstep, but some are indeed being worked on.

<comment><USER10> I thought the announcement meant that UIKit, etc was now available via GNUStep.

<comment><USER11> Nope. It's about the support of new language features like blocks in the GNUStep Objective-C runtime.

</comment></comment></comment></comment></comment><comment><USER12> Here's some info about CoreBreach's Linux port being enabled by these changes: [http://www.phoronix.com/scan.php?page=news_item&px=MTAxN...](http://www.phoronix.com/scan.php?page=news_item&px=MTAxNjQ)

</comment><comment><USER13> I thought Apple's Objective-C runtime was open sourced.. I guess I was conflating LLVM/clang with the runtime itself.

<comment><USER14> No, you're right.

<http://opensource.apple.com/source/objc4/>

I can't speculate about why Apple's runtime would or wouldn't be suitable for use in GNUstep though.

<comment><USER15> Licensing most likely. Apple's runtime is under their own custom license (APSL) which is GPL-incompatible.

<comment><USER16> I was about to correct you, but, in looking over the FSF opinion on APSL 2.0, I noticed that while APSL 2.0 is considered a free software license, I had forgotten that the APSL 2.0 license is still incompatible with GPL.

<http://www.gnu.org/philosophy/apsl.html>

Huh. I was pleasantly surprised by the sentence: "Apple's lawyers worked with the FSF to produce a license that could qualify."

<comment><USER2> Yes. RMS was highly critical of APSL 1.0

[http://www.linuxtoday.com/mailprint.php3?action=pv&ltsn=...](http://www.linuxtoday.com/mailprint.php3?action=pv&ltsn=1999-03-22-001-05-NW- LF)

So Apple revised the APSL to address some of his concerns.

</comment></comment></comment></comment></comment><comment><USER17> What are object planes?

This doesn't support ARC, does it?</comment>


HipChat Web client v2.0 - <AUTHOR> http://blog.hipchat.com/2013/07/11/web-client-v2-0-giving-some-love-to-the-web/ <comment><USER2> What would be the killer use-case to use HipChat over Google Hangout? I feel like I'm missing something.</comment>


We Got Spanked: What We Know So Far - <AUTHOR> https://medium.com/spankchain/we-got-spanked-what-we-know-so-far-d5ed3a0f38fe <comment><USER2> > _1271.88 BOOTY belongs to users (~$9,300 total), and the rest belonged to > SpankChain._

Somehow my sympathy for anybody who invests in a cryptocurrency called BOOTY that's stored on a SpankChain is somewhat limited. Particularly since, once again, the money wasn't really "hacked" or "stolen", just taken by somebody who exploited a contract. Code is law, right?

> _It was our decision to forego a security audit for the payment channel > contract._

...and I don't have a lot of sympathy for SpankChain people either.

<comment><USER3> What makes you think we want your sympathy?

</comment></comment><comment><USER4> I remember meeting one of the technical cofounders of SpankChain the weekend of their ICO. He was very tired but excited to be done with the project and onto his next ICO idea. He was adamant about not having his name attached to it. It didn't strike me as a very serious project for that reason, among others.

<comment><USER3> I fired him.

</comment></comment><comment><USER5> Could someone explain what's happening in the update at the top? It sounds like they got in touch with the guy who stole their money, convinced him to give it back, and then...tipped him a total of $9000 as a reward for...something? That can't be right, can it?

<comment><USER6> It is right, they say it is cheaper than most audits.

<comment><USER3> The hacker was also kind enough to audit two of our other contracts pro-bono :)

<comment><USER5> Does that mean he actually gave you a thorough audit, or that he tried to crack them and failed and you assume that means they're solid?

If the former, do you have reason to believe that he's trustworthy?

</comment></comment></comment></comment><comment><USER7> Probably a pointless question but why is there a blockchain here?

<comment><USER3> From the intro of the whitepaper:

[https://spankchain.com/static/SpankChain%20Whitepaper%20(EN)...](https://spankchain.com/static/SpankChain%20Whitepaper%20\(EN\).pdf)

The $100B adult entertainment industry has faced routine discrimination at the hands of banks, payment processors, and financial institutions. These service providers simply refuse to service those in the adult industry. In 2014, JPMorgan Chase closed the bank accounts of several high profile porn stars and their families without justification . In 2015, Visa and Mastercard stopped processing payments for advertising on Backpage.com. Paypal is notorious for closing the accounts of performers and seizing their funds. This discrimination and censorship has persisted despite the FDIC declaring it unconstitutional and in violation of the First Amendment.

