Mozilla Will Stop Developing and Selling Firefox OS Smartphones - <AUTHOR> http://techcrunch.com/2015/12/08/mozilla-will-stop-developing-and-selling-firefox-os-smartphones/ <comment><USER4> Firefox appeared at a time when there was huge potential being stifled by a stagnant monopoly in the space, and people were desperate for something good. It filled a real need, and people loved it.

FirefoxOS appeared at a time when there was huge potential being actively being pushed forward and innovated on by the two largest tech companies in the space, and people already had two great options to choose from. It filled no real need, and nobody wanted it.

For Mozilla to stay alive, they need to pick a space that is currently desperately needed but being ignored by large corporations and the government: privacy and identity. Mozilla could be the champion of the Snowden era, yet instead they're distracting themselves with IoT, VR and other shiny new toys.

(And yes, I realize that users don't care about privacy. But nobody cared about web standards, either: it's all about packaging. That's Mozilla's strength.)

Mozilla is a non-profit with a mission ([https://www.mozilla.org/en- US/about/manifesto/](https://www.mozilla.org/en-US/about/manifesto/)). It's time they start acting like one again.

<comment><USER5> Outside of hacker news, I haven't heard of Firefox OS even once. They had no marketing to speak of, and you have to complete HARD on marketing to get into that market.

"If you build it they will come" isn't a valid benchmark when there's already two options with massive market share that consumers are more or less happy with.

(Since it's talked about in some replies, I live in the US).

<comment><USER6> Just as a counterpoint, I regularly saw Firefox os+phone ads on giant billboards in central Warsaw.

 _If_ there was to be any market interest, I thought their targeting and marketing efforts like this were pretty spot-on.

<comment><USER7> Oh yeah, I've read about them targeting some specific countries (Spain, Brazil, Poland, etc). So it might be that the parent commentator lives elsewhere and didn't get targeted :)

<comment><USER8> Telefónica, the major carrier in Spain, sold some Firefox OS phones years ago under the promise that there would be a version of WhatsApp for Firefox OS soon. That never happened. They eventually stopped selling them.

(Not implying there is any correlation between those two last facts.)

<comment><USER9> There is Whatsapp client Loqui IM.

</comment></comment></comment></comment></comment></comment><comment><USER10> Most of you are probably not aware that Opera Software (where I spent a decade on Opera Mini/Mobile) went down the same rabbit hole around 2002-2006, spending many many man-years building a web-based (pre-smartphone) phone UI platform using web technologies. The product name was "Opera Platform". Here are some screenshots:

[http://imgur.com/on4gHdi](http://imgur.com/on4gHdi)

It failed for the same, predictable reasons: Yes, there are many web developers in the world compared to the number of (in this example) embedded rtos UI C/C++ developers. However, on resource-constrained platforms (as phones tend to be, since they are battery-powered) it's really hard and requires brilliant developers to be able to build web-based UIs that can compete in performance with non-web-based UIs built by (in comparison) not-so- brilliant developers.

And on top of this, Mozilla decided to shoot for (super) low-end devices as their main target - presumably because their bizdev people had spotted a theoretical opportunity, but failed to connect with engineering, or vice- versa. The first time I saw that I just laughed out loud, to be honest.

They actually have a time-honored tradition of following in the footsteps of Opera when it comes to ways of making money. Those sponsored tiles introduced in Firefox last year? Opera did that in 2008/2009-ish. (Not to mention the concept of a graphical speed dial on the new tab page itself...) That Google search field to the right of the URL field? Opera pioneered that business model in 2001 - followed by Mozilla and Apple half a decade later. Sorry, I get carried away. :D

<comment><USER11> To be fair, the "low-end" devices Firefox OS were targeting were miles more powerful than what Opera Platform targeted a decade prior, and JS VMs are far quicker than they were a decade prior… I'm not sure it's so obvious that low- end devices doomed it to failure (of course, you actually worked on this stuff unlike me!).

I think it's worthwhile to remember at the time Firefox OS launched much of Android ran on the Dalvik VM, so it wasn't so clear cut that the approach was so doomed to fail.

<comment><USER10> (Hi Geoffrey, ltns! :) )

The execution of the code, be it javascript on some modern engine or Java/Dalvik bytecode - that isn't typically the performance bottleneck. It is fast enough now.

I'm not an expert on this (this is where I thread on thin ice), but my understanding is that the HTML/CSS logdoc/layout tree model is inherently non- performant compared to a more traditional hierarchical windowed object oriented model. It is too easy to write HTML/CSS that is not performant (it's way too easy to accidentally cause performance issues), while it is a lot more natural to write performant windowing/OO code. And inversely, harder to write code that is not performant.

<comment><USER11> (Hi. :))

It depends a lot on what you're doing, and how much data you're processing. If we go by the premise that you're processing more data locally than you would in a web app (because you don't need to worry about the latency and you don't have a server to do the pre-processing and filtering of the data before it reaches the client), then actual VM performance is more significant. The last time I looked at any profiles of browsers on Gmail or FB, JIT'd code actually accounts for several of the most expensive functions (and you _will_ notice if you disable the JIT). JS performance _does_ matter—even if DOM performance dominates in the case of the common website (and note that Mozilla has actually been doing quite a lot of interesting work around teaching the JS VM more about the DOM, including rewriting parts in JS, which allows JIT optimisation to happen).

It's definitely true that it's easier to write non-performant code using HTML/CSS (and <canvas> and WebGL don't really help here—because it's hard to ensure data gets correctly passed to accessibility layers), but I think that the majority of mobile apps are simple enough for it to not be a concern.

<comment><USER10> I haven't done profiling of firefox os on a crappy device...

but my suspicion is that it really is as simple as: even really-well-optimized html/css/js that needs to go through a browser core will suffer performance- wise compared to something with 10-15 less layers of indirection. (Like a traditional windowing toolkit.)

The Android UI toolkit isn't exactly efficent (ha!), but still seems to beat Firefox OS on super-low-end hardware judging from the reviews I have seen.

The internal windowing toolkit and java-like mini language with a VM that we made for Opera Mini 5/Opera Mobile 10 with both J2ME and C VM implementations was like 3x faster than the Android UI toolkit with Dalvik for typical windowing tasks. Without any super-fancy optimizations...

<comment><USER12> The indirection is a problem with existing browser implementations (and some spec issues, such as lack of Typed CSSOM, which is the current subject of work in the WGs). There is no fundamental reason that I can see as to why there needs to be a gap between the hardware and the graphics and layout of Web apps.

<comment><USER10> That sounds intriguing. But.. how?

<comment><USER12> Look at Servo and WebRender (disclaimer: I work on both), or just read "Fast and Parallel Webpage Layout", Meyerovich 2010 for much of it :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> It was interesting to follow this experiment but have to admit it was against the odds since day 1 (and it's especially easy to say so in retrospective).

In terms of regular users, there are tons of dirt cheap chinese no-name android devices that more or less work. For 100 euros, you can get an acceptable Android phone from a major manufacturer (LG, etc). FirefoxOS was competing in a similar price range, however offered much less to the end user. I guess it's fair to say that it didn't deliver any extra value.

When I was using FirefoxOS and poking around the code base, I saw potential in their web-first platform as an introduction to programming. It's much easier to write some basic HTML, CSS and JS than to figure how to do the equivalent in Java for Android, etc.

However, things like ionic or phonegap and reasonably good, and it's hard to compete with them as they produce something fairly acceptable and available to run on the vast majority of the smartphones.

At the end of the day, I really appreciate Mozilla's work on this project. Thanks to all the volunteers who contributed to the project. You are amazing people :)

<comment><USER13> Agreed, my favorite thing about Firefox OS was always the "blank-slate" approach to writing apps for it, based on web technologies. Of course, that was good and bad - there was more room for experimentation, but you had to do more work to get the widgets and smooth animation that come for free from iPhone/Android SDK.

</comment></comment><comment><USER14> A few days ago, it looked like they were ditching Thunderbird so they could concentrate on their phone products. What's left besides Firefox?

\- "WebMaker", whatever that does.

\- Rust.

\- The $60 Mozilla hoodie.

\- Their world tour of meetups.[1]

\- The really fancy headquarters overlooking SF bay.

A tight focus on Firefox might be a win. I'm looking forward to an all-Rust browser.

[1] [https://www.mozilla.org/en- US/contribute/events/](https://www.mozilla.org/en-US/contribute/events/)

<comment><USER15> Besides the HQ, what else is left is a $1 million/year Chair (up from $801k the year before), a Director on $874k (up from $779k) and a Treasurer on $908k (up from $613k) [0] [1]

I __do not __begrudge high their salaries in the slightest, but I can 't help but think bringing on folks with half the salary of the above employees would buy enough coders to do more innovation, which they really need. The Technical Lead in 2013 got $179,000 (the job is not listed in the financials in 2014).

The those three top job cost the equivalent of 20% of the Foundations revenue in the 2014 year ($13.5 million, more or less evenly split between donations and "program service revenue").

[0] Year end 2013 Financials: [https://static.mozilla.com/moco/en- US/pdf/2013_Mozilla_Found...](https://static.mozilla.com/moco/en- US/pdf/2013_Mozilla_Foundation_Fed_990_Public_Disclosure.pdf)

[1] Year end 2014 Financials: [https://static.mozilla.com/moco/en- US/pdf/2014_Mozilla_Found...](https://static.mozilla.com/moco/en- US/pdf/2014_Mozilla_Foundation_Fed_990_Public_Disclosure.pdf)

Edit: revised 2014 figures higher as I was not looking at total compensation.

<comment><USER16> The foundation doesn't do any engineering work on Firefox. Paid coding is funded from the 300 million or so dollars a year the Mozilla corporation makes in search revenue.

