Limiting the power of package installation in Debian - <AUTHOR> https://lwn.net/Articles/770784/ <comment><USER2> I don't get why we would want to allow packages to run any scripts before/after the installation. I get why it's necessary at this point, but the true solution should get away without executing any code.

IMHO, a package should deliver a set of files to certain directories. That's it.

It should not overwrite existing files, that were installed by other packages. It should not change existing files in any way.

It might advise the system to trigger certain reindexing actions (systemd daemon reolad, update man-db, etc.) but doing this should be the duty of the package manager, not the package itself.

AFAIK, nix and Solaris' pkg are pretty close to this ideal.

A big advantage that this has, on top of security, is that:

\- packages can be uninstalled safely and without side-effects

\- package contents can be inspected (pkg contents)

\- corrupted installations can be detected using checksums (pkg fix)

\- package updates/installs can be rolled back using file system snapshots.

<comment><USER3> Running arbitrary code may be needed if you want to upgrade an existing installation in-place. Imagine that you are upgrading to a new major version and want to migrate the existing configuration to a new format.

This need not be an automatic action, though; you might choose to postpone the migration, and offer a separate tool for the user to run.

This prevents any packages from _depending_ on such a package, though: they can no longer be automatically installed, because their dependency cannot, too.

This changes the concept of package management seriously enough.

<comment><USER2> Well, for me this is a question who owns the config file:

* If the package owns the file, and the user is not supposed to make changes to it, then package updates may do whatever to the file on update. It's good practice though, to leave a copy of the old file in /lost+found.

* If the user is allowed to make modification, then the user owns it. The configuration syntax becomes and API and should be treated as such. Breaking changes should be rare, preceded by a deprecation period and announced as major versions. As you say, it's questionable if such updates can/should be automated.

<comment><USER4> What about binary formats like gpg keyrings?

</comment></comment></comment></comment><comment><USER5> I'm having slight trouble understanding the threat vector this is supposed to be protecting against. If you don't trust a package's install script, why would you trust any of the binaries installed by that package?

If you're unsure about bugs in a package's install script, why aren't you equally unsure about bugs in the binaries installed by the package.

In-fact, install scripts are auditable; third party compiled binaries aren't (at least not easily).

I see other advantages in declarative approaches - for example more freedom for debian to change the underlying file system layout, or to give the user some information about what the package is going to change for easier troubleshooting, but I do not see any advantage security-wise.

<comment><USER6> I mostly agree with you, but it is worth noting that most software is installwd by root but run by some "less privileged" user. That said, I still agree with you, as there is no data of value on any computer I own that is only accessible to root: all of the data that matters is in fact accessible to whatever the least privileged user that is using all of the software on that machine happens to be... on my laptop, that's me and on my database server that is my database. So really there is no difference between running software as root and running it as the "less privileged" user.

Like, the idea that I care that Chromium can run software as root is nonsensical: yes, root can modify all of the software not on my computer... to what end? The only thing of value on my computer is in my home directory, owned by me... hell, thanks to a bunch of people who (incorrectly) think they can make their computers safer by running fewer things as root, a ton of executable files are in my home directory thanks to userspace package managers provided by rust and node.js, so you can even modify other software without even having to be root anymore :/. There is simply no security advantage to any of this.

<comment><USER7> There are a still a handful of multi-user linux systems out there. Chromium as non-root cannot read the other users files when you log into some evil site that knows of a backdoor. (Assuming no other root backdoor)

There is one other point: if my OS is sound and my user files are corrupted - well at least I can restore my files from backup without first trying to reinstall my machine. It saves a little effort.

</comment></comment></comment><comment><USER8> Docker is a nice idea. It's one tool, one system, for easily packaging software and running it, in an isolated environment. But Docker includes a lot of crap most people don't need. Do we need an isolated network for our apps? Do we need an isolated cgroup? Do we need to install a complete base image of an OS? Do we need root to run those apps? The answer, for most cases, is no.

Then there's things like Flatpak. They also want to make it easy to package and distribute software. And they see all the features of Docker and go, "Hey, a sandbox! That sounds cool! Let's make it mandatory!" In order to simply distribute software in a compatible way, they include a lot of restrictions they don't need to just distribute and run software.

All you need to distribute a software package is files, and a subsystem that maps files into the user's environment, and links together the files needed to run the software. We can accomplish this with a copy-on-write, overlay filesystem, and some software to download dependent files and lay them out in the right way. It _should_ be incredibly simple, and it _should_ work on any operating system that supports those filesystems. And those filesystems should be simple enough to implement on any operating system!

So what the hell is the deal here? Why has nobody come along and just provided the bare minimum needed to just distribute software ( _edit_ : in a way that also allows it to be run with all its dependencies in one overlay filesystem view)? Why is it always some ass-backwards incompatible crap that is "controversial" ? Why can't we just make something that works for any software?

<comment><USER9> I did. [http://appfs.rkeene.org/](http://appfs.rkeene.org/)

You're welcome.

<comment><USER8> Errr... that's not really what I'm looking for, my last paragraph was a bit inaccurate. But seems cool nonetheless.

<comment><USER9> It's literally what you described in the third paragraph:

> All you need to distribute a software package is files, and a subsystem that > maps files into the user's environment, and links together the files needed > to run the software. We can accomplish this with a copy-on-write, overlay > filesystem, and some software to download dependent files and lay them out > in the right way. It should be incredibly simple, and it should work on any > operating system that supports those filesystems. And those filesystems > should be simple enough to implement on any operating system!

It's literally, and exactly that. I'm not sure how it can be not what you're looking for.

<comment><USER8> Well, first of all, there's almost no documentation. I can see how to install it and run it, but I have no idea how to use it. How am I supposed to package software for it, or with it? How does it work internally? How is it supposed to provide an overlay for an individual application, much less multiple? How does it link dependencies? What's even the package manifest format? I skimmed through the C code and the Tcl code and none of it was readily apparent to me, and I could find no more documentation than a Getting Started guide. The manual is literally just the arguments to the app. I'm not sure how anyone other than the author could figure out how to do what I'm looking to do with it.

Also, you may be missing that I'm looking for Docker-like functionality. That is to say, have, say, 3 trees of files, one built on top of the other. When launching the application, lay the first tree down on an overlay, then the second, then the third, then run the application. By having the third tree link to the first two, I just pick the tree I want to run (the third tree, the one with the app), and it creates the correct overlays with the correct dependencies and runs it. No special paths needed by the application. What I'm asking for could be done with existing packaged software, with no need to change existing packages - the same way Docker does it now.

<comment><USER9> Much of that is documented in the page called "Getting Started": [http://appfs.rkeene.org/web/home/Getting%20Started](http://appfs.rkeene.org/web/home/Getting%20Started)

I'll summarize it here:

1\. To use it to run application: a. Get AppFSd running; then b. Run the application you actually wanted to run 2\. To package an application: a. Create a package manifest b. Run the build script to create a CPIO archive c. Upload that CPIO archive to a webserver d. Run the script to publish the archive 3\. The package manifest format is described in the README ( [http://appfs.rkeene.org/web/doc/trunk/README.md](http://appfs.rkeene.org/web/doc/trunk/README.md) ) -- it's CSV with the format "type,time,extraData,name" where the extraData is depends on the value of "type" for type==file, it's "size,perms,sha1"

If you're looking for something Docker-like then it's different since this is a filesystem based approach which doesn't require any of the containerization techniques used by Docker... which is how this conversation got started. It would also not be available on every platform since not every platform supports the same containerization mechanisms, and for platforms that do they often require escalated privileges.

<comment><USER8> I should have looked up the actual functionality to avoid confusion, my bad. This is what I'm talking about: [https://docs.docker.com/storage/storagedriver/#how-the- overl...](https://docs.docker.com/storage/storagedriver/#how-the- overlay2-driver-works)

The Overlay2 filesystem driver is Linux-native, but you could implement it as a FUSE module. It would provide basically all the functionality I'm looking for, minus the network code. The idea would be to unpack software packages on the filesystem (e.g. chroot environment) and then overlay the directories of the packages needed before running a particular version of an app.

In order to make custom paths transparent to the application, you need some custom system calls that Linux provides, such as mount namespaces, which is essentially a containerization technology - but you don't need to use "containers" per se, just a particular system call. If you don't use mount namespaces, you have to use complicated hacks to make an application's view of the filesystem unique, such as chroot with bind mounts, or an LD_PRELOAD filter, but all that's too hacky for a general solution.

Plan9 had mount namespaces (among other things) decades ago, but good luck getting modern OSes to implement useful features in a standard way

<comment><USER9> Which is why AppFS doesn't rely on that and instead relies on the ability to present a single unified filesystem.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I've used Debian since 1994 and can't recall a single package installation or removal which exhibited any problem this discussion claims to be solving.

<comment><USER11> Packages in the official Debian archives are generally well behaved. Unofficial packages, sometimes less so. There was an incident a couple of months ago where a package (from Microsoft, incidentally) replaced your /bin/sh with bash. Wouldn't it be neat if such an atrocity wasn't possible?

<comment><USER12> "Unofficial packages" aren't really in the set of supported dpkg use cases. They're a hack that fail in the general case because there are various things they can't express because the expression of them comes from the other side of the package relationship (eg. Breaks/Replaces), and official packages don't declare such things for packages outside the Debian archive. Therefore external packages are fundamentally broken, but third parties keep using them because better alternatives haven't existed in the past.

> Wouldn't it be neat if such an atrocity wasn't possible?

An easier way might be to make it difficult for users to install "unofficial packages", but that would be against the philosophy of users having ultimate control over their systems.

Your suggestion puts us in the rather interesting situation that you're requesting a new feature for something that primarily affects third party packages that aren't actually supported in the first place.

</comment></comment></comment><comment><USER13> I'd love it if some more common things that are done in postint scripts could be done in a declarative way, like adding system users.