Making matters worse, middlemen in the adult entertainment industry have historically extracted exorbitant fees due to a lack of competition in the space. The popular adult-friendly payment processor CCBill takes a 10.8-14.5% cut of payments and charges a $1,000 'high-risk' registration fee annually, pricing out many potential entrepreneurs. Most adult camsites take between a 30-50% cut of performer earnings, and adult content marketplaces such as ManyVids take a 40% cut or more.

Blockchains represent a viable alternative to the discrimination and inefficiencies of legacy financial institutions. Public blockchains are globally distributed systems of record that provide permissionless access to anyone with an internet connection. Anyone, regardless of their profession, can use a public blockchain to store their funds and transact without fear of having their accounts shut down. Blockchain transactions also have strong finality guarantees, so the fraudulent chargebacks used as justification for classifying adult entertainment businesses as 'high-risk' are effectively impossible. Further, blockchains such as Ethereum, which support smart contracts, can be used to decentralize the business processes of expensive middlemen and render them obsolete.

<comment><USER7> Just words that make no sense.</comment></comment></comment>


Second Theranos Lab Failed U.S. Inspection - <AUTHOR> http://www.wsj.com/articles/second-theranos-lab-failed-u-s-inspection-1484708428 <comment><USER2> It's really a shame that VCs don't seem to have figured out how to do DD on science based startups.

The same is probably somewhat true in tech generally, but VCs in this area don't seem capable of doing the DD. They invest based on personality, connection or business background.

That's all great, but really what these early stage companies need is a CEO with a strong scientific background and focus.

In my experience, those CEOs often don't come across as strong enough to investors who are generally more comfortable investing in tech, which is easier for them to understand.

So my hope is that high profile failures make VCs wake up, and assess scientific startups differently. However I think it's more likely that they'll just avoid them all together.

<comment><USER3> > It's really a shame that VCs don't seem to have figured out how to do DD on > science based startups.

Actually life science VCs do, which is why none of them invested. Theranos' investors were tech investors.

</comment></comment><comment><USER4> Unpaywalled summary: [http://www.marketwatch.com/story/theranos-could-face- new-san...](http://www.marketwatch.com/story/theranos-could-face-new- sanctions-after-failures-at-second-lab-2017-01-17)</comment>


Douglas-Quaid – Open-Source Image Matching Library - <AUTHOR> https://arxiv.org/abs/1908.04014 <comment><USER2> Abstract:

> Security analysts need to classify, search and correlate numerous images. > Automatic classification tools improve the efficiency of such tasks. > However, no open-source and turnkey library was found able to reach this > goal.

GitHub link I had to dig through to chapter 7 to find:

[https://github.com/CIRCL/douglas-quaid](https://github.com/CIRCL/douglas- quaid)

<comment><AUTHOR> True. This may be relevant to highlight the library link in an easier way. Thanks for spotting.

</comment></comment><comment><USER3> Was this named after Arnold Schwarzenegger's character in the movie Total Recall?

[https://villains.fandom.com/wiki/Douglas_%22Doug%22_Quaid/Ca...](https://villains.fandom.com/wiki/Douglas_%22Doug%22_Quaid/Carl_Hauser)

<comment><USER4> Yes. That's the only reference i had for that name, too. I remember the scene where he was trying to bypass the checkin at the station and messed up his camouflage ...

He was pretending to be a woman.

One day i was in berlin on a train, and i swear i saw a woman looking exactly like this. Really terrifying. I had to stop looking at her, but i just couldn't believe what i saw.

It was like every moment Douglas-Quaid would appear after he'd run out of batteries for the cloak :)</comment></comment>


Highlighter.js - <AUTHOR> http://720kb.github.io/highlighter.js/

<comment><USER2> I don't get why this requires a special purpose library. Why not create a css class _highlighted_ where the borders of an elements would be in fluorescent green and modify the class of the elements of the DOM one wants to highlight with jquery?

<comment><USER3> I agree, most of the code in the library is for element navigation. Why not open-source that and let people define their own CSS props.

By the way, I believe it uses the `outline` CSS property as opposed to `border` (border changes layout, outline doesn't).