[http://www.computerworld.com/article/3009646/search/mozilla-...](http://www.computerworld.com/article/3009646/search/mozilla- revenue-climbs-5-in-final-year-of-google-search-deal.html)

</comment></comment></comment><comment><USER17> So it seems like Firefox OS itself will continue to be iterated upon, it's just that Mozilla will no longer try to use it as a means to create a third commercial way as opposed to iOS/Android: [http://firefoxoscentral.com/2015/12/firefox-os-is-dead- firef...](http://firefoxoscentral.com/2015/12/firefox-os-is-dead-firefox-os- is-alive/)

</comment><comment><USER18> Remember, the point of Firefox OS was not to challenge or take over the market with Firefox OS devices. It was to develop web APIs for phone things, like the dialer, video, voice, accelerometer, etc. And they succeeded! That's why the statement says "We are proud of the benefits Firefox OS added to the Web platform". Other browsers adopted the tech, and all phone browsers are better off for the project. That's a win.

<comment><USER10> That sounds like a post-rationalization to me. All I heard was that this was how they expected to survive without Google. It was expected to bring a lot of revenue.

<comment><USER19> Source?

<comment><USER20> You can read the original announcement with the list of goals here: [https://groups.google.com/forum/#!searchin/mozilla.dev.platf...](https://groups.google.com/forum/#!searchin/mozilla.dev.platform/Booting$20to$20the$20Web/mozilla.dev.platform/dmip1GpD5II/CzJSSUMq5HsJ)

there used to be a website - arewemobileyet.com which listed the API's that we identified as necessary to make FxOS possible.

You can find it in web.archive - [http://web.archive.org/web/20140401194921/http://arewemobile...](http://web.archive.org/web/20140401194921/http://arewemobileyet.com/#)

We successfully standardized most of them! :)

<comment><USER10> Those were the publicly announced goals. You must be really naive if you think those were the actual goals.

<comment><USER20> Those were the actual goals.

Next time you want to spread theories and rumors, check background of who you are questioning ;)

Source: I work at Mozilla and on Firefox OS project.

<comment><USER10> I got that. I am just questioning whether you and the executive management at Mozilla had the same goals.

<comment><USER20> I'm pretty sure about it. Please, remember that B2G for quite a while was a "homemade style" experiment started by Andreas.

It took Mozilla quite a while before executive team started considering it and investing in it.

The post I linked sums up the vibe from the very beginning. I believe that there was time when the goals have shifted to aim at producing a real product and gaining market share etc., but the original goals are stated in the post and I believe we are very successful in accomplishing them.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Mozilla is shifting to use their web platform for connected devices and IoT efforts. The IoT space is a mess right now and I think that Mozilla could do a lot of good there.

I think that Firefox OS as a phone operating system will always be available for hackers to port and install on their own devices.

<comment><USER21> "The IoT space is a mess right now"

But is also almost entirely vapour.

Seeing this news gave me relief that Mozilla might be pulling their heads out of the clouds chasing fantastical dreams of mobile platforms, but if anything IoT is worse!

<comment><USER22> >almost entirely vapour

I work for an M2M company whose been around for 25 years now, in some form or another. M2M is the backbone of IoT and while it isn't as glamorous, it's a large space. Industrial gases, especially helium, are very lucrative right now.

<comment><USER23> M2M makes sense. It's great for devices that are not classically connected via the Internet to communicate with each other. It's very helpful in the industrial and medical fields.

However, IoT devices should not be consumer-facing tech. IoT devices are on average far more expensive and have shoddy software/firmware. Even when the software is fixed, IoT will remain a niche range of products until their quality surpasses that of the traditional version of the product. From a business perspective, anything IoT hardly makes sense as a standalone product.

M2M is a fantastic field. But IoT is not.

</comment></comment></comment></comment><comment><USER24> tldr; sad but ultimately no problem, it's just up to the open source community to maintain b2g (boot2gecko) now. It's already a more-than-functional platform, excited to take part in porting it and maintaining it from here on out, because I'll still be using it.

As a person that runs FirefoxOS on my main phone (LG Nexus 5 running FFOS v2.5), this sucks to hear. I used to own a Flame which was the developer reference phone and basically the best ffos phone you could buy except the fx0 which is for sale only with contract in japan (or very very expensively otherwise), and it was pretty good phone, and got better with every update.

However, as far as FirefoxOS (aka b2g/boot2gecko) itself goes, it's open source, so it's got a life of it's own (though it may be significantly less contributed to from now on) -- and I'm totally OK with that. I will continue to run FirefoxOS because it still does the things it should (makes calls, text messages, use apps) -- and can be (relatively) easily ported to existing phones (some flagships).

Sad day, but also kind of fine, because they did what they set out to do, and I'm running this OS on my phone, and it's verifiably not garbage (I think it's great). Looking forward to a leaner, meaner, faster Firefox on my desktop -- I'll be getting my hands dirty with FFOS on my phone in the meantime.

</comment><comment><USER17> Guess it's up to Canonical to make Ubuntu Touch a viable open source smartphone OS - are there even devices running it that are being sold in the U.S.?

Did not expect that Sailfish OS would outlive Firefox OS.

<comment><USER25> If you want an open source smartphone OS, why not just use Android (AOSP)?

<comment><USER26> Because the apps ecosystem is getting more and more locked into Play Services, which are not part of AOSP.

<comment><USER25> And how is the app ecosystem on other open source mobile operating systems?

<comment><USER26> The internet is pretty fine, except for a prevalence of webkit only sites on mobile.

<comment><USER25> Do you really think so? What are some of the best internet apps?

I think a native app will always give a better experience because they can always just contain a browser view (it's basically a superset). Plus native code will always be more efficient and in mobile, that matters.

<comment><USER26> A native app is already lost at the start because it requires the user to install it. Also at least on Android I don't buy the efficiency argument at all, Java and JavaScript are both JITed. You think Java JITs better than asm.js?

The integration argument is decent, but it's only really relevant for apps that get a lot of use, not the long tail of stuff that you use once or twice.

<comment><USER25> > A native app is already lost at the start because it requires the user to > install it

The _billions_ of installed apps indicates that the friction isn't significant.

> I don't buy the efficiency argument at all, Java and JavaScript are both > JITed

That's how everything worked back in the Gingerbread days. Android's ART system compiles applications to native code when they are installed. You can also install actual native code with Android's NDK.

If you like the idea of asm.js, then you should check out Go on Android. It does the same thing - offers a restricted set of the language that runs very fast.

There's definitely a subset of apps that work very well in a browser. But you can do more, faster, with lower power consumption with native apps.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Linux as a platform took off because it was possible for a smart user to install it on hardware they already had.

If there had of been a way to install Firefox OS on an iPhone or Android phone, I would have certainly tried it out. Mozilla really needed to target power users, but it was just too hard to get hold of the hardware - <USER2> hardware availability and the stupid state of carrier contracts are to blame here.

I don't know that Mozilla's business model works if they are not bundling their software to a licensed phone, but it's a shame that the mobile platforms can't be opened up the same way desktops are.

<comment><USER28> Yup. That was one thing I was really hoping Ubuntu Touch would give me a chance with, their whole "install on Android" thing. But it's supported on a pittance of device options.

Currently mobile hardware is in a space where the OS has to be custom built for the hardware choices of that particular phone manufacturer, unlike PCs which have a robust system of drivers you have some manner of control over as a user. Seems to be the biggest limitation.

</comment></comment><comment><USER29> I love the work of Mozilla in the browser space, Thunderbird, Rust and online freedom.

Having web pages as native apps goes back to Web Widgets on Series 60 phones, followed by WebOS.

On the Series 60, almost everyone favoured native Symbian and J2ME apps to web widgets.

WebOS sadly failed to gain major traction.

Windows Phone and Android devices can be obtained by fairly low prices and have the advantage of native apps, Webviews besides the browser. On Windows Phone the WinRT is exposed to packaged web apps.

So although I respect their efforts, I never really understood the effort, given that they were under the same OEM constraints as Android and the reviews of the available devices weren't that great.

</comment><comment><USER30> So the headline is fairly misleading, Firefox OS is not cancelled and development will not be stopped. The strategy of trying to push distribution via carriers has not worked so we will no longer be doing that. The "Firefox OS" team was renamed to "Connected Devices" to reflect the fact we are not only building a smartphone, TV's are already being sold and other factors (iot / wearables etc) are being looked into.

</comment><comment><USER31> Is anyone actually surprised by this announcement? It feels like Mozilla tries a lot of things, but rarely gets traction on any of them.

Mean while, Firefox isn't getting that much better and seems to be loosing marketshare.

What's the long-term plan?

<comment><USER32> Shovel more crap like Pocket and Hello into their flagship product and pray that something sticks?

Agreed, it seems like they're rapidly running out of options. It's getting a little concerning.

</comment></comment><comment><USER33> Good. I can't remember anyone other than Mozilla actually being excited about Firefox OS. It seemed like a massive sinkhole on the company's part that drew resources away from the development of the browser.

<comment><USER34> Every Firefox OS article on HN seems to have gotten 50 comments from excited people. These are apparently the 50 phones they sold worldwide.

<comment><USER20> I wish we got that percentage of satisfied users ;)

</comment></comment></comment><comment><USER35> Something that has been on my mind.. A lot of commenters keep saying there are two good options out there, but really the choice is more "iPhone. Yes or No?". If you don't want an iPhone you are going to end up with an Android device. I can't put iOS on my nexus 5.

There is a space there for another OS that you can put on your non-iphone. I just don't think that's Mozilla's space to fill. Really, in all practicality, this is a space Microsoft needs to fill. It's almost like the world is waiting for them to step it up. Their new open source strategy is going to produce some big plays along these lines; .net in particular. Think about the native and multi-arch work being done for it.. ARM for Windows10 and .net; where is it all going you think?

I can tell you that if I could load up Windows10 on my nexus5 even if just for a test drive I certainly would.

</comment><comment><USER36> I always wondered why they didn't try a tablet first. Like the Chromebooks, but in tablet form, heavy on Firefox branding. Maybe this too is something that would've been an 'also-ran' or market failure, but I still want one even as I type this.

<comment><USER23> What would that solve that a Chromebook wouldn't?

Chromebooks already run Linux when so coerced, and are the most bulletproof computing platform for education and business. What could be special about the FirefoxBook?

Perhaps, instead of expending that much effort to engineer a new tablet entirely from scratch, find an Android tablet and put a Mozilla sticker on it.