And then there are things that are declarative in the debian/ dir (like auto-(re)starting the installed services) that end up as generated, procedural code in the postinst script.

When such things can be done in a declarative manner, it's much easier to reason about them programmatically, and maybe you could completely disable postinst scripts for a whole category of packages.

<comment><USER14> When I first learned how Debian (and other) packages were put together I was somewhat surprised. Not just by the security implications but also by the inherent complexity. Even if you're using templates and generators you can gain a lot by moving all of that out of the package and into the package manager/installer. Distribution-level changes, user OS customization and possibly even reduced privileges would become easier to handle. On the package manager side it seems like maintainability would (in the general case) vastly increase.

<comment><USER7> There is a downside though: if you forget something in the declarative tool it cannot be done. Using bash scripts lets a good programmer get what they need done. Using declarative makes it easier to do everything we thought of but some things are accidentally impossible.

I think an escape to bash might always be required, but I think it should be a restrictive thing. That is packages with that flag require a special flag passed to dpkg. Also any packages using bash should automatically get extra reviewers.</comment></comment></comment>


Dallas rapper's sentence doubled to 12 years because of lyrics - <AUTHOR> https://www.dallasnews.com/news/crime/2018/07/18/rapper-nana-gets-12-years-bragging-youtube-facebook-judge-says-evidence-came-mouth <comment><USER2> "Unfortunately, our site is unavailable to European Union visitors while we work with our partners to ensure your data is protected." And I'm not even in the EU (but close to it).</comment>


Fresh idea for about page. Move mouse and enjoy - <AUTHOR> http://userlook.com/about/

<comment><AUTHOR> Don't forget to place mouse over cheese.</comment>


I Would Rather Be A Jazz Programmer - <AUTHOR> http://deadprogrammersociety.blogspot.com/2007/05/i-would-rather-be-jazz-programmer.html

<comment><USER2> This headline would work better if there wasn't actually a software product out there called Jazz (<http://www-306.ibm.com/software/rational/jazz/>).

</comment><comment><USER3> The difference is ... how many jazz musicians do you think say, "I want to be the computer programmer of jazz musicians!"

</comment><comment><USER4> this (<http://c2.com/cgi/wiki?JazzProgrammer>) is waay better. imho ofcourse.

</comment><comment><USER5> "Get cooler with age"

That definitely puts me in the pro-Jazz Programmer camp.</comment>


Cheat Sheets for Developers - <AUTHOR> http://designzum.com/2014/01/17/12-esential-cheat-sheets-for-developers/

<comment><USER2> More of web developer cheatsheet(2008)

</comment><comment><USER3> Those cheat sheets are seriously out of date. Scriptaculous? VBScript / ASP? Um, no.

<comment><USER4> And extremely narrow in scope, being all web centric.

And what's with the who's who of poorly designed technologies? if I had to pick a list of languages and technologies with the most annoying design deficiencies, it would be php, js, mysql, vbscript, asp. Web development still is a stinking pile of languages, but at least classic asp/vbscript and most php is gone, right?

<comment><USER5> PHP isn't even remotely gone. Between one of the largest sites in the world (Facebook) and the most popular blogging platform (Wordpress) not to mention a countless number of little (and not so little) sites, PHP is stronger than ever.

If anything, I expect PHP's arc to look more like JavaScript than Perl.

<comment><USER6> [http://w3techs.com/technologies/overview/programming_languag...](http://w3techs.com/technologies/overview/programming_language/all)

As a .net developer I am pretty happy ASP.net is doing so well. PHP however, is still king.

</comment></comment></comment></comment><comment><USER6> The ASP/VBScript one gave me a laugh. I could have used it 13 years ago.

</comment><comment> vezzy-fnord Is the word "developer" now implicit shorthand for "web developer"?

<comment><USER7> I agree that it should have said web developer, but your sentence construct leaves the impression upon me that you consider Web developers lesser than any other type of developer.

Web or not, they are still developers.

<comment><USER8> And your comment leaves the impression that you have an inferiority complex about being a web developer. I'm pretty sure the GP was just commenting on the narrowness of the topics covered. We web developers aren't the only ones who need cheat sheets! I hope?

</comment></comment></comment><comment><USER9> "The world of the Internet is quite an interesting place to be a part of!"

Too ridiculous; didn't read.

</comment><comment><USER10> I don't code in any of those languages so no good for me.</comment>


Twister – Decentralized p2p microblogging - <AUTHOR> http://twister.net.co/ <comment><USER2> For me, the more interesting applications in this space are not necessarily normal communications, but "next level" anonymous/pseudonymous protocols, which are by default encrypted, highly private and decentralized.

</comment><comment><USER3> I really wish something like this would take off.

Reddit and friends are great, but it's just too easy to game the system/censor if you control the central server.

<comment> vertex-four On the other hand... nobody's really got decentralised spam prevention working, and the only really effective anti-spam systems that I know of rely on hidden data, which implies centralisation.

The only serious ways of dealing with it are pay-per-use, which disproportionately affects certain subsets of the population, or web-of-trust, which nobody's got working for reputation on a grand scale yet.

<comment><USER4> I created [https://hashcash.io/](https://hashcash.io/) to try avoid spam by forcing bots and users to "pay" with CPU cycles.

<comment><USER5> How well does such a solution scale up? You need to keep the requirements low enough that it runs on mobile CPUs, but if it becomes widespread enough, doesn't it make sense for a bot farm to pick up a Bitcoin mining ASIC to grind out the hashes for them?

<comment><USER4> so far it work great. in future issues might arise, but then i can always tweak hashing algo or switch blockchain. So these ASICs, created purposely to crunch hashes for my service will be obsolete the moment i tweak it a bit. So it have to be software...

As for mobile/desktop/etc - I would expect each community to have their own main audience to which site owner can tweak `complexity` parameter. And in V2 work will be happening in background while you browsing site, so when time come to post comment - enough work already will be done. Hope this make some sense :)

</comment></comment></comment></comment></comment><comment><USER6> Before anyone bothers with it, none of the Docker stuff for the project works. I've got a container building the code, but I'm not getting anything from the daemon once it launches.

Here's the repo I'm working now: [https://github.com/kordless/swarm- twister](https://github.com/kordless/swarm-twister)

</comment><comment><USER7> How does it compare to GNU social/StatusNet?

<comment><USER8> StatusNet was federated not P2P, last I checked.

</comment></comment><comment><USER9> it has a lot of competition [https://bitmessage.org/wiki/Main_Page](https://bitmessage.org/wiki/Main_Page) whisper coming from ethereum project [https://github.com/NikolaMandic/Buyan](https://github.com/NikolaMandic/Buyan)

<comment><USER8> Bitmessage is for private conversations. I assume the same is true for Whisper. I think Twister is mainly about _censorship-free_ public conversations (like Twitter, without the censorship part - see Turkey, etc).

<comment><USER10> Bitmessage is also used for decentralized mailing lists, which are known as "chans".[0]

Also, check out bitchirp.org, which is a twitter-like public website that publishes messages sent to the BitChirp chan.

[0][https://bitmessage.org/wiki/Decentralized_Mailing_List](https://bitmessage.org/wiki/Decentralized_Mailing_List)

</comment></comment></comment><comment><USER11> I hope there is some consensus on protocols between all the various similar projects.

</comment><comment><USER12> can't find the link to source code :-|

<comment><USER6> I find it highly likely you put as much time into finding the source as you did writing this comment.

Nevertheless: [https://github.com/miguelfreitas/twister- core](https://github.com/miguelfreitas/twister-core). Also the paper: [http://arxiv.org/pdf/1312.7152v1.pdf](http://arxiv.org/pdf/1312.7152v1.pdf).

</comment></comment><comment><USER13> I've had a similar idea, but using the web for everything, just haven't bothered with it.</comment>


Muhammad Ali has died - <AUTHOR> http://www.nbcnews.com/news/sports/muhammad-ali-greatest-all-time-dead-74-n584776 <comment><USER2> He is a man who have a heart that bigger than his fists. "Why should they ask me to put on a uniform and go 10,000 miles from home and drop bombs and bullets on Brown people in Vietnam while so-called Negro people in Louisville are treated like dogs and denied simple human rights? No I'm not going 10,000 miles from home to help murder and burn another poor nation simply to continue the domination of white slave masters of the darker people the world over. This is the day when such evils must come to an end. I have been warned that to take such a stand would cost me millions of dollars. But I have said it once and I will say it again. The real enemy of my people is here. I will not disgrace my religion, my people or myself by becoming a tool to enslave those who are fighting for their own justice, freedom and equality. If I thought the war was going to bring freedom and equality to 22 million of my people they wouldn't have to draft me, I'd join tomorrow. I have nothing to lose by standing up for my beliefs. So I'll go to jail, so what? We've been in jail for 400 years."

<comment><USER3> Well he also said that Jews are devils, the mixing of the races is an abomination and that homosexuality is a white man's disease.

<comment><USER4> Do you have aa citation?

<comment><USER5> It's widely known: [https://www.youtube.com/watch?v=uJu8sVWQ- wk](https://www.youtube.com/watch?v=uJu8sVWQ-wk)

<comment><USER4> The full quote refers to all whites. I agree it is inappropriate by today's standards, but a black man saying whites are the devil in 1969? I mean...

<comment><USER6> Ali's friend, Malcolm X, hardly an "Uncle Tom" \- as Ali disgracefully called another friend he betrayed, Joe Frazier - had turned away from the anti-white racism of the NOI by the early 60s (and been killed by the NOI as a result), so what's so special about 1969 that excuses a supposedly intelligent man continuing to mindlessly parrot their inane racist beliefs?

<comment><USER7> He had been treated poorly by whites his entire life. I'm sure you can appreciate how that would affect a person. He was also very young and became more tempered as he grew older.