<comment><AUTHOR> Yes it's outline, just because it is probably the less used css rule available for the scope. Probably the alternative could be box-shadow. Having to modify borders will probably result in breaking third parties CSS etc.. more troubles guess.

The code is already open-source, feel free to open issues, fork and PR also if you want to add new features, the door is open wide!

<comment><USER4> Yeah, you also have to account for box sizing by adding borders. What I've done for this in the past is use a css &:after pseudo-element and make it absolutely positioned, and set width and height at 100% and position it at left: 0 and top: 0. You can do things like give it a fill with opacity too, to highlight not with just outline but color overlay too.

.outlined:after { content: ""; position: absolute; top: 0; width: 0; height: 100%; width: 100%; background-color: green; opacity: 0.3; }

.outlined { position: relative; } // this part my be a poor assumption

<comment><AUTHOR> Hi, yes this is another alternative, probably the best one but it's hard actually to find the real best one because in the end everyone use different styles, different css frameworks, different use cases, in many cases it may break something in many others not, you know :)

Anyway appreciated a lot your example and your tips, let's just wait for some feedback from people who use it and make decisions more clear.

Thank you really :)

</comment></comment></comment></comment></comment><comment><USER5> Neat little tool, and love the size constraint!

I made a little JS bookmarklet a while ago that reveals script, style, and meta tags, and tries to display which tags are used to build the layout: [http://www.youtube.com/watch?v=wp2d24t2POI](http://www.youtube.com/watch?v=wp2d24t2POI)

Are there any plans in the future to make your tool so the highlight follows that I tap on mobile? Keep up the great work!

<comment><AUTHOR> Hi, thank you a lot for supporting, the aim, actually, is to stay lightweight, but for sure you can bind it for your own pourposes and needs, like tap and select, or click and select, why not :)

This project was meant to easily surf the nodes and maybe highlight them, but it's still at early stage and any help is much appreciated!

Thanks for sharing the video, very interesting :)

</comment></comment><comment><USER6> zooming in on Android 4.4.4 browser prevents scrolling for me

<comment><AUTHOR> Hi, thanks for reporting the issue, it's still at early stage we need to improve it.

Here you can check what's wrong and post new issues [https://github.com/720kb/highlighter.js/issues](https://github.com/720kb/highlighter.js/issues)

Any help is appreciated!

</comment></comment><comment><USER7> People were doing this 15 years ago, before all the hipster web designers picked up javascript, opened terminal and called themselves programmers.

I"m sure the old JS programmers moved on to a real programming language, but they put you new guys to complete shame, and they didn't need 18 dependencies and a dependency manager to get it done.

jQuery was a great invention for web development, but everything since then has been total crap. Angular, React, Node, all of it's crap. The only people who like it are those who aren't smart enough to be real programmers.

<comment><USER8> Whatever you say old man</comment></comment>


Base Web, Uber's New Design System for Building Websites in React - <AUTHOR> https://eng.uber.com/introducing-base-web/ <comment><USER2> I guess we can add Uber to this list of corporate frameworks...

[https://news.ycombinator.com/item?id=18235887](https://news.ycombinator.com/item?id=18235887)

[https://element.eleme.io/](https://element.eleme.io/)

[https://ant.design/](https://ant.design/)

[https://quasar-framework.org/](https://quasar-framework.org/)

[https://at-ui.github.io/at-ui/](https://at-ui.github.io/at-ui/)

[https://developer.microsoft.com/en- us/fabric](https://developer.microsoft.com/en-us/fabric)

[https://vmware.github.io/clarity/](https://vmware.github.io/clarity/)

[http://appnexus.github.io/lucid/](http://appnexus.github.io/lucid/)

[https://ng-lightning.github.io/ng-lightning/](https://ng- lightning.github.io/ng-lightning/)

[https://blueprintjs.com/](https://blueprintjs.com/)

[http://www.jetbrains.org/ring-ui/](http://www.jetbrains.org/ring-ui/)

[https://www.lightningdesignsystem.com/](https://www.lightningdesignsystem.com/)

[https://elastic.github.io/eui/](https://elastic.github.io/eui/)

[https://atlaskit.atlassian.com/](https://atlaskit.atlassian.com/)

<comment><USER3> You seem to trying to express a negative response to the fact that these companies create design frameworks. I'm interested as to why you feel this way?

