DeepMind in "very early stage" talks with National Grid to reduce UK energy use - <AUTHOR> https://arstechnica.co.uk/information-technology/2017/03/deepmind-national-grid-machine-learning/ <comment><USER2> The DeepMind datacenter project was very interesting, but a lot of the ML people I spoke to were quite dubious about how much of it was genuinely down to new AI/neural networks, and how much of it was Google PR to justify how much they spent on DeepMind.

> DeepMind trained a neural network to more accurately predict future cooling > requirements, in turn reducing the power usage of the cooling system by 40 > percent.

But when you look at the DeepMind blog post ([https://deepmind.com/blog/deepmind-ai-reduces-google-data- ce...](https://deepmind.com/blog/deepmind-ai-reduces-google-data-centre- cooling-bill-40/)), it looks like the 40% model is comparing to a baseline of doing nothing. So the question is : is this really something you require an AI research powerhouse like DeepMind for, or is it something a regular data science team could do?

<comment><USER3> I was going to say, I feel like this could be done with excel and some historical data combined with weather forecasting.

that being said, even if ML gets you a 0.5% advantage over spreadsheet math, that is a non-trivial amount of savings on a national scale.

<comment><USER4> What I'm wondering is why I can't find anything about ML applied to finding and curating data, which is the most tedious part of data science. That would be an interesting way of using ML without fuzzy stuff.

<comment><USER5> There are a few current projects, particularly in database research. I don't know how many of them use ML in the traditional understanding. Current projects I know of are Wrangler, Mimir, Katara, MayBMS (in no particular order).

<comment><USER4> Did you try any of them. Wrangler seems like a tool similar to OpenRefine to me.

</comment></comment></comment></comment></comment><comment><USER6> Heh. If only they mandate to replace a majority of the crappy wooden + single- pane windows they have in most houses, that let all of the heat out and wind and noise in, with normal, double-glaze windows with good insulation, they would cut the energy footprint in HALF, I'm sure...

<comment><USER7> >crappy wooden

I'm not sure where you got the gripe against wood from. It lasts longer than uPVC given maintenance every 5 years, looks better, is more environmentally friendly and has similar thermal properties. Oh and it doesn't go yellow.

<comment><USER6> Nothing against wood, really. But if you've been to the UK, you should agree that the unmaintained, not-properly-fitted, wooden frames that they use in most old windows are just crap. They let in huge amounts of wind, cold, etc, through the unsealed seams. Anything that improved that would be 10 times better, regardless of the yellowing, etc.

<comment> grey-area Most wooden sash (I assume you're talking about wooden sash) were properly fitted at the time, but are victorian or edwardian and therefore over 100 years old. They've done pretty well considering their heritage. New wooden sash with double glazing are better IMO than plastic windows - as the parent noted, plastic doesn't do well long term when exposed to light.

<comment><USER6> So then, we all agree that the old (ancient) and unmaintained wood frames in the UK are crap. Cool! :)

Really, I couldn't care less if they replaced the frames with wood or whatever, as long as they made sure that they were thermally good and avoid wasting all of the heat...

<comment> grey-area No.

</comment></comment></comment></comment></comment></comment><comment><USER7> On a similar note, for anyone that hasn't seen it you can get live grid metrics from [http://www.gridwatch.templar.co.uk/](http://www.gridwatch.templar.co.uk/).

<comment><USER8> what is this, a website for ants? It needs to be at least twice as big!

Seriously thought, that's quite an unreadable interface.

<comment><USER9> It looks great on a 22 inch screen, and likely even better on a nice 50 inch monitor - but on a normal laptop screen it is indeed nuts.

</comment></comment></comment><comment><USER10> There's a huge conspiracy theory brewing about the mandatory rollout of smart meters. They're going to absolutely freak out when they learn that Google's Deep Mind will be watching them.

</comment><comment><USER11> I like these guys who are already running a "virtual power station" which can smooth out the peaks by switching off non-vital power loads:

[http://www.openenergi.com/](http://www.openenergi.com/)

With Machine Learning, natch: [http://www.openenergi.com/virtual-power- station-with-big-dat...](http://www.openenergi.com/virtual-power-station-with- big-data/)

</comment><comment><USER12> This title misses the following words; "suggests they can", "proposes to", or my personal favourite "something something ai solves all your problems"

come on folks, we can be better than this.

<comment><USER13> We added "very early stage" to the title since that's what the National Grid is quoted as saying in the (you're right, extremely frothy) article.

</comment></comment><comment><USER14> I doubt this will use deep learning though. DL works best at detecting patterns in large quantities of data, whereas the time series data here is limited to just a few years...and the system has changed over those year, and continues to change significantly. I'd guess that 10% is the cost of ensuring supply, i.e. spinning up generators as contingency - any attempt to shave saving from that may increase risk of power outages. Doing so while maintaining the same power outage risk is the goal here, but I think it would be hard to prove that some new clever strategy has the same risk levels. In this respect 10% sounds ambitious to me.

<comment><USER15> I know a couple people working on using deep learning for financial timeseries. It can be beneficial even with relatively limited data (a couple of years with high granularity).

I also think the 10% figure is quite ambitious; especially given that they are at an early stage of negotiations.

<comment><USER16> It might be reducing transmission losses by 10%.

Ie. trying to prefer supply near users to reduce losses in long transmission cables.

The whole thing seems rather tricky though, because the entire grid right now is run on a market based approach, where suppliers and users bid for the right to sell/use power every half hour. The ML in that case would have to be given to every company to make smarter bids.

<comment><USER17> And reducing the use of standby gensets which is very expensive not to mention polluting

</comment></comment></comment></comment><comment><USER18> Predicting peaks in supply and demand for energy is essentially turning the utility into a hedge fund.