<comment><USER8> I'm sure you can appreciate that you know absolutely nothing about how Muhammed Ali was treated by whites his entire life.

Simply assuming that he was treated badly and therefore justified in his blanket discrimination towards others is academically lazy and ethically unacceptable.

<comment><USER7> >Simply assuming

I'm not assuming anything; has life has been documented time and time again. We information from him personally, those who knew him, and we know exactly what Louisville Kentucky was like during his lifetime. Are you saying that unless I was there _personally_ I know "absolutely nothing" about his life? Get real and get over yourself.

Ali was my favorite sports figure as a child and remains so. I have consumed everything I can find about the guy. I'm willing to bet I know more than you on the matter, but if I don't, why don't you share some of your insights with us as well as the rest of the world?

>academically lazy and ethically unacceptable

Yeesh. I'm not sure what 'academic and ethical' standards you believe people on a forum should be held to, but again; get over yourself. I'm sure you think you're being extremely clever and deep with your comments here, but in reality you're adding absolutely nothing to the conversation with your overly pedantic comments which show nothing but your ignorance of history.

I also find it pretty hilarious that you seem to have created a throwaway account purely to comment in this thread.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> To me, this is why he will always be "The Greatest." Not his feet or his fists or his showmanship, but his humanity:

      Zawadzki picked Ali up at Pearson International and they were on their way
      downtown when Ali asked Zawadzki, the son of Polish immigrants, about his
      family. The Etobicoke native mentioned to the former three-time world
      heavyweight champion of the world that his mom Wanda had spent years in a slave
      labour camp during the Second World War.

      "Suddenly, he said he wanted to meet her," said Zawadzki. "So even though we
      were already halfway downtown, we turned around. When we walked into our condo,
      Muhammad walked up to my mom, gave her a big hug, and the two of them sat
      together, and talked and hugged for a good 45 minutes. She told him all about
      her experiences in the camp."

_"When you walked away from Muhammad Ali, you were a better human."_ —Ed Zawadzki

[http://news.nationalpost.com/sports/toronto-author-ed- zawadz...](http://news.nationalpost.com/sports/toronto-author-ed-zawadzki- recounts-how-gracious-muhammad-ali-was-attending-chuvalo-tribute)

</comment><comment><USER10> "During my more than 50 years in the public eye, I have met hundreds of renowned celebrities, artists, athletes, and world leaders. But only a handful embodied the self-sacrificing and heroic qualities that defined my friend and mentor, Muhammad Ali. A master of self-promotion, he declared early in his boxing career, I am the greatest! This kind of boasting enraged many people, just as he'd hoped, ensuring a large audience that just wanted to see this upstart boy taught a lesson. But it was Muhammad who taught the lesson because, as he once said, It's not bragging if you can back it up. And back it up, he did. Again and again. And not just in the ring. Part of Muhammad's greatness was his ability to be different things to different people. To sports fans he was an unparalleled champion of the world, faster and smarter than any heavyweight before. To athletes, he was a model of physical perfection and shrewd business acumen. To the anti-establishment youth of the 1960s, he was a defiant voice against the Vietnam War and the draft. To the Muslim community, he was a pious pioneer testing America's purported religious tolerance. To the African-American community, he was a black man who faced overwhelming bigotry the way he faced every opponent in the ring: fearlessly. At a time when blacks who spoke up about injustice were labeled uppity and often arrested under one pretext or another, Muhammad willingly sacrificed the best years of his career to stand tall and fight for what he believed was right. In doing so, he made all Americans, black and white, stand taller. I may be 7'2" but I never felt taller than when standing in his shadow.

Today we bow our heads at the loss of a man who did so much for America. Tomorrow we will raise our heads again remembering that his bravery, his outspokenness, and his sacrifice for the sake of his community and country lives on in the best part of each of us."

Kareem Abdul-Jabbar

</comment><comment><USER11> After reading the NYT's obit for him, all I can think of is, wow, what a full life and long journey. Being born after his competitive career, all I mostly hear about is how he was "The Greatest", but not so much about his losses and his comebacks.

[http://www.nytimes.com/2016/06/04/sports/muhammad-ali- dies.h...](http://www.nytimes.com/2016/06/04/sports/muhammad-ali-dies.html)

<comment><USER12> Here's one of my favorite sport highlight videos. [https://youtu.be/072IsGDEpTc](https://youtu.be/072IsGDEpTc)

His speed, footwork, and power is just incredible.

<comment><USER11> Damn...whenever I watch boxing movies like Rocky, I always think the action and power look so fake compared to what you normally see when watching broadcast boxing fights. But I guess if you grew up watching videos of Ali, you'd have a higher expectation of razzle-dazzle.

<comment><USER13> I wonder if is now ingrained in boxing training to move like that -- no one notices a big difference like they did with Ali because everyone is trained to move like that. Looking back through the videos I have to think that none of the heavyweight boxers move like that today. I wonder if there will be a renaissance in boxing where you have a whole generation of boxers moving like Ali. Does anyone follow boxing? Can anyone comment on how Ali influenced the state of boxing generations later?

<comment><USER14> Sadly, boxing as a sport has much declined since Ali's day, and especially in recent years. In particular, the heavyweight division has been found most acutely lacking for some time.

However, you are correct that heavyweights don't and have not typically "moved like that". Even those who were relatively fast and defensively gifted (e.g. a young Tyson) didn't move as poetically.

He moved like a boxer of a much lower weight class and, beyond even that, he moved like Ali. Graceful. Fluid. Quick. Rhythmic. Instinctive. Check out some of his highlights on YouTube. There are entire sequences during which he defied opponents to hit him through head/upper body movement alone. Hands are low and movement is so fast and well-timed that it seems to predict his opponent's next move. It's as if he is training his opponent to punch wherever he moves his head, and his opponent is reacting to him vs. the other way around.

And, this is to say nothing of his footwork. He glided without effort and the mechansim by which he changed direction was almost imperceptible. It seemed that he was being guided on a wire versus using his legs. Back then, it was amazing to see a man his size (or any) move like that, and it would be just as much so today.

<comment><USER15> At 1:21 and 1:35, Ali does this shuffle thing with his feet.

How does one do that? I just tried it, and I can't imagine how I would move my feet that rapidly even with extensive training. I'm pretty lanky. Would it be easier to foot-shuffle if I had Ali's build? Or would it be even harder because of his mass.

And does this maneuver have a name? It seems like he does it when he's winding up for a jab combo. To make his punches unpredictable. Am I reading his movements correctly?

<comment><USER16> One thing people underestimate about boxing is how much training goes into the feet movement. Any boxer at that level can do things with their feet that is pretty baffling. Training your feet and calfs in boxing is extensive. That said one of the things that made Ali so astounding is that for a big guy he was super light on his feet.

That foot shuffle doesn't have a name, and he isn't doing it for a tactical advantage. He's showing off. Nearly anyone else on the planet who tried it would have a coach in there ear ripping them a new one. But you know, the greatest of all time gets to do things others can't.

<comment><USER14> Oh, I do think the shuffle had tactical advantages beyond showing off. It's demoralizing to the opponent, it serves as a distraction, and it's so unorthodox that it momentarily leaves opponents wondering what's coming next. He frequently threw (and landed) off of a shuffle, even if not to devastating effect.

But, I agree that it would drive most trainers nuts for any other boxer. And, yeah, Ali's gifts and confidence made it possible for him to get away with a lot of the kind of stuff that would drive trainers crazy (including Dundee early on). For, instance, consistently carrying his hands so low violated a Golden Rule of boxing and keeping the hands up is one of the first things kids are taught about the sport.

Later, he fashioned the rope a dope and other techniques to compensate for his then diminished speed.

Kind of reminds me of Bruce Lee. Improvise. Create. Take what your opponent gives you.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> "The hands can't hit what the eyes can't see. Float like a butterfly, sting like a bee! Rumble, young man, rumble!"

rip

<comment><USER18> He must be chatting with Bruce Lee right now.

</comment></comment><comment><USER19> Sad day. A video that probably won't be played very often, but might be special to this crowd: a 1997 Apple commercial staring The Greatest, during their Think Different campaign.

[https://www.youtube.com/watch?v=n83xzu2xH-E](https://www.youtube.com/watch?v=n83xzu2xH-E)

The video was created to poke fun at Michael Dell, when Dell was being "rude", as Jobs put it.

[https://www.youtube.com/watch?v=_hq0Ny1WgFs](https://www.youtube.com/watch?v=_hq0Ny1WgFs)

<comment><USER20> I think that video is from his training in Africa for the George Foreman fight. it might be in this movie:

[https://en.wikipedia.org/wiki/When_We_Were_Kings](https://en.wikipedia.org/wiki/When_We_Were_Kings)

It's a great documentary.

<comment><USER21> Yes, it is. A great film, recommended. Trailer: [https://www.youtube.com/watch?v=IfUHYUpmTFs](https://www.youtube.com/watch?v=IfUHYUpmTFs)

It shows Ali and Foreman in preparation for their fight in Zaire/Congo (the famous 'rumble in the jungle' [https://en.wikipedia.org/wiki/The_Rumble_in_the_Jungle](https://en.wikipedia.org/wiki/The_Rumble_in_the_Jungle)).

You can see the clever Ali blend in with the local population, winning their hearts and their cheers. Ali won the combeback fight against the younger, much stronger Foreman in a way nobody had predicted, leaning into the ropes and taking a lot of beating to his upper body, while giving short, fast hits on Foremans head. After 2/3 of the fight Foreman was completely out of fuel and Ali gave him one legendary, sudden last punch, and the giant tumbled down.