<comment><USER4> >insert xkcd framework reference<

</comment></comment></comment><comment><USER5> The overrides pattern they describe sounds like a nightmare to maintain. It's almost the exact opposite of how I'd design the API for a set of reusable components: provide a minimal API surface to cover existing use cases, and evolve the API deliberately to cover new use cases as they arise.

Allowing users to override arbitrary styling parameters is a recipe for disaster in a reusable component, because once you start doing that, literally any change you make to the component could become a breaking change for some usage of it in the wild. There is no more explicit interface that users of the component are expected to work with that you can hide implementation details behind, as to afford you the ability to change those implementation details without breaking users, because users can just reach into your implementation details with those arbitrary parameters and change them at will, in a way that's potentially incompatible with how you might want to evolve the component in the future. As a side effect, any sense of brand/design consistency you might want to enforce through a design system goes out the window. Interestingly enough, this set of components use component-oriented CSS-in-JS, which is a pattern developed specifically to provide style isolation between components that wasn't possible (or at least not in a foolproof way) with regular CSS, yet they chose to open that can of worms back up through their API.

I've found that a much better middle ground is to deliberately accept React nodes or render props in your components so that you can explicitly yield control of rendering to users for specific, isolated pieces of the component, like the contents of a modal or the individual options of a dropdown. This gives users freedom to render what they need to render, but within the confines of a consistent design framework that enforces overarching rules around consistent use of spacing, colors, transitions, etc. And such an API can still be evolved deliberately to support new use cases without the risk of breaking users unintentionally.

<comment><USER6> I get this concern and I used to have a very similar feeling about it. Uber had an older React component library that was more locked down in a way you pretty much described. Number one complain was "not easy to customize" and that probably applies for every component library out there.

You describe render props as a "middle ground". For us, it is the last resort / nuclear option (as described here [https://baseweb.design/theming/understanding- overrides/#over...](https://baseweb.design/theming/understanding- overrides/#override-the-entire-subcomponent)). You give the consumer all the freedom to completely replace the guts of your component. Sure, nothing provides more flexibility but at the same time, consumer has to do a lot of heavy lifting - creating a whole new component.

However, developers usually want to tweak some small things. Maybe changing some color or padding. Forcing them to swap the whole subcomponent through render prop is an overkill and once they "opt-out" that way, they will never get any updates from us since that part of component is completely replaced.

Of course, ideally we want them to always use the defaults but that's not how real organizations with thousand of engineers and hundreds of apps work so we rather let them customize but on our terms. We don't want to see them hacking the styles through CSS selectors or "render prop" everything which equals not using our visual components at all. It's a compromise we had to make to make everyone reasonably happy.

Surprisingly, it's not a nightmare to maintain. We don't consider changed styles as a breaking change and in last 6 months I haven't seen complains about that. Although, it makes the Base Web codebase more complex and all changes need to be thoughtful. But that's a cost that Base Web pays so other teams don't have to.

<comment><USER7> Do you use any sort of visual comparison tools or snapshotting in CI to catch regressions caused by changes to Base? Seems like this would remove any (technical) objections to having overrides.

<comment><USER6> We currently use [https://screener.io/](https://screener.io/) for Base Web itself and working on an app that should automatically crawl all our web apps, analyze them and provide insights into how exactly our components are being used. It should be open sourced eventually.

</comment></comment></comment></comment><comment><USER8> Nope. This is replacing composition with configs for no good reason. It's like the people who made Grunt and Webpack teamed up to ruin React for everyone.

<comment><USER9> I really hate dismissive comments like this.

They laid out pretty well what problems this is trying to solve, why they want it that way, the benefits it has, and some of the tradeoffs it makes.

Saying it "replaces composition with configs for no good reason" is not only wrong (they still heavily use composition here, it even makes it more powerful in some ways from what I can tell so far), but also doesn't really mean anything on it's own (at least to me it doesn't).

<comment><USER8> Ok, fair enough. It was a drive by shooting of a comment. So here's a more considered criticism.

There's already a way to overwrite props in react. Just use props.

If you need to expose the native API of the underlying element, do this (does HN format code?)...

``` const {foo, ...native} = props;

<label {...native}> <p>{foo}</p> </label>

```

Combine that with default props and you're good to go.