<comment><USER36> Literally nothing except a different form factor. FWIW, I wish there were Chrometablets too. The Pixel C is headed this way in form, but unfortunately toward Android and native apps instead of ChromeOS and the Web.

<comment><USER37> > The Pixel C is headed this way in form, but unfortunately toward Android and > native apps instead of ChromeOS and the Web.

The web -- though not Google's non-standard Chrome apps through the browser, as yet -- works quite well on Android.

<comment><USER36> Indeed. I use Android devices and think the market is headed toward native vs. the web too, I just hope it's not zero sum. ChromeOS is arguably less functional than Android, but there are use cases for it, and its stripped- down, web-only nature, in many respects is a feature, not a bug. I also really don't like commercial app stores. Discovery is terrible and then who wants to try a couple different versions of an app, before finding the best in class, if not immediately obvious? At least with web apps discovery is easier and switching costs much lower. Native apps also feel less configurable, less extensible, silo'ed off, and don't offer the freedom software provides for on a desktop anyway. I know this all may change in the future - I'm hopeful it does!

</comment></comment></comment></comment></comment><comment><USER38> > "We are proud of the benefits Firefox OS added to the Web platform and will > continue to experiment with the user experience across connected devices. We > will build everything we do as a genuine open source project, focused on > user experience first and build tools to enable the ecosystem to grow.

This doesn't necessarily mean that Firefox OS is over. It means that it's over on the phone but it might move to those "connected devices". I bet Mozilla will release a more precise statement soon.

</comment><comment><USER39> What is the future of Mozilla and of open platforms?

1) Without FirefoxOS, what is Mozilla's future on mobile devices? The Firefox browser, while I think it's great, has very low adoption on mobiles. I'm not sure content-blockers are enough, and they now need the platform owner's cooperation to get their product in front of users (i.e., to get into the app store and to be compatible with the user systems).

2) Without a future on mobile devices, what is Mozilla's future? How influential can they be while playing no role on the most popular Internet platform?

3) Without a player on mobile devices, what is the future of open platforms in general? On the desktop there are several mature operating systems and ecosystems but what is there on mobile? Can open platforms be relevant without a presence on mobile? Where are the BSDs for mobile? GNU tools? Vim?

There are Android forks, but they depend on the continued generosity of the market leader (to release AOSP, a version of Android designed for that purpose). And having looked around for a good option, I can report that the various forks are unambitious, provide little to differentiate themselves from Android, and their organization and support don't inspire confidence.

</comment><comment><USER40> I bought one of the Fx0 phones last month.

Sad to hear this news. I wanted to move away from Android and iOS, and saw FFOS as the only viable option.

They should've mass produced whatever the developer phone was, the Flame I think? Sell it to consumers as a flagship, supported by Mozilla devs, and community devs...

</comment><comment><USER41> I'm saddened by this because I am not a fan of the current state in mobile where everything is an app. I liked their idea of having 'apps' be about the open web. Sure, native apps can be great but I don't want to be locked in to anyone's proprietary platform.

</comment><comment><USER42> Looks like Smart Feature Phones won't materialize :( [https://youtu.be/JIiIjjIsuzc](https://youtu.be/JIiIjjIsuzc)

Though they aren't quite saying that, I guess there'll be no new Firefox OS Smart TV's, too? [http://www.techradar.com/news/television/6-best-smart-tv- pla...](http://www.techradar.com/news/television/6-best-smart-tv-platforms-in- the-world-today-1120795/2)

</comment><comment><USER43> Hate to say it, but good. Firefox OS was going in a backwards direction. The UI was designed for low-res screens, and it ran mostly on hardware barely better than the iPhone 1, except with JS.

Something like this could have been the future if Webassembly was ready for prime time - you could have 'native' apps all running on top on Firefox, on top of the Android/CM base.

Anyhow, hopefully Mozilla refocuses their efforts on Firefox, Rust and Webassembly, and regain relevance.

</comment><comment><USER44> That's too bad but like everyone else said pretty obvious what the outcome would be.

I wonder what a third player in the mobile OS market would look like and if it's even possible at this point. Microsoft is basically number 3 at this point, right? Yet they have so little market share that companies are activity leaving their marketplace.

I wonder if the next mobile OS isn't an OS that requires apps to survive but, instead, offers a crazy amount of integration experiences. For instance if someone came up with a way to unify how to call a car then integrate that directly into the phone (so ultimately it wouldn't matter if it was Uber, Lyft or even yellow cab).

Maybe not the best example but I'm getting the feeling creating a phone that needs apps to be highly functional is simply not possible at this time and another angle is needed to break in.

<comment><USER45> Ubuntu Phone looks interesting and has great potential with the conergence

<comment><USER46> It will be good to know how resource hungry Ubuntu Touch OS is. That's one problem with Android. It requires a Hexa Core processor and 3GB RAM for super smooth performance. Almost all flagship Android devices have heating issues and they seem to need much bigger batteries than iOS devices.

</comment></comment></comment><comment><USER47> Thunderbird: stopped.

FirefoxOS: stopped.

Rust: as nice as the language is, I can see it become irrelevant in the rise of Swift (and tons of developers already using and praising it).

so the last thing that remains is the very core of mozilla: firefox. But then version 42 hit me, disabled the support for custom themes, leaving me alone with a crappy UI I can't stand any longer to the point I uninstalled Firefox forever.

As others have already mentioned: from several sessions of customer development out in the streets, I can confirm that privacy is something that no-one has really interest in, let alone pay a penny for it nowadays.

I'd love to know what Mozilla's vision of the future is, given that the points above are real and Firefox itself becomes more and more an awful "me too!" of other, better browsers.

<comment><USER12> > Rust: as nice as the language is, I can see it become irrelevant in the rise > of Swift (and tons of developers already using and praising it).

How are Rust and Swift in the same language niche at all?

</comment></comment><comment><USER48> I was waiting for a Firefox OS phone with great hardware, but that didn't seem to materialize (AFAIK). Making both high end and low end phones together, perhaps in different volumes, could have helped. Focusing only on the extreme low end with poor hardware was probably a mistake.

While I'm unhappy that Mozilla is not going to focus on Firefox OS smartphones, I do consider this as an experiment that organizations like Mozilla ought to do. I'm sure there were a lot of things accomplished (like some mentioned in the comments for phone APIs) and a lot of things learned. These will in turn help other initiatives.

Now, please put Thunderbird back on the development track with the same priority as Firefox. :) And while you're at it, we want Persona too! :)

</comment><comment><USER49> Hugely disappointing. Actually love my Open C once I upgraded it to FxOS 2.2

Dear Mozilla, I hate IoT devices. I don't want them. They are security exploits incarnate. At least a phone is useful, why the hell do I really need a microwave with an IP address? I don't.

</comment><comment><USER50> I must say I'm not entirely surprised, though part of me wished they had gone through with it, would of been interesting to have more than just 2 options for a phone. I am reminded of PalmOS though for some reason, similar project if I remember correctly.

<comment><USER51> Try Jolla so your dreams can be crushed twice.

<comment><USER17> I wonder if Jolla has a higher chance of survival, because it's niche enough to be focused, rather than chasing after a world market. Sailfish OS might outlive Ubuntu Touch.

<comment><USER52> Jolla is pretty much insolvent at the moment. Does not really look good. [http://techcrunch.com/2015/11/20/jolla-running-out-of- runway...](http://techcrunch.com/2015/11/20/jolla-running-out-of-runway-for- its-android-alternative/)

</comment></comment></comment></comment><comment><USER53> I really wanted them to merge themselves in as an alternate userland mode for cyanogenmod and any other AOSP. I'm not sure if microsoft's investment in cyanogenmod was a response to those kinds of possibilities..

</comment><comment><USER54> I was always waiting for a credible Firefox OS phone in the US; ready to buy immediately on arrival. Nothing ever arrived. The phones were weak by Android phone standards, expensive by low-end Android phone standards, and often didn't support all of the bands of my carrier and so would have had less connectivity in remote locations.

I'm disappointed, though. I looked forward to a more open phone built by an organization I trust. Google is barely OK. Apple is not even that. Microsoft is improving, but still out of the running in terms of openness.

</comment><comment><USER55> That's a shame and awful. Web apps should really be winning this fight against "native". Firefox OS was our greatest warrior. Or wasn't it?

</comment><comment><USER56> They failed because they missed the great opportunity of promoting ad-hoc and mesh applications in their API and security model as first class citizens.

</comment><comment><USER57> I'm surprised this project didn't pivot into something more like ChromeOS. The market there, as proven by Chromebooks. As others have mentioned, Mozilla could have played up the security/privacy aspect of a "Firefox-book".

As a smartphone OS, I don't see what problems Firefox OS solves. Both iOS and Android have great browsers, and can pin webapps to their homescreens.

</comment><comment><USER58> I'm writing from my buggy, crashing ZTE Open C... And this is the final straw: I've had it Mozilla.

It's not me, it's you. You were the symbol of informatics progress in the right direction, but now you're just another pusher of one size fits all crapware. Hope this changes again because we need a good guy in this space.

Now to finally remove the slow, crashing behemoth that has become Firefox...

</comment><comment><USER59> Two days ago when Mozilla discontinues Thunderbird, people cheering "oh yeah, finally they can focus on firefoxOS", the same people are yelling Mozilla should focus on their mission (the browser)?

Not to mention rust, it's adoption is nowhere comparable to Java, see what happened to Sun, I would boldly say Mozilla's mission has completed.

<comment><USER12> > Not to mention rust, it's adoption is nowhere comparable to Java

By that metric, no language produced in the past 10 years has been a success.

<comment><USER60> By that metric, and considering absolute numbers, there's a good chance that no other language ever produced has been a success. :P

</comment></comment></comment><comment><USER61> A federated web payment infrastructure would be the holy grail Mozilla could build a life around.

</comment><comment><USER62> Lots of headlines at HN from Mozilla these days.

Tried Firefox OS emulator and it's fine, but not impressed enough to actually to get a real device.

Yes they better focus on privacy/identity and revamp Thuderbird to make it a unique product.