[https://youtu.be/55AasOJZzDE?t=21m4s](https://youtu.be/55AasOJZzDE?t=21m4s)

</comment></comment></comment><comment><USER22> Muhammad Ali is something we won't allow public figures to be anymore. Being outspoken and standing up for his beliefs, against all repercussions, were his his greatest feat(s). I hope, over all else, his contributions to the human spirit reign over the rest of us. We need another (dozen) Cassius Clays.

<comment><USER23> > Muhammad Ali is something we won't allow public figures to be anymore. Being > outspoken and standing up for his beliefs, against all repercussions, were > his his greatest feat(s).

What? You think current public figures are being prevented from being out spoken? Have you seen 50cent's twitter? Have you seen Donald Trump's? Lots of people are being out spoken, maybe more than I personally like, but whatever floats their boat.

<comment><USER24> There's a big difference between Trump's blowhard populism and Muhammad Ali's firm, unpopular beliefs. Trump says things with no filter, with utter disregard for their meaning, consequence, or congruence with the last thing he said. I respect him for having the guts to be stream of consciousness and throwing out each thought, but he's not, in any of his campaign, stating policy, but just this thought process.

Muhammad Ali had much to say. He was an outspoken civil rights supporter, anti draft activist, and convert to Islam, and a true believer in all those thoughts even when the majority of the country, even his fans, were against his positions. Hell, I'm against two of the three of those, and I still respect him enormously. He had a well spoken, eloquent, and coherent speaking style. He made you understand what his precepts were, how they shaped his philosophy, and he came to conclusions that you could respect. He wasn't simply outspoken, he was a good orator and a philosopher.

There's a great interview with him in The Kandy-Kolored Tangerine-Flake Streamline Baby. Tom Wolfe is not his intended audience, but is utterly enthralled. He comes across as genuine, progressive (in a meaning of that word that is positive), and concerned with his fellow man (if intending to be insular in parts of his philosophy.) He's no saint, but one of the most genuine people in the stardom limelight.

<comment><USER25> On being drafted for Vietnam:

> My conscience won't let me go shoot my brother, or some darker people, or > some poor hungry people in the mud for big powerful America. And shoot them > for what? They never called me nigger, they never lynched me, they didn't > put no dogs on me, they didn't rob me of my nationality, rape and kill my > mother and father... Shoot them for what? How can I shoot them poor people? > Just take me to jail.

</comment></comment></comment></comment><comment><USER26> If you want to understand Ali's genius then I highly recommend _When We Were Kings_ , an Oscar-winning documentary about Ali's 'Rumble in the Jungle'.

After watching it, I finally understood that he wasn't just another athlete with a big ego and mouth, but a brilliant, courageous competitor, far beyond the rest.

[http://www.imdb.com/title/tt0118147/](http://www.imdb.com/title/tt0118147/)

</comment><comment><USER27> Oh man this is a bummer.

For as beautiful as it was to watch him box, it is even more beautiful to watch him and Howard Cosell interact. The two of them were a pair, and Cosell was one of the first if not the first to acknowledge his name change. Cosell also stood by him when he decided to be a conscientious objector.

</comment><comment><USER28> An earlier HN article ([https://news.ycombinator.com/item?id=9478442](https://news.ycombinator.com/item?id=9478442)), partly an appreciation of Ali's style, made me look up an early fight of his from 1966:

[http://youtu.be/oJUzl0aFHZw](http://youtu.be/oJUzl0aFHZw)

It lasts only 8 minutes. The opponent is clearly a slugger who is baffled by Ali's style. Ali moves very fast, and fights with his gloves down. I'm not a fan of boxing, but she's right, that fight is an amazing spectacle.

</comment><comment><USER29> One of his best replies

[https://www.youtube.com/watch?v=2QE9XBovMk0](https://www.youtube.com/watch?v=2QE9XBovMk0)

<comment><USER30> Holy crap that was amazing. Thanks for the link!

</comment></comment><comment><USER31> He was a really smart dude. The way he marketed himself was I think the first of his kind.

Plus he won some of his fights even before stepping in through the ring by getting into his opponents head. Just imagine Ali going to your yard a few days before the match in the middle of the night with a loud speaker

</comment><comment><USER32> There's a couple of people in here still referring to Ali as Cassius Clay or Mr. Clay. He's quite clear in this excellent interview talking about racism [1] that Clay was a slave name and he was now a free man and wants to be called Muhammad Ali.

> "How would a Chinese look named 'Robert Smith'?"

      [1]: https://www.youtube.com/watch?v=rtxfTEyJZg4

<comment><USER33> Lots of people still fighting those culture wars.

</comment></comment><comment><USER34> He was one of my favorite folks in the world.A very good man.I often read his words for inspiration.He will be missed.

"A man who views the world the same at 50 as he did at 20 has wasted thirty years of his life."

"Champions aren't made in the gyms. Champions are made from something they have deep inside them: a desire, a dream, a vision. They have to have last- minute stamina, they have to be a little faster, they have to have the skill and the will. But the will must be stronger than the skill."

"He who is not courageous enough to take risks will accomplish nothing in life."

"It's lack of faith that makes people afraid of meeting challenges, and I believed in myself."

</comment><comment><USER35> It would be hard for someone who did not grow up in the '70s to understand the huge cultural influence of Muhammad Ali. The kids next door were African- American and my younger brother and I watched several of the Ali matches. He was strong, fast, smart, and good looking. He was outspoken and opinionated. He was a different kind of black man than what was portrayed in movies or on TV. He was revered by us kids at the time. If I knew nothing more than what I witnessed in the boxing ring he would still have been revered. But of course there was much more to Muhammad Ali than boxing.

</comment><comment><USER36> I don't think any athlete will ever match Ali's impact. He could get into see anybody. The US State department used him as back door conduit to pass messages.

He was a big fan of basketball. He had a house outside Benton Harbor on Lake Michigan is the southwest part of the state near Indiana. Someone passed word to the coach of the Michigan State Spartans that Ali was a fan of the team. Coach Izzo arranged for him to attend a game each year.

</comment><comment><USER37> What's My Name?

Beautiful little 20 min doc on his life and, yes, his name: [http://www.nytimes.com/video/sports/100000003216440/muhammad...](http://www.nytimes.com/video/sports/100000003216440/muhammad- ali-whats-my- name.html?hp&action=click&pgtype=Homepage&clickSource=clearfix&module=a-lede- package-region&region=top-news&WT.nav=top-news)

</comment><comment><USER38> My biggest sports idol, rude from outside (probably because of his "job") but inspiring, compassionate and with an enormous heart on the inside....

Superbowl 2004, in one of the classic IBM's Linux commercials, teaching Linux (represented by a kid) how to grow up...

[https://www.youtube.com/watch?v=BesI6NEPWlM](https://www.youtube.com/watch?v=BesI6NEPWlM)

</comment><comment><USER39> Why the Times can produce this so quickly.

[http://www.nytimes.com/times-insider/author/margalit- fox/](http://www.nytimes.com/times-insider/author/margalit-fox/)

<comment><USER11> Here's another explainer: [http://www.nytimes.com/2015/10/08/insider/when- death-comes-a...](http://www.nytimes.com/2015/10/08/insider/when-death-comes- and-the-obituary-quickly-follows.html)

The obit for Steve Jobs was initiated 4 years before his death.

</comment></comment><comment><USER40> Some great quotes:

[http://www.dailymail.co.uk/news/article-3624652/The-30-best-...](http://www.dailymail.co.uk/news/article-3624652/The-30-best- quotes-Muhammad-Ali-original-trash-talking-self-aggrandizing-motormouth- sport.html)

 _To make America the greatest is my goal, so I beat the Russian and I beat the Pole. And for the USA won the medal of gold. The Greeks said you 're better than the Cassius of old.' \- He said this quote after he won the Olympic light-heavyweight gold medal at the 1960 Games in Rome_

Pretty amazing for an 18 year old .. if a bit Trump-like.

<comment><USER41> It's all about perspective. Trump should _jump_ on this because in spirit they're alike; at least when it comes to a duty to succeed as a nation by vanquishing others with competitive success.

</comment></comment><comment><USER42> A sad day. He was an inspiration for American youth for 3 decades when he was active. RIP, the world has lost a champion

<comment><USER42> A sad day. He was an inspiration for American youth for 3 decades and being a 3 time heavy weight champion when he was active. RIP, the world has lost a champion

</comment></comment><comment><USER20> Muhammad Ali was so popular in the 1970's that they made a (not so good) Saturday morning cartoon about him, back when most people were only watching 3 network TV channels.

[https://en.m.wikipedia.org/wiki/I_Am_the_Greatest:_The_Adven...](https://en.m.wikipedia.org/wiki/I_Am_the_Greatest:_The_Adventures_of_Muhammad_Ali)

I remember watching a few of them:

[https://youtu.be/9nKpmzQZa5w](https://youtu.be/9nKpmzQZa5w)

</comment><comment><USER43> I remember him receiving an honorary doctorate degree on stage during my own college graduation. He was shaking from Parkinson's, helped by his daughter, but looked strong. This was 9 years and 3 days ago.

RIP.

</comment><comment><USER44> My wife visited his home in Berrien Springs, MI. As an exchange student she had no idea who he was. Hugging The Champ in his frail years without having a clue... sigh. Fun fact.

</comment><comment><USER45> Great photos of the Greatest by Neil Leifer:

[http://neilleifer.com/gallery/muhammad- ali/](http://neilleifer.com/gallery/muhammad-ali/)

<comment><USER45> More: [https://www.theguardian.com/sport/gallery/2014/oct/30/muhamm...](https://www.theguardian.com/sport/gallery/2014/oct/30/muhammad- ali-25-best-photographs-cassius-clay-legendary-boxer?CMP=fb_gu)

</comment></comment><comment><USER46> When I read and see some interviews with people like him, it's interesting to me how Islam was seen - not very long ago - as some self-determination movement for black people. (Malcolm X, and all that.)