There's already a way to allow components to take multiple types of children.

``` <Select render={ blah => { return <CustomOption>{blah}</CustomOption> }} /> ```

And there's already a multitude of ways to adapt styles based on props, the most obvious of which is StyledComponents.

In addition, this highlevel config is brittle. It means parents must be coupled to their children, and children coupled to their parents.

And where does this config end? How deep does the nesting of this configuration go?

Here's my opinion; if you think you need this sort of configuration to properly wrangle your UI, then you've failed to grasp the point of React and the true power of composition.

React components are just functions. Preferably pure functions. Once you strip away the JSX, you should be left with something that resembles functional programming (albeit taken to an extreme thanks to JSX's goal of emulating HTML). Props are parameters. We've all come across code where functions take complex and convoluted objects as arguments that trigger an explosion of calls that are near impossible to track or reason about.

This override solution is the first step in towards turning React into the kind of tool that it usurped. It has the stench of ExtJs and it's ilk.

This "solution" was created by people who believe all problems are better solved by abstraction.

As programmers, our time is spent on the edge cases. Our text book prefect algorithms and mathematically sound functions are exposed as frauds the second they're exposed to user input. Our carefully crafted UI libraries fall to pieces when the designers choose to break their own rules.

For configuration to work, it requires god level foresight and will eventually become Turing complete in itself.

Config is for the birds. Declarative code has always been the answer.

<comment><USER10> A big part of the goal with the overrides mechanism was to provide usable components out of the box that could optionally be modified if something needed to be changed for a given use case.

You can use the components as is, using props if you're ok with the out of the box style/functionality/etc, without ever touching overrides. The overrides provide a standardized interface to changing the component internals across the entire component library.

That approach may be overkill for simple components that are trivally composable (Card for example), but is incredibly powerful for a component like Datepicker where you may want to change styles or functionality of a deeply nested component without exposing a massive top level props interface.

<comment><USER8> But you're still creating a suite of components that can be composed to create a specific instance of a date picker. Except with the override config, you're now complicating and limiting the simple and versatile concept of composition.

Your components now need to follow some pre established and short sighted rules in order to understand how to manage their own children.

To use the example in the article, lets say you have an Option component, but now you want a version of that component that takes two additional components under certain conditions. E.g, an icon, and a checkbox? But only when one specific Option has a specific combination of props?

How does this override system handle that? It doesn't. Composition handles that. But if components are created with this override system in mind, they lose the ability to be composed in more complex ways than the designer of the override system imagined.

<comment><USER8> It turns out I was wrong about this, but not in a good way.

It appears you can pass functions to the config that render components, which presumably can also take an override config which in turn can take a function to render components and so on. So it's basically negating the entire point of JSX. It's halfway between JSX and React.createElement. The worst of both worlds.

</comment></comment></comment></comment></comment></comment><comment><USER11> I've been searching for a basic React UI component system for awhile now. There are a lot of systems available, but each one has significant drawbacks to the point I end up just rolling my own.

I think an ideal system would have a core set of "unstyled" components with the necessary functionality baked in. That way the overall aesthetic is up to you, but a lot of the painstaking UI work (e.g. showing, hiding, and highlighting elements in a dropdown menu or making sure a layout element breaks properly on mobile) is already done.

From there you could build UI "kits" that use the core functionality but each have a distinctive look and feel.

<comment><USER8> For the past few years, i've been building "reusable component libraries" and I can say with confidence that they're a massive waste of time.

When you get into it, the UI usually the least difficult problem to solve in an app. The real challenge is state management, control flow, and wrangling sode effects.

Alas, people are still wedded to the idea that UI is where all the time is wasted.

The truth is, it's always been easy to put a button on a screen. But making that button do something? That is a much bigger problem. I'd argue that 99% of the effort of putting a button on a screen goes into implementing whatever that button does. But stakeholders don't understand that. They think buttons just do the thing they do, so when it takes six weeks to put a button on screen, they naturally assume that a reusable component library that includes a button will somehow shave days and weeks off a project.