<comment><USER26> _Lots of headlines at HN from Mozilla these days._

They're having a developer conference so big announcements are concentrated.

<comment><USER63> It's more accurately described as an employee all-hands, with some volunteers invited too. 1200 employees, ~200 volunteers, not really people developing things on Mozilla platforms.

<comment><USER32> Twelve hundred employees???

And they couldn't find one or two of them to port Thunderbird to Qt.

<comment><USER63> I think you seriously underestimate the amount of work that would take.

<comment><USER32> Wow, you think it would take more than a few developer-years?

</comment></comment></comment></comment></comment></comment><comment><USER64> Anyone know the status of the smart feature phone os they were talking about a few months back? I can't find anything on it but am interested in the project.

</comment><comment><USER65> Good riddance. Firefox OS was a technical disaster. It was vulnerable by design as it had no capabilities for updating Gecko. I had hopes for it, and I will happily continue to use my first generation ZTE (70 bucks) FxOS phone, but I am happy they are no longer sold.

Distribution of the OS was a reckless debacle and, from the perspective of a non-technical customer, fraud, if you ask me.

</comment><comment><USER66> Well that sucks.

I desperately want to drop Android and was hoping Firefox OS would continue to mature and improve.

</comment><comment><USER67> It was doomed from the beginning, already such a crowded space. Firefox OS had no chance at all.

</comment><comment><USER68> FFxOS kernel is a fork of android kernal, but optimized to run on small memory footprint (128 MB RAM). Its speed on 128 MB RAM devices is commendable. Javascript is the only and primary development language for FFxOS & we get to access all hardware devices (Bluetooth, wifi, camera, etc ) via Javascript.

</comment><comment><USER69> I never knew Firefox OS existed. Maybe they should've marketed it better?

</comment><comment><USER70> Funny, I just advised for that in a HN thread.

I guess the writing was on the wall of course -- but in case they just heard me and decided to stop it: please guys prioritize a native-UI on all platforms, servo based release for 2016.

</comment><comment><USER71> It's high time Mozilla gets its shit together.

</comment><comment><USER72> Got to ask: what is the point of Mozilla?

<comment><USER73> I'm not sure if you're serious or not. If you are, here's a good place to start: [https://www.mozilla.org/en-US/about/](https://www.mozilla.org/en- US/about/)

<comment><USER72> That's not very useful. I think you mean to link to this:

[https://www.mozilla.org/en- US/about/manifesto/details/](https://www.mozilla.org/en- US/about/manifesto/details/)

I'm going to get voted down by those who don't like dissent or opinions that they fear are "offensive" (and certainly they probably won't participate in the discussion or even attempt to answer the issues I raise!), but here is why I asked the question:

Basically, I just don't see that Mozilla is actually doing anything terribly innovative any more. Certainly anything that seems to support their manifesto is dumped when it seems to get a bit hard. I'm specifically looking at the following:

1\. Persona: Persona specifically fits into "build and enable open-source technologies and communities that support the Manifesto's principles" and also "promote models for creating economic value for the public benefit".

They just didn't support it very well, or for long enough to make an impact. An identity service needs Facebook-like periods to make it work - <USER3> took a LONG time to get to where it was an complete persistence of vision against pretty much overwhelming odds.

Ultimately, that Personna failed was because Mozilla didn't have courage and weren't willing to run with something they truly believe in. IMO, the heads of Mozilla have no real grit and only go for short to medium term goals.

2\. Allowing EME to be implemented in Firefox. EME should only ever have been an extension, and not baked into the core Firefox platform. EME does _not_ fit into point 2 of their manifesto:

      2. The Internet is a global public resource that must remain open and accessible.

Here is an opinionated view of Mozilla initiatives:

* Rust - this is important and long-term. But it handles the underlying development of their browser, and as important as it is, it only goes so far in really making a big impact on promoting an open web

* Personna - abandoned, but this _would_ have been a key way of opening the web. A secure, cross-browser website authentication mechanism which allows a user to use a single username and password (or other authentication method) to log in to multiple sites - I just can't think of a more important initiative.

That this was abandoned shows the sort of short term mentality of those leading Mozilla.

* Mozilla Location Service - interesting idea, but there are privacy concerns - they sell the underlying data to Combain AB, and Combain allow you to search on all sorts of things. I don't see how this helps Mozilla's underlying foundational principles!

* The MDN - now this is truly great, and does satisfy all the points of the manifesto. I hope that Mozilla keep this up!

* Firefox OS - now abandoned, but this was truly something that was needed in a market that is more and more proprietary. Evidently Mozilla have no stomach for keeping a project going for more than 2-3 years; there is no medium or long-term commitment.

So, given that Mozilla largely don't seem to want to do anything that they will commit to in the medium to long term (with a few exceptions, though these are already established) I have to ask: what is the point of Mozilla?

All the things Mozilla now promote (like the ad-blocker in iOS, which their own browser can't even use) seem like things that aren't very ambitious; certainly they won't change the world!

<comment><USER12> > But it handles the underlying development of their browser, and as important > as it is, it only goes so far in really making a big impact on promoting an > open web

Rust's safety features are designed to enhance security of Web browsers, and its parallelism/concurrency features are designed to enhance Web performance. I can't think of many things that are more important to the health of the Web platform than security and performance.

</comment></comment></comment></comment><comment><USER74> Anyone remember the Facebook phone?

</comment><comment><USER75> Sad, but properly to be expected.

</comment><comment><USER76> When did they start?

</comment><comment><USER77> Money well wasted.

</comment><comment><USER78> Could have seen that being a flop from outer space.

</comment><comment><USER79> Finally.

</comment><comment><USER80> I hope they can figure out something to keep them afloat. Mozilla seems directionless lately.

<comment><USER81> Last week it was Yahoo

</comment></comment><comment><USER82> Well, this comes as a huge surprise to no one.</comment>


Show HN: HackerRank's app guarantees an interview call after a coding challenge - <AUTHOR> http://techcrunch.com/2016/01/12/hackerrank-jobs-takes-the-mystery-out-of-technical-recruiting/ <comment><USER3> Are there actual licensed engineering professionals (ie electrical, mechanical) who resort to some made up ranks to separate themselves from the herd and use puzzles to judge the skillset of a potential employee? How does this work in industries other than software? Just genuinely curious here.

<comment><USER4> Putting the most positive spin on this situation as I can, I think the difference between software and other engineering disciplines is in software we are often hiring people to do things that have never been done before. Other disciplines can say, "we need you to design this, have you ever designed this before?" and the engineers can generally say, "yes, and this is how it went." For software the best way we can guess if people will be able to do the thing that they have never done before is to assess their general cleverness and problem solving skills, with puzzles.

Or something like that.

<comment><USER5> Is that true, or is it just that we're unaware of how much innovation exists in other fields?

</comment></comment></comment><comment><USER6> Is "Show HN" an appropriate category for a link to a TechCruch coverage? (Unless you are the creator of TechCrunch... and expect us learn about it from this post.)

<comment><USER7> The rules morph to accommodate the type of project. It's hard to show a mobile app directly, so an article describing the work with a link to the app is ok. In this case, since there's a web version, the Show HN post should probably have linked to that, with a mention of the article in the comments. But it's a bit late to change now so we'll leave it as is.

</comment></comment><comment><USER8> Is it wrong that I have zero interest in a new job, but want to sign up for a ready supply of interesting puzzles?

<comment><USER9> Why not just use normal HackerRank then...?

</comment></comment><comment><USER10> I love the general principle of this and applies to other professions.

I work in finance and accounting and it's rare for someone's technical skills to be evaluated in an interview.

The problem with that is that the profession becomes overrun with people who have zero ability to actually get things done in an efficient manner.

Not everyone need to be a coder, but most professionals do need to know how to leverage machines to automate their workflow and generate deeper insights.

If I were hiring people in my field (finance/accounting) I would love to use something like this to make sure a candidate can accomplish some basic analytic tasks and workflow automation tasks.

</comment><comment><USER11> Looks like Uber and VMware are already using this product. Can anyone from those teams tell us about their experience?

<comment><USER12> My team (at VMware) has used HackerRank to hire. It worked out pretty well. The biggest advantage was being able to vet many candidates quickly. It's definitely improved our hiring process (it used to take us much longer to find a suitable candidate). I think my team was one of the first at our company to use it (and we haven't done much hiring since), so my knowledge about the specifics is a little out-of-date.

</comment></comment><comment><USER9> It would be really nice if something like this existed for internships - <USER2> of the companies listed (like Uber) seem to be extraordinarily hard to get a response from if you don't go to a target school.

<comment><AUTHOR> We have 5 companies already ready to take interns. If you are interested, you can just email me: vivek@

<comment><USER9> I'm down, will do.

</comment></comment></comment><comment><USER13> While I cannot vouch for whether or not this will land you an interview, HackerRank was very useful in preparing for interviews.

Also, the team is great - I signed up a long time ago and had some performance feedback for Vivek. They promptly implemented the change within a day. I haven't used it recently, but at the very least you'll get something out of it if you need practice.

</comment><comment><USER14> Canadian companies too?

</comment><comment><USER15> *guarantees an interview call after a coding challenge

<comment><AUTHOR> Yes, that's correct. Guarantees after clearing the qualification score for a coding challenge.

<comment><USER15> The point is that the omission makes your submission title somewhat misleading.

An app that guarantees an interview _ipso facto_ would be interesting. An app that guarantees an interview after passing a coding challenge is standard fare for most tech job-hiring startups nowadays. (It also doesn't make much sense to offer a coding challenge on a smartphone either)

<comment><AUTHOR> Got it. Will fix the title. However, the "guarantee" part if you pass a coding challenge isn't a standard. For eg: if you would like to apply to Facebook, how would you go about doing it now?

<comment><USER15> Standard for job-hiring startups like Hired and TripleByte, for example, not for the normal interview process. (Although I double checked and TripleByte does not do a programming challenge; they go straight to the interview)

<comment><AUTHOR> It involves a lot of manual work on both hired & triplebyte . For instance in triplebyte, you get interviewed by the triplebyte team AND then proceed for an interview. We are bypassing those steps and getting them connected directly to companies.