It makes sense to me of course, but it's still interesting to see Islam being perceived totally differently today, just a few decades later. If you hear someone mention today that he wants to make "islamic nation", your mind goes to what is happening in Middle-East right now.

</comment><comment><USER47> Don't care for people hitting each other, even if it is consensual

HOWEVER - he overcame amazing odds for growing up in a heavily racist, segregated country and I have massive respect for him giving up his career while refusing to serve in the Vietnam War and kill others simply at the order of the government.

So why do we always wait for people to die to honor them - why not do it when they can appreciate it?

<comment><USER48> There are a lot of small honor ceremonies, for example he lighted the olympic torch in Atlanta 1996. The problem is that is difficult to coordinate that all the major newspaper put an article about him in the front page. (Perhaps for some anniversary, like the x0th anniversary of the word championship? And what happens if he lives 10 more years?)

Also, there is some social norms that prevent criticism at the obituaries so they are more hagiographic than usual articles.

</comment></comment><comment><USER49> Float like a butterfly, sting like a bee. The hand's cant hit what the eyes cant see. - M. Ali.

</comment><comment><USER50> By the way, I sometimes wonder how appropriate it is to say "rest in peace". To me, it always sounds like you assume someone may not rest in peace (i.e. end up in hell?).

<comment> k-mcgrady You're over thinking it. It's like telling someone to have a safe flight. You're not assuming they're going to have an unsafe one. Or wishing someone good luck - you're not assuming they'll have bad luck. It's just a nice platitude.

</comment></comment><comment><USER51> I met him briefly in 1991 but will never forget. A man in the history books now and forever. I shall look up to the sky and smile. I'm sure he is resting in peace.

</comment><comment><USER52> Such an embodiment of what it means to stand up for the truth in a time it was powerlessly rare. "Float like a butterfly. Sting like a bee..." RIP, ALI.

</comment><comment><USER53> Some great interviews with parkinson [https://youtu.be/YkM0v4lYEUc](https://youtu.be/YkM0v4lYEUc)

</comment><comment><USER54> I wondered if he received any experimental treatment for his Parkinson's. Or Michael J. Fox? Are we any closer to the cure?

</comment><comment><USER40> Rumble young man, rumble. Rumble in peace now ..

</comment><comment><USER55> A true character filled with personality and changed my view of certain aspects of life. Rest in peace and with success.

</comment><comment><USER56> Very sad to hear this. He was a legendary person in so many different aspects of life.

Rest in power.

</comment><comment><USER57> This news item currently has 260 upvotes on _hacker news_.

Think about this a little. Think and try to name anybody else from boxing (or heck, any other sports) who could be up here. I know can't think of more than a few people.

He was the greatest in his time.

Rest in peace, Mr. Clay. You are among the icons of the 20th century.

<comment><USER33> Why do you call him "Mr Clay"?

<comment><USER57> When one converts to Islam, it's customary to change his name but generally people hold on to their surnames. So I always thought of him as "Muhammet Ali Clay". This apparently wasn't the case with him. Too late to edit my post now...

</comment></comment></comment><comment><USER58> This was a full page headline on BBC News earlier today as well.

<comment><USER59> He was very popular in the UK, as a result of his fight with Harry Cooper and his appearances on Michael Parkinson's chat show over the years.

</comment></comment><comment><USER60> Would've loved to see him fight Teofilo.

</comment><comment><USER61> Rest in peace

</comment><comment><USER62> Place the black stripe on the top. He was the greatest...

</comment><comment><USER8> I've read Hacker News for a long time and never published a comment until today.

Ranked by my earnings and by education I'm probably in the bottom 2% of users on this site...but I'm proud to see today that in spite of that fact I'm one of the very, very few who refuses to deify sports celebrities.

By and large the majority of you who throw adoration at Muhammed Ali never lived through his era. You never interacted with him. You never experienced him as a person other than retrospectively through his manicured public image. And yet you revere him unsparingly, without hesitation, without qualification.

How disgusting.

It is this trait in human beings, this desire to worship and affiliate with those one wishes to be like that enables power stratification in society...and always will.

<comment><USER63> One of the best qualities people can have is to see the good in something/someone. The bad is of no value, so forget it, but celebrate the good. People here are celebrating the things they admired about a public figure. Likewise you can look at an online community and take heart at how people had a shared recognition of great achievements and are able to celebrate it together. It does no good to dwell on the negative and suppose that people would actually deify someone or support everything they do without hesitation in order to affiliate themselves in some way.

<comment><USER8> Thanks for your thoughtful reply. In defense of my mentality:

> One of the best qualities people can have is to see the good in > something/someone. The bad is of no value, so forget it, but celebrate the > good.

This depends on your objective. If your objective is to be liked by others - then by all means ignore the undesirable aspects of people and things and only acknowledge those which perpetuate warm and fuzzy feelings all around.

My problem with this behavior is that it makes its way into the democratic process, and tends to override objective critical analysis.

I think as a society we need to respect and honor openness and critical thought. Censoring our interactions in a manner that perpetuates some kind of self delusion - although a happy delusion - is counter productive to progress.

> Likewise you can look at an online community and take heart at how people > had a shared recognition of great achievements and are able to celebrate it > together. It does no good to dwell on the negative and suppose that people > would actually deify someone or support everything they do without > hesitation in order to affiliate themselves in some way.

That might hold some weight, in this case, if there wasn't an overwhelmingly disproportionate amount of grieving for someone whose life as an entertainer made little impact on the daily lives of others.

Sure, there was admiration and fantasy spread amongst the throngs of enthusiasts who followed the life and times of Muhammed Ali. But had he never existed the world would be no different today.

So I think it is absolutely incumbent on me to outwardly, vehemently condemn the intellectual class (Hacker News) for being so shallow, so superficial, and so sycophantic. We must rise beyond this mentality as a people in order to gain equality and value those who contribute in a more fair sense.

<comment><USER64> I disagree. I think everyone has their own journey and everyone must accept and respect it for the value it offers. Just because you can't see the value or the impact does not mean it's not there. Wings of butterflies and all that. Ali's influence on the world is incalculable. How's that for critical thinking?

"We must"? No, we musn't. If you don't like sports, don't watch them. I don't.

Clearly you come here with an agenda. The goal of your "progress" is by definition regressive. Equality means respecting and defending everyone's rights equally as individuals and not a specific ingroup, such "those who contribute in a more fair sense." That would be collectivism and you appear to be demonstrating authoritarian attitudes and socialist (culturally Marxist) shaming techniques in an attempt to make people feel disconnected from the intellectual elite as a means of coercing them to join your group/cause. We are not your weaponized zombies, shamed into submission and programmed to deliver your message so we fit into what you define as an elite group.

That's called 'malignant narcissism' by the way. How's that for openness?

The right to life, liberty and the pursuit of happiness as individuals is what needs to be promoted if you believe in free will/agency as a goal. And with that you have to accept the good with the bad, whatever you believe them to be.

"I'm sorry, I didn't know freedom meant people doing stuff that sucks." \--Summer, Rick and Morty Episode 203: Auto Erotic Assimilation

</comment></comment></comment></comment><comment><USER65> The saddest thing about Ali's life IMHO is that he lived in a world where the best way he could make his living was hitting and being hit by others. It is time to recognize boxing for the barbarism that it is and retire it from the repertoire of human activity along with bullfighting and bear baiting.

<comment><USER66> It's not barbarism when it's consenting adults. Bulls and bears do not consent.

<comment><USER65> > It's not barbarism when it's consenting adults.

Do you think this is OK?

[https://en.wikipedia.org/wiki/Bumfights](https://en.wikipedia.org/wiki/Bumfights)

The barbarism in bull fighting and bear baiting lies not in the animal's absence of consent. Animals don't consent to be eaten, but eating animals is [EDIT] not generally considered barbaric. What makes boxing and bull fighting and bear baiting barbaric is the fact that the _object_ of the game is to inflict pain on another living being. Many other sports have pain as a consequence (football, rugby), but in boxing the _goal_ is to inflict pain. The more pain the better. The ideal outcome is to render your opponent unconscious. That, IMHO, is barbaric.

Money and social constraints also significantly distort the matter of consent. Muhammed Ali was a black man living in an age of discrimination. His professional prospects were limited more by the color of his skin than by the content of his character. I think he was capable of a lot more than bashing people's skulls in. But because society places so much value on bashing people's skulls in, we will never know.

<comment><USER66> Plenty of people think eating animals is barbaric.

<comment><USER65> That's a minority view. Most people think it's OK as long as the animal is raised and slaughtered humanely. I edited my comment to make it a little more precise.

</comment></comment></comment></comment></comment><comment><USER67> Wasn't his daughter on a reality show about jails?</comment>


Chicago Boss: The Erlang Web Framework - <AUTHOR> http://chicagoboss.org <comment><USER2> Does Chicago Boss have a lot of momentum? I thought it was idle now that the founder had moved on. It's certainly a fairly complete and mature framework.

I'm thinking the hot new kids are:

Phoenix: [http://www.phoenixframework.org](http://www.phoenixframework.org) and N2O: [https://synrc.com/apps/n2o/](https://synrc.com/apps/n2o/)

Of course, this is just my opinion, not a comprehensive list. But these two are most interesting to me and seem to have momentum.

<comment> vezzy-fnord The current maintainers are officially Dmitry Polyanovsky and Jesse Gumm (same guy who maintains Nitrogen, from which N2O was forked, and also the SimpleBridge web server abstraction library), I believe.

You're right it's not terribly active at the moment. It has rough edges, but it's very much usable.

Phoenix arguably supports most of the same patterns as CB, but on top of Elixir.

EDIT: Oh, by the way, you can actually write Chicago Boss apps using Elixir and LFE instead of plain Erlang, if you'd like. This is officially supported.

<comment><USER3> Also interesting is that Evan Miller is the original developer of Chicago Boss, and he shows up a lot here. You will see it on the list of his software on the home page.