Which is why they gravitate towards UI libraries. And then they introduce a new problem that wasn't there before. They want us to use Material UI, but they want us to make it look different. And they want a bunch of extra UI elements to boot. So not only do we still have all the original problems of creating an app, we're now on the hook for turning some implementation of Material UI into something that fits with with our architecture, but is also completely different.

So while I hate UI libraries, I recognise that they're something inflicted on a team. So I've started work on a UI library designed specifically to address this problem. It's a UI library that's meant to be changed and easily customised by it's consumers. It's minimal functionality and minimal styling. I'll announce it here on HN when I think it's ready. It may never be ready because not only is it a difficult problem to solve, I'm also very lazy.

But anyway, I say all this because I hear what you're saying, and I'm working on it.

<comment><USER12> FYI, Material UI is working on the issue as well [0].

[0] [https://twitter.com/olivtassinari/status/1120818781058686979](https://twitter.com/olivtassinari/status/1120818781058686979)

</comment></comment></comment><comment><USER13> Finding a good React UX library is tough. None is ideal. Too heavy, too small, too slow, too dirty.

Settled on ant.design for a while, not perfect but good enough.

<comment><USER14> Any other good candidates? This is something I really need to look into soon.

<comment><USER15> I've found Materia-UI to have the best code quality, most up-to-date. If you don't like Material UI theming it's also easily overridable.

Downside of ant-design is that the library is huge (there was a bug recently where the whole icon library was included in the bundle!), some of the components have bugs, style/look is not easily modifiable.

<comment><USER13> Love ant-design and currently, you can use tree shaking I believe. It is otherwise a heavy lib for sure. Not great for B2C apps, but for B2B with caching it should be okay if users have decent broadband speeds.

</comment></comment></comment></comment><comment><USER16> So this is basically a component framework ala [https://element.eleme.io/#/en- US/component](https://element.eleme.io/#/en-US/component) with some theming standards?

Edit: The drag and drop component is nice and looks well-built. I had to use vue-draggable [1] for an app recently which was just a hacky Vue layer on top of Sortable.js [2]. It's one thing I wished ElementUI supported natively.

[1] [https://github.com/SortableJS/Vue.Draggable](https://github.com/SortableJS/Vue.Draggable)

[2] [https://github.com/SortableJS/Sortable](https://github.com/SortableJS/Sortable)

</comment><comment><USER17> > drag and drop Lists are notoriously difficult to implement because browsers > provide little help when developers have to build drag and drop > interactions. Developers using Base Web have the peace of mind that keyboard > navigation is reliable and works well with screen readers.

FYI, their drag and drop sample doesn't "work well with screen readers". It's overly verbose and requires keyboard passthrough to operate. So maybe don't take any web designers at their word when they say you can just use their framework and forget about accessibility.

</comment><comment><USER18> I'm surprised that many huge React libraries don't expose its core Context for user to consume.

Context is the most important concept in React.

Actually, a library just need users to provide the right types of Context to be flexible.

I'm tired of the "lock in" API, in which, it doesn't allow me to just get my context data into its arguments API.

In this sense, you can consider Context as the local version of Redux.

<comment><USER19> As someone who stopped doing React development before Context became a "thing", is it possible to ELI5 in a couple sentences why it is such an important concept?

<comment><USER18> It's important, because you don't need to care about props vs state, instead, just consume the context deep in your component tree.

One use case, is, suppose you have two independent contexts at two branches, now, if you want to share those data to 3rd branch, you just create new context with value from the first two contexts.

<comment><USER20> This is starting to sound like the scope from Angular 1.

<comment><USER21> Contexts in React are like raw pointers in C++. There are reasons to use them, but every time you do, it should raise eyebrows, because they are finicky, complicated to reason about, and thus full of pitfalls.

</comment></comment></comment></comment></comment><comment><USER22> Nice, looks very well made.

It does force everyone in your organization to not only use React, but also Styletron which might be a pretty large switch for some teams. Has this been a problem?

I think this could lead to limited adoption in some organizations because autonomies teams want to keep delivering with their current stack.