</comment></comment></comment></comment></comment></comment><comment><USER16> Sorry, Hacker Rank can't make me guarantee anything.

<comment><USER7> Please stop posting unsubstantive comments to Hacker News.</comment></comment>


The Ice Cream You Are Allowed to Have - <AUTHOR> https://www.theawl.com/2017/12/the-ice-cream-you-are-allowed-to-have <comment><USER2>
      Halo Top, which is now the best-selling ice cream in the country

_only_ in the prepackaged pint category.</comment>


15 Year Old Entrepreneur Launches Teens In Tech - <AUTHOR> http://www.techcrunch.com/2008/08/04/15-year-old-entrepreneur-launches-teens-in-tech/comment-page-2/#comments <comment><USER2> So far that's an online community, not a business. Or at least a site to build a community around. It could be monetized by ads, but could this attract tens of thousands of people to actually make money? I'll wait and see.

Starting a site doesn't make you an entrepreneur. But he has made a lot of important friends that are apparently sold on the IDEA of a 15-yr old entrepreneur, therefore making him one.

His intentions may be in the right place but the technology behind the site is uninspiring.

</comment><comment><USER3> Don't fear the haters, kid. Just do your thing. Most of the people criticizing you are just trying to make themselves feel better about that next game of Mario Cart they're about to play instead of actually, you know, _doing_ anything.

</comment><comment><USER4> To sum up the criticisms I've seen on TechCrunch - the site is down, it's just a Wordpress install, difficult to monetize, inexperienced team, the company's acronym is TIT, etc. With all that said, he learned a valuable lesson. He learned how to deal with the angriest people from one of the most self- critical industries in the world (IT). I'm no therapist, but many of the comments on Slashdot, Reddit, or TechCrunch seem to come straight from a guide to the DSM IV. If he learns how to deal with criticism like that, then he's set for life and I'd bet on his next venture succeeding.

<comment><USER5> agree. though the site doesn't sound impressive, what he's doing is still way better than going to school or figuring out ways to get alcohol

</comment></comment><comment><USER6> Ouch, moving servers or otherwise being completely down when you get TechCrunched, without so much as a "give us your email and we'll tell you when we're back up".

</comment><comment> cypress-hill teenager lights up turnkey message board software, knows scoble. YAWN.

okay i am officially a geezer...here is my two cents: have fun playing webmaster but don't put the calc book down just yet. most of your "contacts" (scoble etc) are legends only in their own minds. by time you get to college, everything about today's web will be obsolete. booting up wordpress is not going to get you far in 2014.

but there may be a gem of widsom here. you might find that eating ramen, getting fat, and running up your (or your folks in your case) credit cards to pay your hosting fees isn't as nearly as glamorous as PG and the YCult make it out to be.

kid you may also be missing a very big boat. webtech is becoming an idiot's game. the larry/sergey of your generation will likely be a chemist or physicist. don't get too charmed by the web "business"

<comment><USER7> Can you back any of that up?

<comment> cypress-hill yeah, its true cuz i say so. are you the guy who trolls around the web asking people to cite everything they say? and yes it is trolling</comment></comment></comment>


Building the optimal user database model for your application (2015) - <AUTHOR> https://www.donedone.com/building-the-optimal-user-database-model-for-your-application/ <comment><AUTHOR> I'm curious what other people's approaches have been to modelling user/account relationships. What tradeoffs have you made? How do you manage permissions?</comment>


Vim/Neovim Arbitrary Code Execution via Modelines - <AUTHOR> https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md <comment><USER2> I feel like security for CLI users is generally falling behind other systems.

On Android and iOS, any application is supposedly running in its own sandbox, where it can't just randomly access files used by the rest of the system (including other applications).

The web is obviously strongly based around a security model where a website ultimately can't do much in terms of information access (eg, a properly designed website's information is protected from other websites) .. as I understand it, this was not always the case (we're not using ActiveX anymore, right?).

In the desktop space, this pattern is supposedly supported by Flatpak, and I think the macOS store (though I'm not sure about this—I haven't actually used either).

Meanwhile, when a random developer decides to run `make` or `npm install` or `mvn install` or even `vim foo.txt`, they're essentially trusting their entire computer to whoever created the content in their working directory.

Will there be some revolution at some point that encourages people to somehow isolate their commandline activities to different realms, thus limiting the scope of any attack like this?

<comment><USER3> > any application is supposedly running in its own sandbox,

But that fails for developers (which is more or less synonymous with "CLI users"). Development is all about data and fine grained tools, not apps.

You check out a file with git, then edit it with vim, and build it with gcc, which pulls in headers generated with a python script, itself having been configured with, I dunno, cmake gadgetry. Where do you draw the boundaries here?

I mean, you can draw a big circle around all your development activities. Products have been invented that do that. They're called "IDE's", and are sort of the metaphorical opposite of the command line tools we're discussing, and not really a solution to the people choosing to use this environment.

Alternatively, you can view the whole development system as a sandbox. Do your work in a separate VM or docker instance, for example. Some people actually do that (in particular folks with windows desktops who need linux tooling will recognize this), and while it's not generally considered a security technique, it certainly could be.

<comment><USER4> I see what you're saying, but I think we can do better.

I would really like some simple way to limit what build scripts can do. For example, they shouldn't be able to read and write arbitrary files in my home directory, even though they should be able to read /usr/lib and the like. They shouldn't be able to contact the Internet (or even the LAN) without explicit permission. They shouldn't be able to do anything with my display unless I permit it.

Is there some command available for Linux that lets me set up a quick sandbox so I can detect and stop trojans in build scripts? Virtual machines, chroots, containers, and Docker are all good but they don't solve this problem. SELinux has the potential to solve this but it's extremely complex. Instead of "./configure && make", I want to type something like "sandbox ./configure && sandbox make"; sandboxed build scripts should work the same as if they're outside the sandbox.

<comment><USER5> What you describe is called Mandatory Access Control, which is in contrast and supplements standard UNIX Discretionary Access Control (user/file permissions). It is implemented on Linux with AppArmor in addition to SELinux.

I would guess the biggest hurdle in using such systems is the complexity and expertise required in drafting the specific rules that should apply in your threat model.

<comment><USER6> If you craft rules for your cmdline tool you will run into problems pretty soon despite the complexity. Better is using a wrapper that is confined. See e.g. SELinux' sandbox(8) which is more or less a "multiwrapper" in that it sets the context explicitly and not implicitly by being confined.

</comment></comment></comment></comment></comment><comment><USER7> Which OS' are compiling `nc` with `-DGAPING_SECURITY_HOLE` ?

<comment><USER7> Jeez, what's with the down votes? Look at the netcat documentation, that's what the configuration option for "-e" is called.

[https://ps.uci.edu/~franklin/doc/netcat.html](https://ps.uci.edu/~franklin/doc/netcat.html) [https://stackoverflow.com/questions/15351646/how-to-re- compi...](https://stackoverflow.com/questions/15351646/how-to-re-compile- netcat-with-options)

<comment><USER8> How is it related to the vim vulnerability?

<comment><USER7> That was the proof-of-concept they used.

</comment></comment></comment></comment><comment><USER9> I have never understood the appeal of modelines. Why on earth would you put editor specific configuration _inline_ with the file you are editing?

Thankfully I've had 'set nomodeline' in my config ever since I found out about this insane option.

<comment><USER10> I use them in Emacs occasionally. It's handy for stuff with ambiguous names. Makefiles (which dialect?), whatever.pl (Perl? Prolog?), whatever.asm/whatever.s (which architecture? Which assembler?), etc.

Also comes in handy for working with files that have an incorrect extension, for whatever reason, or different formatting from all the other files of that type that you work with. (Per-project formatting stuff can often by solved with .dir-locals.el, but not always.)

<comment><USER9> How do others feel about this when they open the files? Or are they not part of a shared project?

<comment><USER10> Nobody seems to care, and I can easily put them back in if somebody deletes them.

</comment></comment></comment></comment><comment><USER11> This should be put into perspective: The default vimrc configuration file disables the modelines option and contains a warning that it is a security risk.

I.e. this likely only affects a small number of users and the devs have done as much as they can about a risky feature: Off by default and whoever changes the option should know about the risks.

Of course it's still a valid vulnerability and it's good that it's been found and fixed. But it's likely not a big deal.

</comment><comment><USER12> I remember reading ~10 years ago that mode-lines were considered to be insecure (you are parsing arbitrary data as configuration options) and have always had them disabled in my .vimrc. I'm surprised they haven't been disabled by default (even in neovim).

EDIT: I probably was reading about CVE-2007-2438, another mode-line based RCE attack.

</comment><comment><USER13> This is a well known problem - thus the "securemodelines" plugin: [https://github.com/ciaranm/securemodelines](https://github.com/ciaranm/securemodelines)

<comment><USER14> Seems so, Ubuntu's defaults (at least in 16.04) set nomodeline with a comment about security vulnerabilities.

</comment></comment><comment><USER15> It's mildly interesting that the neovim patch for this [1] is just an import of the upstream vim patch [2], but with the test removed.

1: [https://github.com/neovim/neovim/commit/4553fc5e](https://github.com/neovim/neovim/commit/4553fc5e) 2: [https://github.com/vim/vim/commit/5357552](https://github.com/vim/vim/commit/5357552)

<comment><USER16> I wonder if it is because neovim's testing is setup differently and they wanted to port the patch immediately rather than spend time which they might not have had at the moment to rewrite the test. I suppose the patch was tested upstream, though you would want the test in neovim to prevent a future regression.

<comment><USER17> A different PR is still open, that presumably would include the test: [https://github.com/neovim/neovim/pull/10052](https://github.com/neovim/neovim/pull/10052)

</comment></comment></comment><comment><USER18> Well crap, now I have yet another reason to lose sleep tonight. I always thought Vim and text-files were safe.

I do find something endlessly interesting in these kinds of vulnerabilities, for no other reason than the fact that I can appreciate the hunt for them. I wouldn't really think to look at Vim as an attack vector, and even if I did, I wouldn't even know where to start.