[http://www.evanmiller.org/](http://www.evanmiller.org/)

I think he has since moved on. Notice some nice CB components, like ErlyDTL, are also his work. He shows up a lot here, so I thought people would be interested in it with regards to his other pieces about statistics, modeling, and other topics.

<comment><USER4> Evan actually took over and maintained ErlyDTL, but it's Roberto Saccon's work IIRC.

quickly confirmed: [http://erlang.org/pipermail/erlang- questions/2014-January/07...](http://erlang.org/pipermail/erlang- questions/2014-January/076422.html)

<comment><USER3> Not surprising. Was not even familiar with the library until I saw the link in these threads to the Github wiki page for ChicagoBoss mentioning features and I saw ErlyDTL, and went to evanmiller's page.

I dug a little deeper because having used Django in a very small does years ago, I have no idea what made its templating so desirable or unique that over stacks copy it.

I assume up on deck: queue jokes about templating non-Erlang in Erlang and how people clamor for anything else.

</comment></comment></comment></comment></comment><comment><USER5> I started playing with Chicago Boss a few years ago and it was nice. But the models/records part is designed around Erlang's experimental "Parameterized Modules" feature, which has since been more or less rejected (see: [http://www.erlang.org/news/35](http://www.erlang.org/news/35)). It seems that Erlang will continue to support the syntax for legacy reasons but I'm extremely hesitant to hop on board a framework that uses an all but deprecated feature so centrally.

<comment> vezzy-fnord "Deprecated" isn't the proper term, I think. It's not in the mainline language, but it is instead kept as a separate module in the form of a parser transformation, which CB pulls in during build time.

In that regard, it's no different from pulling in any other library.

</comment></comment><comment><USER6> They provide a nice comparison of current Erlang web frameworks: [https://github.com/ChicagoBoss/ChicagoBoss/wiki/Comparison-o...](https://github.com/ChicagoBoss/ChicagoBoss/wiki/Comparison- of-Erlang-Web-Frameworks)

</comment><comment><USER7> _" Do you pine for a simpler time when web pages loaded in under one second?"_ That's a great mission statement. I see so many slow-loading pages which could be simple static HTML pages.

</comment><comment> r-u-serious I prefer Axiom for its lightness: [https://github.com/tsujigiri/axiom](https://github.com/tsujigiri/axiom)

...but that might just be because I built it.

</comment><comment><USER8> Would the Erlang/Elixir platform be useful for small/hobbyist developers? Everything I've read on it makes it seem very domain-specific, considering its history in telecommunications.

<comment><USER5> I don't know exactly what you mean by "small/hobbyist developers".

Yeah, Erlang really shines for high-availability, high concurrency network and distributed systems stuff, which it was designed for, but many of the properties that make it successful in that area are useful elsewhere as well.

First, obviously, a great deal of web and database stuff is network programming and distributed systems when you get down to it so web servers, proxies, websockets, messaging, etc are all well within Erlang's domain.

Here's a demo of someone using Erlang as firmware for a Drone, doing hot code- swapping while it's in the air: [https://www.youtube.com/watch?v=96UzSHyp0F8](https://www.youtube.com/watch?v=96UzSHyp0F8)

Erlang's bit packing/unpacking syntax ([http://www.erlang.org/doc/programming_examples/bit_syntax.ht...](http://www.erlang.org/doc/programming_examples/bit_syntax.html)) is really nice to work with. It came out of a need to handle binary wire protocols, but it means that it can also be nice for any kind of binary file format parsing that you might need to do.

ErlangOnXen ([http://erlangonxen.org/](http://erlangonxen.org/)) is really interesting if you are into operating systems and virtualization stuff.

Erlang's not very focused on heavy numeric processing so you don't see it much in science domains, but the actor model that it's built on maps well to Agent Based Modeling: [http://www.research.ucf.edu/Swarmfest/Program_Day2/Gene%20Sh...](http://www.research.ucf.edu/Swarmfest/Program_Day2/Gene%20Sher_FINAL_ABM_Using_Erlang.pdf)

<comment><USER9> There's also a book, Handbook of Neuroevolution Through Erlang.

> First, obviously, a great deal of web and database stuff is network > programming and distributed systems when you get down to it so web servers, > proxies, websockets, messaging, etc are all well within Erlang's domain.

Caveats with database is their driver. Cassandra for example does not have official supported drivers and I've met a gentleman that worked for TigerText company have complains that it was pretty bad. So Erlang having small user base have less official driver support.</comment></comment></comment>


Destruction of evidence charges filed for remotely wiping iPhone - <AUTHOR> https://dailygazette.com/article/2018/11/08/police-woman-remotely-wipes-phone-in-evidence-after-shooting <comment><USER2> I'm kinda curious how the law would treat a dead man's switch that automatically wipes the phone if you haven't unlocked it for N hours (say, 24 or 48). (Assuming it was set up well before any event that prompted the phone's seizure, of course.) Could they somehow charge you for not warning the police about the auto-wipe when they took your phone? Does the answer change if you were officially under arrest and had a right to remain silent?

This seems like a pretty good idea in any case. If the seizing party can't crack the passcode anyway then it's a no-op. If they can then presumably they won't/can't do it right away, so it would add a bit of defense in depth.

<comment><USER3> > Does the answer change if you were officially under arrest and had a right > to remain silent?

Being formally under arrest doesn't affect whether you have the right to remain silent. It affects whether the police are required to tell you that you do.

<comment><USER4> Fascinating how this varies between nations and cultures. In Norwegian case law, refusing to explain yourself can be considered indirect evidence of guilt.

I remember a report from a recent Norwegian criminal trial, where the judge himself warned the accused that refusing to give an explanation could reflect badly on the question of whether she was guilty or not.

<comment><USER5> In the US, the Fifth Amendment protects the opposite: you cannot be compelled to testify against yourself in the US, and choosing to take the Fifth cannot be considered evidence of guilt. There's some evidence that, in practice, this isn't always true, but judges are required to clearly explain this to jurors.

</comment></comment></comment></comment><comment><USER6> Howdy, digital forensics software developer here. A few points: 1) yes, the police probably should have put the phone in a Faraday bag, but those aren't perfect and municipal law enforcement generally doesn't have the same equipment that state and federal police do. It doesn't excuse the suspect allegedly taking action to destroy evidence; 2) this is probably about the boyfriend, who they suspect committed a shooting—-they charged the girlfriend with evidence tampering as a felony, and then the prosecutor has legal leverage to get her to testify against her boyfriend and take a gun off the street; 3) no amount of technical argumentation will save you from a prosecutor, judge, or jury if you do something that causes spoiliation of evidence—when your company is sued and your business systems are preserved/collected as a result, don't even think about getting in the way.

<comment><USER7> How do you get into digital forensics dev? Seems like an interesting field.

<comment><USER6> I was laid off from a startup at the bitter, wretched end of the dotcom bust in the spring of 2003. Another company two blocks from my apartment in Pasadena, CA was hiring C++ engineers, and I was lucky enough to join Guidance Software to work on EnCase. It's a fun field: bits and bytes, a whole lot of 'em, and the requirement for perfection.

<comment><USER8> I trained with Encase at uni! Quite a tool.

</comment></comment></comment></comment><comment><USER9> > Monday Update: Suspect in remote phone-wiping case denies wrongdoing, Nov. > 12, 2018 > [[https://dailygazette.com/article/2018/11/12/suspect-in- > remot...](https://dailygazette.com/article/2018/11/12/suspect-in-remote- > phone-wiping-case-denies-wrongdoing)]

> "Our position is that my client didn't access anything to remotely delete > anything," Smalls said. "My client wouldn't have any knowledge how to do > that."

That seems like something pretty easily disproven with a subpoena to Apple for records of whether a remote wipe command was issued, no?

Which makes me think the defendent probably indeed didn't remote wipe.

I wonder if it wiped itself after too many wrong password attempts (is that a thing they do?), or as the attorney suggests "days after her phone was seized, Grant got a new phone. Smalls said he didn't know if that had any impact on the data on the phone police had taken" \-- does it auto-wipe the old phone in those circumstances sometimes?

<comment><USER10> Yes, there's an option to have your phone auto-wipe after 10 failed unlock attempts. However, I'm not aware of any way to have it auto-wipe by itself after n-days. Getting a new phone and signing into your Apple ID has no effect on the data stored on your old phone.

<comment><USER11> Removing a phone that was previously associated with your Apple ID will remotely erase the device. You will get an email confirming the erasure the next time the device is turned on.

<comment><USER12> Assuming the suspect is telling the truth, that's probably what happened. And it might not even have been the suspect herself; a store employee helping her set up her new phone might have helpfully removed her "lost" phone from her account.

<comment><USER13> OK, then, does telling the Apple Store that you lost your phone, when it was in fact impounded by police, constitute evidence destruction? I can see how it might.

<comment><USER14> I bet saying the magic words "my phone is impounded by the police, please wipe my phone" would be. But, assuming the suspect is telling the truth and assuming an apple employee disassociated the suspect's phone from their icloud account, let's also assume the suspect lied to the apple employee.

"I lost my phone and need a new one." "Your phone is lost? Let me disassociate your old and and help you set your new one up. What's your icloud username, email or phone number?"

Assuming the suspect knew disassociation meant data deletion on their old phone, is it up to the suspect to prevent this from happening? It seems pretty close to invoking the magic words I started out with, especially if this was the suspect's intent going into the store.

Now assuming the suspect didn't know, and he did not intent to delete data from his old phone... Now what? Is it acceptable to accidentally destroy evidence? Spoliation of evidence suggests a guilty conscience, but in this case it was an accident.

<comment><USER15> >Is it acceptable to accidentally destroy evidence?

Theoretically no. In practice it's murkier.