One idea I considered is to have an Atomic CSS library for theme stuff like whitespace, color and typography, and compose those into components for React or Svelte 3 or whatever is hot right now.

All other styling could be done with Styletron, styled components, or plain CSS, whichever suits your team.

<comment><USER6> Yep. React was adopted a long time ago and it is also now the "industry winner", so no complaining there. Styletron is also older - created more than two years ago.

However, CSS in JS is more controversial and there are some other more popular libraries now. We keep monitoring them and at the same time we are bringing the best features back into Styletron. Also, you could use BaseWeb+Styletron and some other CSS solution for everything else. It's not a big deal (Styletron has like 7kB). But all CSS in JS libs are very similar anyway.

So overall, Base Web was not a big tech switch, React and Styletron have been already widely used.

</comment></comment><comment><USER23> Referencing and being inspired by someone's Design System is a good thing. Try looking at a bunch of them to get a better perspective.

However, using someone's Design System may not always be a good choice. Unless, they are lean, non-directional and are mostly patterns that you can adapt to any tech stack or systems. For instance, Google's Material Design Philosophy is a good starting point and you can leverage it as your base system. You'll still need to understand the WHYs of the principles. Without understanding the core principles and the WHYs, you'll be dependent on it in the wrong fashion.

Here is an example without trying to single it out from the other Design Systems. Sometime back, I studied Ant.Design to see if I can adapt to a massive product overhaul. Unfortunately, I realized that it is a system more specific to the way AliExpress does and think about their design. And technically it was in LESS (CSS Pre-Processor).

There are many good, well thought out systems. One being that of AirBNB's JavaScript styleguide.

Be inspired, and possibly start with a system that has fewer restrictions, a lot of community activity behind it.

<comment><USER24> What's meant by non directional ?

<comment><USER23> Now, I'm not sure if I used the right vocabulary. I meant, it has constraints which lead you one way in a singular path, their way.

</comment></comment></comment><comment><USER25> Before even looking at the details ... why would I use this? Uber is not a company that is known for great websites. They get (I'm guessing) 99%+ of their usage through native apps. So why would I believe they're particularly good at building for the web?

<comment><USER26> It's probably got more engineers behind it than the vast amount of design frameworks, given Uber's size. And some of the components feel pretty nice, so maybe try looking at the details?

</comment></comment><comment><USER27> Can you use this outside of React? I'm interested in the styles, but I'm not using React.

<comment><USER28> This is why Web Component interest is growing, especially w/ enterprises and large teams. The killer app for WC's is building Design Systems that don't force specific frontend framework decisions.

<comment><USER29> Do you have a source? I'd like to explore WC, but from what I have gathered WC evangelist are dying out to React ecosystem.

</comment></comment></comment><comment><USER30> The overrides system is weird, to say the least. Any consumer can change styles and erbitrary HTML attributes deep inside a component's DOM tree

This breaks encapsulation. As an app developer how do I know my change will be future proof? As a component developer how can I refactor a component or change its behaviour without breaking my consumers?

It feels like stuffing the worst parts of jQuery and old-school CSS back into React.

</comment><comment><USER31> Why do they call it a "design system" instead of a framework .. you know like 99% of the web does

<comment><USER32> React is the framework and their design system uses a specific set of rules within the React framework to build consistent end UI/UX.

<comment><USER33> React is not a framework. It's just a view library.

<comment><USER34> React is a view library, _with an opinionated methodology_ and congrats: now you have a framework.

</comment></comment></comment></comment><comment><USER35> Unfortunately the accordion component is not smooth at all. Otherwise, a valiant effort.

</comment><comment><USER36> CSS-in-JS is an unmaintainable disaster. Write your SCSS, keep it modular, and import it as a JS object with sass-loader.

<comment><USER15> CSS-in-JS allows for easy JS-based code-splitting (if you've got that setup) and inlining critical CSS on the page.

<comment><USER36> >CSS-in-JS allows for easy JS-based code-splitting (if you've got that setup) and inlining critical CSS on the page.

All of this can be accomplished without keeping your source of truth in JS config files. SCSS or CSS files can easily be loaded with Webpack and imported into your code. Then you're not giving up the simple yet powerful expressiveness of CSS selectors for a nightmare of nested JS objects.

<comment><USER15> Generally CSS is loaded into your code where you require them but has to be extracted into a single bundle.

If you want to it _truly_ be loaded into your code where you use it, then CSS- in-JS is the solution and does this for you.