<comment><USER12> Given that most administrators use vim to edit everything in the system and often open random files, I would think vim is the most obvious thing to attack (just like printers in corporate networks).

Just do "set nomodeline" and move on. I've had it disabled for the past ~10 years because of previous CVEs like this (such as CVE-2007-2438).

<comment><USER19> or use [https://github.com/ciaranm/securemodelines](https://github.com/ciaranm/securemodelines) like I did for the past aeon

</comment></comment></comment><comment><USER20> My system vimrc has:

      set modelines=0

and a comment referencing CVE-2007-2438, which was another sandbox escape via modelines.

Seems prudent.

</comment><comment><USER21> nvi nipped this in the bud from inception:

modelines, modeline [off]

Read the first and last few lines of each file for ex commands.

 _This option will never be implemented._ [0]

[0] [https://netbsd.gw.com/cgi-bin/man- cgi?vi+1.i386+NetBSD-8.0](https://netbsd.gw.com/cgi-bin/man- cgi?vi+1.i386+NetBSD-8.0)

</comment><comment><USER22> In which case would I open a file with vim like that? Or can it be hidden in innocent looking files? I always first cat a file.

And never heard of modeline even though using vim for over 20 years.

<comment><USER23> The second PoC hides the modeline when printed with `cat`.

<comment><USER22> Sorry, missed that one, thanks for pointing out.

</comment></comment></comment><comment><USER24> Very interesting exploit. Makes me feel good that I disable modelines because my company always sets columns=96, however I usually open multiple files with :vsp and I have to manually change the columns to what my terminal actually is.

I would be interested to hear the historical reason for having such generic modeline execution in the first place. It seems a little out of place in text file editing.

<comment><USER9> > Makes me feel good that I disable modelines because my company always sets > columns=96

Your company places this as a modeline in all its source files? If so why does your place of work enforce modelines in its source?

<comment><USER24> They don't "enforce" it, but all the code written by the two largest contributors always has it. Its a startup, so those two contributors wrote the majority of the codebase.

<comment><USER25> You mean they include editor configuration in all of their source code files? Not just some special cases?

<comment><USER24> # vim:set columns=96 expandtab nocindent nosmartindent ff=unix:

This is in basically every source code file just below the shebang.

<comment><USER25> I've never seen anyone do this. There are so many better solutions to this problem and it's a heavy-handed/messy solution that is difficult to change/maintain.

I'd push back on this hard if I was told to do it.

<comment><USER24> I'm not told to do it, but I don't write hardly any of the code in the repo. So when I have to go inspect one of their source files, which I do many times per day, then it gets me. Usually if I'm on some VM that doesn't have my own .vimrc in it. It is what it is, just a minor annoyance and a few key strokes to fix (":set columns=xxx", then "C-w =").

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> Scratching my head a bit but ... isn't this old news (the underlying issue, not the github doc)?

The modelines issue (this exact issue) was widely publicised well over a decade ago (long enough that I don't remember when).

I vaguely recall it showing up in an early gentoo security alert (pre-2005?) which is how I became aware of it.

How does this become a new security issue now?

<comment><USER27> Simple: Modelines come from a time before we understood that ordinary user applications working with ordinary files needed to be engineered securely.

<comment><USER26> I think you missed my question :)

I understand the security concerns (arbitrary code execution just by loading an arbitrary file into vim).

My question was: this issue was caught, diagnosed, widely publicised and the configuration fix for it was widely deployed - nearly 15 (fifteen!) years ago.

So why is it cropping up as a "new" security issue now?

</comment></comment></comment><comment><USER28> I'd like to note here that while the vim versions of OS distros get updated every now and then, Bram does a fantastic job of releasing multiple times per week and vim is easy to compile.

I compile it every week (I use it as my IDE -- term buffers and all).

Just in case someone here is a heavy user and is worried about this.

[https://github.com/vim/vim](https://github.com/vim/vim)

</comment><comment><USER29> No !!! Not my vim

</comment><comment><USER30> I guess we have a winner for Editor Wars.

<comment><USER31> Emacs has similar functionality [https://www.gnu.org/software/emacs/manual/html_node/emacs/Sp...](https://www.gnu.org/software/emacs/manual/html_node/emacs/Specifying- File-Variables.html)

<comment><USER32> The default behavior on Emacs is to warn you that file-local variables can be unsafe and prompt you to execute them. However I developed the habit of mostly ignoring it since they're usually in my own files.

[https://www.gnu.org/software/emacs/manual/html_node/emacs/Sa...](https://www.gnu.org/software/emacs/manual/html_node/emacs/Safe- File-Variables.html)

<comment><USER33> The scary part for me (albeit that I'm an emacs user not really a vim user) here is that the modeline string is hidden from the victim in their vim window, so not only have they enabled the RCE they aren't aware of it. I'm not sure if emacs file-local variables can be exploited in the same way (they probably can but I'm just unaware of it)

</comment></comment></comment></comment><comment><USER34> If you're heartbroken about this, it's only because you were too smug before.

<comment><USER34> Before I go completely grey here, I'll clarify as a decades long user of vim/neovim: no software should be so near and dear to your heart that you get complacent about the risks it poses, most especially security risks.

Heartbreak at this announcement means you were assuming it wasn't a vector for security weaknesses.</comment></comment>


Why Wall Street Gets a Bailout and You Don't - <AUTHOR> https://mattstoller.substack.com/p/the-cantillon-effect-why-wall-street <comment><USER2> I wonder if it was ever considered to pay companies / individuals according to their relative tax rate. So an employee would get 30-40% of the baseline, while international companies using offshore trickery get almost nothing.

Otherwise, like the article says, a large part of US stimulus packages will ultimately end up with foreigners or in Panama or other offshore tax havens. And that wouldn't help the US economy much.

<comment><USER3> This would ensure that among individuals, those who need the stimulus most (people with lower income) would get the least money.

<comment><USER2> Good point, it seems this doesn't work well for people.

For businesses, I also agree that one would be discriminating against small businesses which were already struggling before corona and, hence, have low profits and as such low taxes.

But if your goal is to revitalize the economy in general, focusing on small businesses that used to be successful, e.g. artisan bakery and independent coffee shops, seems like a good way to spread the money around.

</comment></comment></comment><comment><USER4> I never could see a use for cryptocurrency outside of black/greymarket transactions.

Now I can see one: a currency that a central bank can't create more of to bail out someone else's incompetence and greed.

<comment><USER5> Ok, then. I guess you also have a plan to avoid the second great depression? Lots of pain,death and suffering. The higher you climb, the harder you fall. Look at venezuela and imagine astronomically worse.

They should perhaps consider taking criminal action against execs ,create better regulation and permanetly take away equity from these companies but why do people think it's a good idea to let th fail and watch the fire burn as if they won't burn everything you have down with them?

<comment><USER4> Rewards require risks. Take away the downside and you'll find you've also destroyed the upside. This is everywhere in life, not just in economics.

<comment><USER6> Yeah, but the causative link doesn't work the other way. Sometimes you can add more downside and get no more upside. My prediction? This stimulus package won't destroy the upside.

<comment><USER7> This prediction is unverifiable, as you don't know what would have happened in 2, 5, 10 years, if the bailout did not happen.

<comment><USER6> Ah ha, that's fair. But that is just as well a problem with the original assertion. So I suppose I'm happy to listen to the prediction as to which upsides are about to be destroyed and then perhaps pick a position opposite it that's verifiable.

</comment></comment></comment></comment></comment></comment><comment><USER8> This pandemic will amplify the wealth inequality drastically. The poor will lose their jobs and houses, while the mega rich will find a way to tap into those trillion dollar stimulus funds.

I don't understand why Congress wouldn't pass a simpler, $1000 to every person with SSN and address in file + $500/dependent.

It would have been faster to process and get that money out. It would save people from losing their homes and put food on the table. IRS still hasn't started sending those checks out and so many people will still miss out. IRS is the most effective institution that could aid millions of people in a short time.

I just don't get why America is so afraid of being a bit socialist ? Wouldn't this save the people & economy in the long term?

<comment><USER9> Yeah you ought to see how it's being rolled out in Canada.

In Ontario I filled out an incredibly short web form (address, name, child's name, bank account). And in turn they wire $200 per child into my account to buy them learning supplies. There are no financial restrictions. They just want to get the money out. I'm sure I'll pay for it later with all the tax I pay. Still proud of it. Socialism shines during crisis.

<comment><USER10> What does it have to do with socialism?

</comment></comment></comment><comment><USER11> Article is terrible.

First, these are short-term loans, with forgiveness being discussed for small businesses (not for Wall Street).

Second, there _is_ money going out to individuals, so the "you don't" part of the title is BS. [https://www.cnn.com/2020/04/01/politics/stimulus-money- distr...](https://www.cnn.com/2020/04/01/politics/stimulus-money-distribution- individuals/index.html)

Like does this guy even read the news? What is going on?

<comment><USER12> You say the article is terrible but your problems deal just with the title. The article acknowledges the things you say it doesn't.</comment></comment>


Breaking Same Origin Policy (for the alexa top 1m) - <AUTHOR> https://ejj.io/breaking-sop/?hn <comment><USER2> "If you are logged in to a site that does this, it's a huge danger. Your private account information can be slurped down by ajax on any other sites."

This is false (unless `Access-Control-Allow-Credentials` is set). See CORS 101: [https://annevankesteren.nl/2012/12/cors-101](https://annevankesteren.nl/2012/12/cors-101)

<comment><USER3> Seconded. And if you have Access-Control-Allow-Credentials then Access- Control-Allow-Origin must reflect the origin, * is not enough.

It's safe to put Access-Control-Allow-Origin:* on any publicly-accessible server, since another server could simply proxy that stuff anyway.</comment></comment>


Startup News -- Chinese HN clone - <AUTHOR> http://news.dbanotes.net/newest

<comment><USER2> The source code Startup News based is from the Arc language package written several years ago which may contain some serious Bug.

<comment><AUTHOR> How did you tell that?</comment></comment>


Latinamerican applicants to YC? - <AUTHOR>

Are there any other applicants, either accepted or rejected, from Latinamerica out there? We are from Argentina and got rejected and like to find out about other experiences. <comment><USER2> I am participating of the Open-Coffee Club here in Montevideo (<http://upcoming.yahoo.com/group/3668>) and I think it's a good kick off...