If you're a cop? Definitely not acceptable on paper but you'll get a slap on the wrist at best.

If you're OJ Simpson and can afford a good lawyer? You will probably be found not-guilty.

Peasants like you or I? They'll throw the book and something will stick.

Edit: Am I being down-voted for being blunt or because reality makes people uncomfortable?

<comment><USER16> I didn't downvote you, but I think you were downvoted because the post you were replying to was asking a legal/ethical question about whether it's acceptable to accidentally destroy evidence in general, and you gave an unsupported answer and then veered off into a discussion of whether the law is applied to all people fairly.

<comment><USER11> In my view the question of whether the law is unbiased and "fair" is more important to resolve than whether accidentally erasing a phone seized by law enforcement counts as spoiling evidence.

There's no point arguing that storing a vat of milk in the sun counts as the law enforcement impounding incorrectly or the suspect deliberately arranging evidence to destroy itself, when the crux of the matter is that the defendant is a black woman in Alabama so has no chance of a fair trial regardless how airtight the case might seem.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> What if I use the gmail/slack/whatsapp website instead of the app, and remotely log the phone out of google/etc if my device is seized. That way the data was only stored in RAM, and they shouldn't be able to access it once they get into the phone. Does that count as destruction of evidence?

<comment><USER18> If you deliberately do anything which will cause evidence to be placed beyond the reach of law enforcement then you are likely to be hit with charges.

You can quibble over technical details, but at some point a judge will be asked if it fits the charge, and make a layman decision, not a programmer's one.

<comment><USER19> Then again, if a browser cookie is the only thing providing access to "evidence" on a particular machine, then it wasn't actually on that machine to begin with.

That's far from a mere technical detail, as it also means the person lacked any meaningful physical control of, or proximity to, the evidence.

I recall there _are_ some cases that centered on whether someone was aware of the existence of a browser cache and knew how to clear it. In that case the "evidence" really is on the local machine because that's what the cache is.

<comment><USER20> > _That 's far from a mere technical detail, as it also means the person > lacked any meaningful physical control of, or proximity to, the evidence._

That would still be irrelevant if their intention for getting themselves to "lack any meaningful physical control of, or proximity to, the evidence" is deemed by a judge to be malicious.

<comment><USER21> You have badly misunderstood the point the GP was making. The person in question was always in a state of "lack[ing] any physical control of or, proximity to, the evidence". They had no control of this in any way.

This, by the way is why the technical issues are important, relying solely on the lay person interpretation is dubious. A court that issued ruling on issues it doesn't understand is inherently unjust.

<comment><USER20> > _The person in question was always in a state of "lack[ing] any physical > control of or, proximity to, the evidence". They had no control of this in > any way._

Well, if they arranged so they are always, from the start, in that position, with the intent to leverage that "lack of control" to not produce evidence (i.e. with doing some law breaking in mind), that could still be considering incriminating...

And that, in the end, is a lay person's judgement to make...

</comment></comment></comment></comment></comment></comment><comment><USER22> I'm curious what sort of notice was given to this person that the phone was evidence. For example was she arrested, and had her phone on her, and then the police never returned it, or was there a search warrant/subpoena and she was given a receipt for items held under that order?

</comment><comment><USER11> How long until we find out that attempting to use a Greybox will trigger the self destruct feature built into iOS by Apple as part of that patch where they disable USB data when the phone is locked?

</comment><comment><USER23> I guess the police will learn to put the phone in a Faraday cage as soon as it's seized

<comment><USER24> Sell 'mobile' Faraday cages one for every squad car... Profit?

<comment><USER25> [http://www.reynoldskitchens.com/aluminum- foil/](http://www.reynoldskitchens.com/aluminum-foil/)

<comment><USER24> [1] + this kind of pouch. Probably could sell them for at least 100$ a piece. 'battle tested'

[1][https://i5.walmartimages.com/asr/15479a20-388b-4138-9f8c-1a1...](https://i5.walmartimages.com/asr/15479a20-388b-4138-9f8c-1a1cee17513f_1.68da8590f42851e5d4bb9dda0ba2d89f.jpeg?odnHeight=450&odnWidth=450&odnBg=FFFFFF)

<comment><USER26> It would be hard to sell it for $100 if you can buy digital evidence bags for a couple bucks: [https://www.arrowheadforensics.com/products/evidence- packagi...](https://www.arrowheadforensics.com/products/evidence- packaging/faraday-pouches-bags/cell-phone-faraday-storage-kit.html)

<comment><USER27> Put a "5G-ready!" sticker on it, and you're back in business.

</comment></comment></comment></comment></comment></comment><comment><USER28> Does anyone know what the standard of proof is for destruction of evidence? It seems a simple defense in a case like this is to have previously shared ones iCloud password with their entire family. Each family member then creates reasonable doubt for any family member who is tried for the crime.

</comment><comment><USER29> follow-up article "Suspect in remote phone-wiping case denies wrongdoing -- Accused woman doesn't even know how to do that, her attorney says"

[https://dailygazette.com/article/2018/11/12/suspect-in- remot...](https://dailygazette.com/article/2018/11/12/suspect-in-remote-phone- wiping-case-denies-wrongdoing)

</comment><comment><USER30> What is the penalty for destruction of evidence? If it's less than the crime at hand, it's logical to wipe.

I'm a little surprised the police don't have faraday bags or a room to store evidence in that doesn't allow radio signals in.

<comment><USER31> > What is the penalty for destruction of evidence? If it's less than the crime > at hand, it's logical to wipe.

According to [https://en.wikipedia.org/wiki/Spoliation_of_evidence#Tamperi...](https://en.wikipedia.org/wiki/Spoliation_of_evidence#Tampering_with_evidence) , in my non-lawyerly (hence probably imprecise) summary, the act of destroying evidence can be regarded as incriminating evidence.

</comment></comment><comment><USER32> I guess it didn't have a passcode? Just let the police try whatever they have, as long as you have the iOS 12 update that disables accessories and thwarts "GrayKey" there's no need to remotely wipe it.

<comment><USER33> It only locks out accessories if the device has been locked for over an hour, so make sure to lock your device at least an hour before getting arrested, or reboot it. Also make sure the option is enabled under passcode settings; I think it's disabled by default.

</comment></comment><comment><USER34> So data stored on a phone counts as "physical evidence"?

<comment><USER35> Why wouldn't it be? It's the same as words on paper.

<comment><USER36> Because there is nothing 'physical' about it.

<comment><USER35> The phone is the physical evidence. Would you not consider a flash drive as physical evidence? Even at the most pedantic level, the data is still stored physically as the state of the logic gates.

</comment></comment></comment></comment><comment><USER36> But who wiped the data anyway? Apple - sure she asked them to, but apple did it.

<comment><USER37> But then if it was Apple who deleted, does it raise the question that they(Apple) didn't check if the data being deleted was evidence or not?

<comment><USER16> You can't expect Apple to do an investigation of every phone they wipe at a customer's request. What about Google Docs? Even if the user clicks the "delete" button, Google performs the physical act of deletion. So should clicking that button trigger a pop-up with the message, "Deletion will occur once we've verified that you are not under investigation by the authorities in your jurisdiction"? Or should it silently send the "deleted" document to an archive that Google must maintain indefinitely for the purpose of responding to subpoenas?

</comment></comment></comment><comment><USER38> But GDPR says I can delete my data, I'm confused

<comment><USER33> I believe the GDPR allows a company to refuse (or delay) processing your request to delete their data about you if they have a legitimate reason, and being legally obligated to hold onto that data is one of the legitimate reasons. However, GDPR is a big law and I am not a European lawyer (I am neither, in fact), so I'm curious if my understanding is wrong. What section of GDPR are you thinking of and what exceptions does it have?

<comment><USER39> The GDPR regulation has some exceptions for legal requests and generally puts itself below local laws and regulations that specify further, to my knowledge, if you get a letter from the police/state that says some data is needed for a court case, you can safely ignore all deletion requests for that data until such time that the state/police request is no longer valid (ie, they copied it off your server).

However, once they have the data (and after asking the forensics team if it's okay) you can certainly follow up on the request and it's probably good manners to inform people that there is a legal obligation holding up the deletion of some data (unless the warrant prohibits that).

<comment><USER16> This again raises the issue of speech vs absence of speech. What if a cloud provider has applications that confirm deletions that are initiated by the user? A secret warrant prohibits disclosure of the warrant's existence, but now we're talking about a requirement to actively lie to users. I really don't think that this hair-splitting.

<comment><USER39> Then you'll have to lie to the user. Simple as that.

</comment></comment></comment></comment></comment><comment><USER40> Maybe the detective should have to undergo some extra training? Though I guess they probably figured it out by now so no point but I mean seriously? In 2018 you are going to allow this to happen? Outsmarted by someone who sounds like a gangster. This has been an issue for years. I had a friend who was arrested for illegal fishing(5 fish out of season) and they took his phone. He was panicked because he didn't have a password on his phone and had done something that may have gotten him in trouble. For me being so experienced with tech at the time without even thinking said I would just remote wipe it if this happened to me. He said how. I said well just sign into google device manager. For those wondering he had some marijuana stuff which is now legal in Canada on his phone pictures of his plants or something nothing crazy. We were young and never thought about legal ramifications. But it seems like this has been possible for at least half a decade there should be standard procedure when taking a persons phone into custody.

<comment><USER41> wait a second, i've seen this before...