It sounds like the main gripe you have is with syntax, and that's not really required with CSS-in-JS. The 'nightmare of nested js objetcts' can be hidden in the implementation. In fact, many libs (such as emotion) allow you to write CSS syntax using babel macros to preprocess this into javascript.

</comment></comment></comment></comment><comment><USER37> Horay, finally, where do i throw my money,

</comment><comment><USER38> Imagine creating this beast of a "framework" and not even using TypeScript or Flow. What are you thinking?

Edit: It does use Flow.

<comment><USER11> Sigh. I really wish people would just accept the fact that JavaScript is a dynamically typed language and stop making things unnecessarily difficult.

<comment><USER9> That's why I love Flow and Typescript so much. They are as opt-in as you want them to be.

I've seen a team use typescript, but have zero types in most of their files, they just used it from libraries to get some IDE autocomplete and some very small typing on core areas.

</comment></comment></comment><comment><USER39> This article makes a lot of noise about Uber's commitment to accessibility. So I am led to believe that this new React gizmo is fully accessible.

Yet Uber can't be bothered to make efforts to get basic accessibility right on the page that tells us this.

The main content is not in a <main> element, this <main> element being the landmark that tells people using assistive technologies where the main content is.

Then the navigation links, e.g. in the footer are not in <nav> elements.

The code sample in the middle is an image. It should be in a <figure>, <pre>formatted and in a <code> block for accessibility.

It is a bit hypocritical to write an article about how wonderful your product is for accessibility and not make it accessible.

<comment><USER40> Those are issues with the CMS being used to host the blog. The blog has been around for a long time and isn't using BaseWeb.

What you're suggesting is that when someone releases a library with a commitment to accessibility, they are also responsible to reach out to some completely unrelated comms-focused team, take over their CMS workflow, rewrite it entirely with the new framework, and only then make a blog post about the thing you were trying to talk about.

<comment><USER39> It is not difficult to put a <figure> in Wordpress with some code inside it.

Some things you either have or you don't. Accessibility is one of those things. Either you think it is actually important or you don't.

The Uber comms team also need to be living and breathing accessibility. It is part of what comms is about.

<comment><USER40> Who is "you"? Me personally, the team behind BaseWeb, the comms team, Uber as a whole? Companies by definition can't "care" since they are emotionless entities, so you must mean a physical person. But physical people within a large organization might care about different things with different degrees of priority or be prevented from doing the best thing (tm) for various reasons. But we all already knew that.

</comment></comment></comment></comment><comment><USER33> My favorite part about Base Web is that it's broken.

How to reproduce:

1\. Visit the official website [https://baseweb.design/](https://baseweb.design/)

2\. Click "Welcome" on the sidebar.

3\. "An unexpected error has occurred."

No thanks, Uber. Your community of broscience engineers permanently lost me as a customer after the Susan Fowler writeup, and I'm not interested in your buggy technology either.

<comment><USER41> Cannot reproduce.

<comment><USER33> It's probably because I'm using uMatrix and it's blocking something "critical" that breaks when you try to visit the Welcome page.

<comment><USER9> Wait so you are blocking their javascript then claiming it's broken?

I was curious, and I just went in and tried blocking the google analytics, google tag manager, and everything from cdn.jsdelivr.net, and even some random scripts (like the commons.js file), and everything still worked fine as far as I could tell...

<comment><USER33> It's loading the first-party scripts (all 58 of them), but there must be even more delivered by a CDN that it requires.

[https://i.imgur.com/iGqwpWR.png](https://i.imgur.com/iGqwpWR.png)

</comment></comment></comment></comment></comment><comment><USER42> It looks pretty nice. My pet peeve with "modern" web design is that it has become, objectively, very effeminate. Uber tends to leans more neutral to slightly masculine.</comment>


GitHosting – Git SCM Wiki - <AUTHOR> http://git.wiki.kernel.org/index.php/GitHosting <comment><AUTHOR> @EdgarSanchez: _For all the people who left #github and migrated to #gitlab on a rush because you don 't like Microsoft, welcome to Microsoft #Azure _[0]

@app4soft: _SourceForge, GitHub, GitLab... Last frontier: repo.or.cz_ [1]

@probonopd: _SF = advertising infested, gh = owned by ms, gl = hosted on ms, .cz = .cz!_ [2]

[0] [https://twitter.com/EdgarSanchez/status/1004087778760646656](https://twitter.com/EdgarSanchez/status/1004087778760646656)

[1] [https://twitter.com/app4soft/status/1004406808239362048](https://twitter.com/app4soft/status/1004406808239362048)

[2] [https://twitter.com/probonopd/status/1004427931496669184](https://twitter.com/probonopd/status/1004427931496669184)</comment>