I was kidding about replicating YC because it's impossible to do. YC is the YC'people.

But, we could organize a startup weekend like this: [http://www.techcrunch.com/2007/07/07/startupweekend-70-found...](http://www.techcrunch.com/2007/07/07/startupweekend-70-founders- create-company-in-one-weekend/)

What do you think? We can start the company with the required hype all over the continent... I think 70 people is too much... but maybe 20-30?

Drop me a line to leovernazza [at] himalia.net

<comment><AUTHOR> I actually think is not a bad idea to take the concept and try to replicate it. It'll cost far less to do it here and wouldn't be as much competition. The big question is if there are enough of us to give it a try.

You can reach me at rafael_imas[at]yahoo[dot]com

Let's open a group somewhere to follow up on this.

<comment><USER3> I just sent invites to a new google group, its a great idea.

</comment></comment></comment><comment><USER2> Google Group: <http://groups.google.com/group/yc-latinoamerica>

<comment><USER4> I'm from mexico, the google groups idea sounds cool to stay in touch, did you just start that?

Saludos!

<comment><USER3> Yes, like 2 hours ago =)

</comment></comment></comment><comment><USER2> I am from Uruguay, we should try to create a new YC'like in Punta del Este. Could you find one referent in your country to make it happen? I can find some of them here.

I am sure after posting some photos of punta del este girls everyone in California would want to move here with us, including pg :)

<comment><USER3> I would be a great idea for all southamerican founders to know each other personally.

</comment></comment><comment><USER3> Hi imasr, we are from Peru, maybe we can share experiences (En espanol por supuesto) email me at:

german (at) prezentit (dot) com ;)

Update:

Another idea: Lets create Latin American Y-Combinator!

(maybe we can sell it as a reality show)

<comment><USER5> "Combinador I-Griega"? :)

En serio, en el mercado mas grande de latam, hablan portuguesa, no espanol. El problema de las tres idiomas es un poco dificil.

The largest internet market in Latam speaks Portuguese, not Spanish. The problem of the three languages makes things more difficult.

<comment><USER6> Just use English or Spanish. Most hackers learn English the way early 20th- century engineers learned German, because most technical docs are in it. Or use Spanish because Brazileros generally understand it, and most think they can even speak it. :-)

<comment><USER5> :) That works inside the company. At Terespondo we muddled through between engineers in Miami & Sao Paulo.

But with customers you have to go the extra mile to make support for each language (& currency, culture, laws, etc) first-class. Our customers loved that; it was a competitive advantage that helped us go toe-to-toe with Google and Overture in Latam.

<comment><USER6> Oh, I see. I thought you were referring to difficulties for a Latin-American Y Combinator. You're actually talking about difficulties for its startup companies.</comment></comment></comment></comment></comment>


Dwolla now issuing cashbacks - reversing earlier policy - <AUTHOR> http://tradehillblog.com/

<comment><USER2> When they said the system was free of chargebacks, that just meant due to people changing their mind. You still get the rug pulled from under your feet if there's fraud (I assume, stolen bank accounts).

</comment><comment><USER3> This is pretty serious and brings into question all of Dwolla's million- dollar-a-day transaction volume claims. If if it is a million dollars a day-- which I find totally inconceivable having built FaceCash day-by-day for two- plus years--it's clearly not from mobile payments.

Dwolla isn't licensed as a money transmitter anywhere but Iowa to the best of my knowledge. Their management claims that their investors make them exempt, but that's simply not the case. If there were anyway to bring regulatory scrutiny upon oneself, processing a million dollars a day in fraudulent transactions for an unregulated cryptocurrency would be it.

Be careful!</comment>


Using an IDE Hard Drive with a 8051 Board and 82C55 Chip (2005) - <AUTHOR> https://www.pjrc.com/tech/8051/ide/index.html <comment><USER2> Yup, I too wanted to see the offering from US Software, it looks like they have diversified somewhat :)

<comment><USER3> Nowadays, there's elm-chan's FatFs: [http://elm- chan.org/fsw/ff/00index_e.html](http://elm-chan.org/fsw/ff/00index_e.html)

</comment></comment><comment><USER4> I love this guy. I have bought countless Teensy-ies from this website and his stuff is so solid.

<comment><USER5> A true 100x engineer and a really nice guy.

<comment><USER6> I bought a teensy on impulse to mess around with LED strips, and this library he wrote is awesome:

[https://www.pjrc.com/teensy/td_libs_OctoWS2811.html#tech](https://www.pjrc.com/teensy/td_libs_OctoWS2811.html#tech)

It takes care of all the low-level details and offloads almost all of the work onto the DMA controller, leaving the CPU free to service interrupts or run other code. It reduces controlling individual LEDs to something as simple as a putPixel.

</comment></comment></comment><comment> jonah-archive Hah, this takes me back -- I own the 8051 dev board he made and at one point built the original MP3 player design (though I don't think mine ever worked quite right): [https://www.pjrc.com/tech/mp3/old_player.html](https://www.pjrc.com/tech/mp3/old_player.html)

I should dig that up and get it running again.

</comment><comment><USER7> Funnily enough, even then there was likely a more powerful general purpose microcontroller inside the drive.

</comment><comment><USER8> Kind of useless with the present day SATA serial interface. The parallel interface is so simple that you can essentially bit bang it but with for the serial interface you really need a controller due to the strict timing.

<comment><USER9> CompactFlash cards still support PATA so not entirely useless.

</comment></comment><comment><USER10> Other than the link mishap, I would really like to see more DIY guides like this on HN to extend and hack old hardwares that otherwise would have been ending up in junk yard.

</comment><comment><USER11> Somewhat related question:

Is there an easy way to power an IDE drive so that the motor does not eventually spin down?

(I don't care about reading/writing, only spinning)

<comment><USER11> Answering my own question: [https://www.youtube.com/watch?v=UY3BFewPYB8](https://www.youtube.com/watch?v=UY3BFewPYB8)

Last time I had this problem was before youtube :)

</comment></comment><comment><USER12> (2005)

Also, warning:

The link to "US Software" now leads to an adults-only website. I recommend not clicking this link, it has nothing to do with software.

<comment><USER13> Actually, it is (1999):

> This code is an original work by Paul Stoffregen, written in December 1999

The 2005 update just applied minor changes for a new board revision:

> Status: This page is complete, code updated for rev 5 board, January 2005

</comment></comment><comment><USER14> Bullshit. This should be removed from HN. That first link about "US Software" is NSFW to say the least.

<comment><USER15> Really? Have you not been around long enough to witness bitrot and squatting of domain names? There were sixty-eight anchors in that page and one is no longer valid.

I've sent an email to Paul because you're too indignant to be helpful.</comment></comment>


Jupiter's Great Red Spot Likely a Massive Heat Source - <AUTHOR> http://www.nasa.gov/feature/jupiter-s-great-red-spot-likely-a-massive-heat-source <comment><USER2> > _The study, in the July 27 issue of the journal Nature, concludes that the > storm in the Great Red Spot produces two kinds of turbulent energy waves > that collide and heat the upper atmosphere. Gravity waves are much like how > a guitar string moves when plucked, while acoustic waves are compressions of > the air (sound waves). Heating in the upper atmosphere 500 miles (800 > kilometers) above the Great Red Spot is thought to be caused by a > combination of these two wave types "crashing," like ocean waves on a > beach._

I'm surprised that gravity waves from something that small can have an affect on the atmosphere.

(Yes, I know that Jupiter is big, and so is the Spot, but gravity is incredibly weak.)

EDIT: apparently there is a very big difference between "gravity waves" and "gravitational waves"; I withdraw my comment, but leave it for posterity so that others can be enlightened!

<comment><USER3> Gravity waves are the waves forming on top of atmospheric layers, like ripples in a pond.

Gravitational waves are the spacetime waves generated by black hole mergers and the like.

Very different phenomena.

<comment><USER4> Google search seems complicit in this misconception. A search for gravity waves (without quotes) yields only results for gravitational waves. Searching "gravity waves" is only slightly better, yielding the actual meaning as the second definition (and result).

<comment><USER5> [http://www.planetary.org/blogs/guest- blogs/2016/atmospheric-...](http://www.planetary.org/blogs/guest- blogs/2016/atmospheric-waves-awareness.html)

> It's important to clarify that atmospheric or oceanic gravity waves are not > to be confused with gravitational waves, the outward propagating > perturbations in spacetime that are associated with cool physics graphics > and, apparently, any and all Google searches on either subject.

:)

</comment></comment></comment></comment><comment><AUTHOR> Publication in Nature (doi:10.1038/nature18940)

[http://www.nature.com/nature/journal/vaop/ncurrent/full/natu...](http://www.nature.com/nature/journal/vaop/ncurrent/full/nature18940.html)

Article in Scientific American

[http://www.scientificamerican.com/article/jupiter-s-great- re...](http://www.scientificamerican.com/article/jupiter-s-great-red-spot-may- broil-planet-s-atmosphere/)

</comment><comment><USER6> Question re "Massive Heat Source": Is this a case of a very hot, but very thin gas?

For me, a "massive heat source" is something that is pumping out lots of heat energy, not necessarily something that is hot. But the OP speaks of sonic waves heating upper-atmosphere gas ... very thin gas. It doesn't take much energy to heat a very thin gas.

We are into that weird place where a gas can be thousands of degrees hot, but if you were standing in it your flesh would still freeze (after you die of something else).

<comment><USER7> Yes, according to [1] Jupiter's thermosphere has a pressure between 10^-1 and roughly 10^-4 Pascal so we're talking about a very low density. The thermosphere layer is huge though so we're still talking about a tremendous amount of energy.

[1] [https://en.m.wikipedia.org/wiki/Atmosphere_of_Jupiter](https://en.m.wikipedia.org/wiki/Atmosphere_of_Jupiter)

</comment></comment><comment><USER8> The question that immediately jumped into my head after reading this article: what does the Great Red Spot sound like?