<comment><USER40> Not really sure what you mean by that? I also knew my opinion would be unpopular here on HN, perhaps it was my tone I'm not sure, but really if I was the family of a murder victim and the detectives lost incriminating evidence on the phone in this way I would be upset. This has been in the news many times. We know better then that and in my opinion the detective screwed up. It appears almost everyone here knows about faraday cages it is common knowledge. So why did this happen again in 2018? Have a good day everyone</comment></comment></comment>


No Justice for Old Men - <AUTHOR> https://www.miamiherald.com/news/local/article220097825.html <comment><USER3> I'd read this as Acosta supports child trafficking and/or paedophiles - <USER2> he is one?</comment>


Seven Years Is Too Long - <AUTHOR> http://lolindrath.com/2014/01/29/seven-years-is-too-long/

<comment><USER2> I cannot agree with this at all. Conflating duration with personal growth is the problem here. People who get "comfortable" in a job and just keep doing it for multiple years, those folks will find that all of a sudden[1] things have changed and they don't have a job and they don't know what they want to do. But that is because they stopped growing, not because they spent too long in their job.

[1] "Sudden" to the person in the job but generally if you look for the signs its pretty obvious when some part of the company is going away.

<comment><USER3> I don't think he's saying that 7 years is too long in one job; he's saying that it's too long between interviews.

</comment></comment><comment><USER4> Wish I could stay at one company for 7 years. Or at least one city. Grass is greener and all that. I keep my cv updated even when at work, when deciding on tech to use or books to read I often think about how they will fit into my skills portfolio next time I have to job hunt. Feels really bad when I admit it. I hope I can change my luck and stick around because I'm really not a mercenary - I never started interviewing before leaving and I never treated my work like a card-punching factory job.

Way ahead of the game when it comes to wearing a suit. I've been wearing a tie all my career. And I used to work in games where it was highly inappropriate (but people there are very acceptable of all kinds of eccentricities).

</comment><comment><USER5> If you just want to keep up to date on interviewing skills, make a habit out of doing interview-style problems. I don't think you need to worry about wearing a suit or writing on a white board. Careercup is a fairly consistent source of interesting interview-style problems; I find myself perusing it sometimes even when I'm not remotely interested in another job, because a fair number of the problems are interesting in and of themselves and simple enough to not take up much of your time.

There are also plenty of other sites, usually with a competitive edge, like HackerRank or TopCoder. Doing problems like these really is not a waste of time even if you're completely content with your job. While a lot of it may seem like algorithmic trivia, you'll internalize it sooner than you might expect, and then you'll start finding real-world uses for some of these tricks and, more generally, your "mental overload" when thinking through a piece of tricky code will gradually go down and down.

Re: interviewing frequently just for practice, that's great if you're in an area with an abundance of tech companies. I think that could be risky if you're in a city with just a few that you'd want to work at, though. You don't want to bomb an interview at the only other company in your city you'd want to work for just because you were rusty and used them for practice.

<comment><USER6> I couldn't disagree more. Interviewing is definitely a skill (beyond solving interview problems), and like anything - if you don't do it often you will not be very good at it.

<comment><USER5> You're free to disagree, but I don't think you responded at all to the actual point I made regarding "interviewing for practice" in a city where there are only a small handful of companies that suit you. I never said or even implied that interviewing itself isn't a skill.

<comment><USER6> So look outside your city or your comfort zone and interview with other companies.

You may be an exceptionally charismatic person that can get any job you want, and if so, you can ignore the blog post and my responses. Think about it though, are you working at your dream job? Is there somewhere else you really want to work? Wouldn't it suck to choke at that interview?

For me, part of the challenge with interviewing is remaining calm under pressure (your future depends on how you answer the following question...). After a couple interviews recently, I found it got a little easier to handle.

Interviewing is also a matter of selling yourself, and this is more than just answering questions or solving problems - you also need to be asking your interviewer good questions. If you lead them the right direction they can come up with answers for why you're the best person for the job. (Asking the right questions can also help you determine whether you really do want to work at a company.)

</comment></comment></comment></comment><comment><USER6> This article strikes really close to home for me. The company I had worked for nearly seven years laid off a bunch of people and I could see where things were headed. Fortunately I've been doing mobile development and it's particularly in demand right now, so I was able to land a new job in a few months.

> _Interview at Least Every Other Year_ If you struggle to communicate under > pressure like I do, then it's important to do this a _lot_ more often. My > personal goal is a phone interview at least once a quarter and one or two > in-person interviews a year.

I would also add another rule:

Don't apply to too many places at once. (Especially if you're currently working!) Keeping up with the responses, doing the interviews, and solving coding exercises can be a full time job in itself.

Edit:

The other thing I learned to do was to note all of the questions that I didn't have an immediate, natural response for. Some of them I was able to think of better answers later on that helped me in the next interview. Some I asked other people to see how they responded, and I realized I hadn't always interpreted the question correctly.

</comment><comment><USER7> Someone convince me that Big-O notation is useful anywhere outside of interviews. Because I don't believe it is.

<comment><USER8> I've run into plenty of cases where something was unacceptably, brokenly slow for a handful of inputs, and I wanted to figure out why, and then I realized "Oh, this bit of code is O(n^2) and it's running into a weird edge case with a large n", and then fixed it. I've also run into cases of regular expressions running in exponential time, which is always entertaining.

<comment><USER7> Yes, but you saw code was not optimized, you didn't see the letters "O(n^2)" in the code.

I'm not asking why _optimization_ is important, I'm asking about the notation that only seems to appear in interviews.

<comment><USER9> Big-o is about a specific class of optimization, and a theoretical understanding of it is important.

It is important to distinguish between asymptotic optimization vs. i/o optimization vs. code optimization.

I'd argue if you can't do the first one you're less likely to be able to handle the next two. Yes, you can do it intuitively to some extent. However, I think it's important to be systematic about it so we can have meaningful conversations about it beyond "doing it this way is slow and if we do it this way it's faster."

</comment></comment></comment></comment><comment><USER10> Interesting look at how to stay relevant. As some other posters have noted, duration != irrelevance. That is, you can be irrelevant to your field after being at a company one year (if they have you doing mindless work that rots your brain), or still relevant even after a decade, if you have challenges.

I particularly enjoyed his point about interviewing once in a while, as that definitely sharpens skills that are not typically used in a job.

One thing I'd add is to keep your linkedin profile up to date all the time. This can help you know the local companies as well as folks who will be good to approach for a soft intro for interesting companies.

</comment><comment><USER11> I will soon have been at my current job for eight years. Whether that's too long or not depends on the flexibility you have in your job to keep growing your skills and responsibility.

</comment><comment><USER12> you lost me at wearing a suit...

<comment><USER13> Did you not get his point or you were you not convinced it was a good idea?

<comment><USER14> I get his point and it's a solid plan in most fields.

But for the tech jobs most people want, it's a really bad idea to put a suit on for a interview.

<comment><USER15> > But for the tech jobs most people want, it's a really bad idea to put a suit > on for a interview.

Why? Are you saying that some company will give you a hard time because you are wearing a _suit_? That would certainly be humorous.

Humorous as in "Haha, I have no intention to work in such a place, ever".

<comment><USER16> You'd probably be wrong. Cultural fit may be important, and you don't want to get strange looks on an interview. At the same time the company still might be quite good - as in "early Google"-like good.

</comment></comment></comment></comment></comment><comment><USER17> Great tips in here! Thanks for posting!</comment>


PulseAbility.io – Build Trust in Your Product with LinkedIn Influencers - <AUTHOR> https://pulseability.io/ <comment><USER2> How do I connect with Influencers?

</comment><comment><USER2> Great idea!</comment>


Automated Scanning of Firefox Extensions Is Security Theater - <AUTHOR> http://danstillman.com/2015/11/23/firefox-extension-scanning-is-security-theater <comment><USER2> It just seems amazing to me that anyone with anything remotely resembling a degree in CS[0] would think that this kind of scanning would work for a Turing Complete language. If you restrict extensions to non-TC languages, then it could be made to work[1]. Also the argument that it stops lazy malware authors is absurd -- it's as if they haven't heard of script kiddies. The situation here is exactly analogous: one someone figures out a way around their (extremely ad-hoc) checks, everybody else gets that "workaround" for free. They're only setting themselves up for a neverending whack-a-mole game which they can only lose, solely based on the amount of resources they have.

[0] As one hopes at least _some_ of the people working on this would have. Not that a degree confers magical powers, but any CS education will go over what's known to be impossible.

[1] ... by static checks via type system, termination checker and restricting access to "unsafe" modules/libraries. Of course it's doubtful how many extension authors would be able/willing to write their extensions in e.g. Idris.

</comment><comment><USER3> ...about halfway through that article I remembered how he'd said "lucky you," and understood it.

Wow.

I suddenly understand why Firefox isn't the dominant browser anymore. Mozilla hasn't adapted to being the competition. At all. They've, like, spazzed out and are pitifully flailing their arms around as they die. Not a particularly endearing way to go.

What a strange new world we now live in. Blink is now the future of the Web, Webkit is where you'll find occasional snippets of "oh, cute" when OS X updates, EdgeHTML takes over from Presto as the leading closed-source competitor, and Vivaldi trails everyone else as a source of "wat."

I wonder where Cargo will end up. It's a pretty weird sprawling mass as it is right now.

For anyone out there interested in the browser scene (and non-bureaucratic, non-toxic development environments!), I definitely have to recommend [http://netsurf-browser.org/](http://netsurf-browser.org/) \- checking the site, I see they just got a JS engine properly integrated, and it looks like they've finally started major work getting the rendering engine up to scratch to handle dynamic page changes (once the page was in the canvas it used to be unmodifiable).

</comment><comment><USER4> The thing that stands out to me in the discussions on the Mozilla mailing list is how Mozilla is changing the goals of extension signing after the fact. It was initially presented as a method of combatting malware but with the back and forth over Zotero they now seem to be expanding the scope to include add- ons with performance problems, addons with code that is hard to read, addons with code that touch powerful API's unnecessarily. That's opening up a whole lot of grey area for their volunteer reviewers to wade into. In hindsight, I also wonder if they shouldn't have just waited for XUL addons to be phased out since the screening process for the more limited WebExtensions API should be easier.</comment>