<comment><USER9> I'm guessing here, but if it's anything like every other "reconstructed noise from space" I've heard, it's probably a dull roar. Similarly, it's probably loud enough to cause immediate and permanent hearing loss as well.

Now I really want to know too.

<comment><USER10> > Similarly, it's probably loud enough to cause immediate and permanent > hearing loss as well.

As immediate result of death due to body crushing down.</comment></comment></comment>


The Best of Stress - <AUTHOR> http://blog.vaughanstudios.com/the-best-of-stress/

<comment><USER2> Well done.

I can't help but feel that this post was a beginning of a "goodbye".

Having been part of building software network systems that I recognize your problem (and solution) as it fits well with this engineering domain and that you need clear priorities so when a system get stressed, it can handle the workload gracefully. Maybe this is my way of "imagining my problems as a friend's".</comment>


Dawn project or the end of Firefox's Aurora channel - <AUTHOR> http://release.mozilla.org/firefox/release/2017/04/17/Dawn-Project-FAQ.html <comment><USER2> EDIT: seems this thread is dead and discussion happens at [https://news.ycombinator.com/item?id=14131675](https://news.ycombinator.com/item?id=14131675)

> _" We plan to keep [the Aurora population] on a separate "pre-beta" update > channel as compared to the rest of the Beta population. We will use this > pre-beta audience to test and improve the stability and quality of initial > Beta builds until we are ready to push to 100% of beta population. Because > we presented Aurora as a stable product in the past, the beta channel is the > closest in terms of stability and quality."_

Uh, doesn't adding a pre-beta channel defeat the initial purpose of getting rid of the existing pre-beta channel?! If Aurora is a dead weight channel ( _" Aurora was to be the first stabilization channel having a user base 10x the size of Nightly so as to provide additional user feedback. This original intent never materialized."_) and Mozilla's getting rid of it, why not effectively assume the decision to get rid of it and let users migrate to either Beta (by default) or Nightly (for the more adventurous)?</comment>


Show HN: WebGL Fire Simulation - <AUTHOR> http://ghostinthecode.net/2016/08/17/fire.html <comment><USER2> Nothing will ever impress me more than this WebGL fire / explosion effect: [http://glslsandbox.com/e#33550.0](http://glslsandbox.com/e#33550.0)

Warning: may melt your GPU.

<comment><USER3> _Warning: may melt your GPU._

You're not wrong. That put a workstation-class GPU in a water-cooled system up about 20 degrees C within a few seconds. And it was _still_ not fast enough to animate smoothly during the more demanding parts later in the sequence.

Awesome effect, though. :-)

</comment></comment><comment><USER4> Did something similar a few years ago... a port of the classic demo effect to JS/Canvas :) [https://jstsch.com/post/old- skool_fire_demo_effect_in_javasc...](https://jstsch.com/post/old- skool_fire_demo_effect_in_javascriptcanvas)

</comment><comment><USER5> Takes me back to the time of Netscape 2.0 where webpages were not complete without a fire.gif background :)

BTW did a pure CSS3 fire a while ago too: [http://pag.es/fire/test.html](http://pag.es/fire/test.html)

</comment><comment> s-macke If you want to see fire based on real fluid dynamics take a look at Ron Fedkiw's site: [http://physbam.stanford.edu/~fedkiw/](http://physbam.stanford.edu/~fedkiw/)

For example the following video: [http://physbam.stanford.edu/~fedkiw/animations/fireball.avi](http://physbam.stanford.edu/~fedkiw/animations/fireball.avi)

</comment><comment><USER6> Parts of it look way too noisy, like TV static.

<comment><AUTHOR> Yes, the actual burning fuel part is just random noise, which doesn't look very very good. I mention it as a possible imrpovement under "Better looking fuel".

</comment></comment><comment><USER7> I remember doing something similar in x86 assembly back in the 90's. int 10h comes to mind.

<comment><USER8> Oh me too, was fun and surprisingly not difficult. Still remember learning cool tricks from the Hugi demoscene diskmag.

</comment></comment><comment><USER9> Having fun playing with fire:

[https://twitter.com/kruhft/status/766304583924592640](https://twitter.com/kruhft/status/766304583924592640)

</comment><comment><USER10> Looks like Runescape fire.

</comment><comment><USER11> Nice work. Effects like these are a great example of programmers combining theory, art, and creative optimizations.

</comment><comment><USER12> do you have a shadertoy version of this for comparison?

i took this one by ozzy [https://www.shadertoy.com/view/lsSGWw](https://www.shadertoy.com/view/lsSGWw) and tweaked a few things by hand for optimization. saved a few cycles on the code and increased the iterations to 13, which gives a better result.

like this:

#define ITERATIONS 13.0 #define SPEED 10.0 #define DISPLACEMENT 0.05 #define YOFFSET 0.1 #define YSCALE 0.25 #define FLAMETONE vec3(50.0, 5.0, 1.0)

            uniform lowp sampler2D source; // this item
            uniform lowp sampler2D chan0; // random map
            uniform lowp float qt_Opacity; // inherited opacity of this item
            varying highp vec2 qt_TexCoord0;
            uniform highp float    time;           // shader playback time (in seconds)

            float noise( in vec3 x ) // iq noise function
            {
    	        vec3 p = floor(x);
                vec3 f = fract(x);
    	        f = f*f*(3.0-2.0*f);
    	        vec2 uv = (p.xy+vec2(37.0,17.0)*p.z) + f.xy;
    	        vec2 rg = texture2D( chan0, (uv + 0.5)/256.0, -100.0 ).yx;
    	        return mix( rg.x, rg.y, f.z ) * 2.0 - 1.0;
            }

            void main()
            {
    	        vec2 uv = vec2(qt_TexCoord0.s, (1.0 - qt_TexCoord0.t));
    	        float nx = 0.0;
    	        float ny = 0.0;
                float i;

    	        for (i=1.0; i<=ITERATIONS; i = i + 1.0)
    	        {
    		        float ifrac = i/ITERATIONS;
    		        float d = (1.0-ifrac) * DISPLACEMENT;
                    ifrac *= time;
    		        float ii = i*i;
                    float y = uv.y*YSCALE*ii - ifrac * SPEED;
                    float x = uv.x*ii;
    		        nx += noise( vec3(x-ifrac, y, 0.0)) * d * 2.0;
    		        ny += noise( vec3(x+ifrac, y, ifrac/ii)) * d;
    	        }

                uv.x += nx;
                uv.y += ny;

                // a blob shape to distort
    	        float flame = clamp( sin(uv.x*3.1416) - uv.y+YOFFSET, 0.0, 1.0 );
                flame *= flame; // f^2
                float ft = flame*flame; // f^4
                flame *= ft*ft; // f^10

    	        //lowp vec3 col = pow(flame, TIGHTNESS) * FLAMETONE;
    	        lowp vec3 col = flame * FLAMETONE;

                // tonemapping
                col = col / (1.0+col);

                // ~sqrt
                //col = pow(col, vec3(1.0/2.2));
                col = sqrt(col);

                col = clamp(col, 0.0, 1.0);

                lowp vec4 p = texture2D(source, qt_TexCoord0);
                p.xyz = col;
                gl_FragColor = p * qt_Opacity;
            }

<comment><AUTHOR> I can't get your example code to work, but that is a completely different technique, ray marching a volume displaced by a noise function. This gives nice 3D-looking flames, but the movement tends to look like a scrolling noise function. And it's harder to use arbitrary burning shapes, my simulation supports drawing anything and it will burn.

<comment><USER12> Sorry, this version wont just paste back as is in shadertoy. Also it needs a random 256x256 bitmap in channel 0. The effect is the same as ozzy's original, except change ITERATIONS to 13 in his code to see the change (which is only slightly better). The other changes were for performance, which i improved slightly.

</comment></comment></comment><comment><USER13> Is there any way to see the result without WebGL?

</comment><comment><USER14> can i have this for selected text?</comment>


Project West Ford - <AUTHOR> https://en.wikipedia.org/wiki/Project_West_Ford <comment><USER2> You can see the orbit and current position of needle clumps still in space here: [http://stuffin.space/?search=Westford](http://stuffin.space/?search=Westford)

</comment><comment><USER3> The thought of just spraying junk like that in space today is harrowing. The Iridium-Cosmos collision in 2009 still has left some 75% of its debris field in orbit.

<comment><USER4> hey, that's nothing, in the early 1960s they also thought it would be a good idea to nuke space: [https://en.wikipedia.org/wiki/Starfish_Prime](https://en.wikipedia.org/wiki/Starfish_Prime)

<comment><USER5> See Project A119, a top-secret plan developed in 1958 by the United States Air Force to detonate a nuclear bomb on the Moon. It would be a show of force to boost domestic morale in the capabilities of the United States after the Soviet Union took an early lead in the Space Race and was also working on a similar project.

[https://en.wikipedia.org/wiki/Project_A119](https://en.wikipedia.org/wiki/Project_A119)

<comment><USER6> Reminds me of this comedy skit: [https://www.youtube.com/watch?v=Oml4oz5knaI](https://www.youtube.com/watch?v=Oml4oz5knaI)

</comment></comment></comment></comment><comment><USER7> Where can I read more about "bouncing communications off the ionsphere"? I've never heard of this

<comment><USER8> The term would be skywave propagation.

[https://en.wikipedia.org/wiki/Skywave](https://en.wikipedia.org/wiki/Skywave)

Enjoy. It's mind boggling!

Oh, and the related over the horizon radar!

[https://en.wikipedia.org/wiki/Over-the- horizon_radar](https://en.wikipedia.org/wiki/Over-the-horizon_radar)</comment></comment>


Burnout amongst developers: an industry disease? - <AUTHOR> http://jaxenter.com/burnout-amongst-developers-an-industry-disease-118357.html

<comment><USER2> The worst thing about burnout is that it's really hard not to carry into interviews or other discussions about actually finding new work. Especially with all the invasive questions they keep piling on, and on, and on.

It's as if there's just no room to be human -- even though all you want to do is turn a new leaf, put the nightmare of your previous failed working relationship behind you.</comment>