I think it's worth considering the overall characteristics of the "improved" algorithm, since the ML optimizations are likely analogous to leveraging based on an overfitted predictive model, and the objective of a power grid is resilience as well as efficiency.

Also, depending on how you define efficiency, it may be considered beneficial to shut down a coal plant and spin up a few hundred windmills, even if the resulting price per kilowatt hour increases by 5%.

<comment><USER19> I work in the industry and we've been "predicting peaks in supply and demand for energy" for years.

You're 100% correct about the "resilience" and "efficiency" part, and we currently have software for that as well (Google "Real-Time Contingency Analysis"), but the real improvements to be made in this area would be things that generally fall under the "smart grid" buzzword. The ability to automatically switch transmission lines in and out of service during an emergency event, better and/or automatic control frequency and voltage (which we do have currently, but could be further automated), and reaction/recovery/restoration after a relay incident (for example, an automatic "Blackstart" after a voltage collapse) would all fall under the kind of improvements needed to push electric grid technologies to the next level, in my opinion.

<comment><USER18> Very interesting! Thanks for the clarification. Would you say that the ML/AI aspect is "easy" once the automation is built? Or does the automation offer limited value without fairly sophisticated algorithms?

</comment></comment></comment><comment><USER20> I don't want to give any hint to the DeepMind, since I an inclined to think that in this field an expert assessment can be better that DeepMind advice. Just to give a simple question or example of the kind of knowledge involved in those predictions: Since energy generation and demand depends a lot of weather conditions, do they have any state of the art machine learning model to forecasting weather conditions?, can they predict the evolution of energy prices?, can they measure the impact of new improvement in reducing the cost in renewable energy, what about the impact of the brexit in the energy market?, are they first class experts in times series or are they simple to apply current technologies like profet or Hyndman's R package for ts. How can they defend that technologies applied at go game like reinforcement learning can be successfully applied to forecasting? Perfect games simulations allow you to get almost infinite data, current world market and weather has only very limited amount of information to be supplied for a model, how can they justify the application of big data techniques to a small available data world. I hope that some of those questions can be addressed, unfortunately while writing this I haven't read the post yet.

<comment><USER21> Reinforcement learning is used in spam detection and control amongst other things. You can do data augmentation and also do transfer learning.

<comment><USER20> In this concrete case, how do you do transfer learning? what is the domain you have experience to transfer to the energy of energy? Also, Bayes's naive algorithm can be used in spam detection and usually it gives good results, is RL such a great tool in spam filtering when there is moderate data?

</comment></comment></comment><comment><USER22> If you're in Cambridge (UK), Demis Hassabis (CEO of DeepMind) will be giving a talk to CSAR as part of the Cambridge Science Festival at 7:30 this evening: [http://www.sciencefestival.cam.ac.uk/events/towards- general-...](http://www.sciencefestival.cam.ac.uk/events/towards-general- artificial-intelligence)

</comment><comment><USER23> This is about prediction of supply. In other words, becoming a weather forecasting organization, mainly wind and clouds/shadow.

Demand is predictable so little to gain there.

How big is the market of providing excess demand? If I can turn on the AC or charge electric cars in the millions, what can I earn as a company?

</comment><comment><USER24> I don't know much about electric grid engineering - are there opportunities for a ML approach to increase efficiency in ways other than the sort of better supply forecasting implied by this article.

The article does mention the losses involved in long distance transmission, but surely traditional approaches can already yield fairly well optimised planning for improving this sort of efficiency?

(Finally, this article seems quite light on details to me & doesn't mention a source Google press release or anything like that with more specifics. Maybe just better supply forecasting could yield bigger benefits that I imagine...)

<comment><USER25> DM is far from the first company to provide ML solutions to revolutionize utilities.

There are so many opportunities to increase the efficiency of our electric networks. Forecasting demand is not something they do well, but more importantly they could improve Demand Response and Energy Efficiency programs. Oh, and most of the techniques they use to prevent and stop theft are a joke (that's a $6B/yr problem in the US).

The utilities have not been forced to innovate. They won't innovate on their own because there are no customers at risk - no competition. (Aside from smart meters and the main benefit from that was that they no longer had to pay for meter readers.)

There is a WORLD of opportunity for utilities to become more efficient, but they will not do it on their own. Our regulators need to force them to innovate.

Kudos to DM for this work, but I will be more impressed if they can actually get a major utility to implement these solutions.

<comment><USER19> "Forecasting demand is not something they do well, but more importantly they could improve Demand Response and Energy Efficiency programs."

\- Source?

"The utilities have not been forced to innovate. They won't innovate on their own because there are no customers at risk - no competition."

\- Also, what data can you provide to back this up? I work in the industry, and I can tell you that innovation will depend largely on the type of energy market that the utility operates in, whether or not they are a vertically integrated company, regulated or unregulated, IOU or POU, as well as a ton of other variables. So while maybe its true that not every single company is innovating, to generally say that they "won't innovate" or that there is "no competition" is simply wrong as well as spreading incorrect information about the industry.

I'd check out this is you're interested in learning more about the utility industry: [https://www.osti.gov/scitech/biblio/15001013](https://www.osti.gov/scitech/biblio/15001013)

</comment></comment></comment><comment><USER26> "We think there's no reason why you can't think of a whole national grid of a country in the same way as you can the data centres." means that you haven't thought about it at all.

A grid has all sorts of actors involved, a whole bunch of whom are there purely to make money (manage risk, gamble... tom-a-to/tom-ar-to) - bolting an AI onto a complex system and then letting people !#$!@# with it to get their hedge contracts into the money is practically a guaranteed scenario.

</comment><comment><USER27> Or run some TV ads telling people to turn their heat down and hang up their laundry..

</comment><comment><USER28> What is 'UK energy use'? The title should tell what the article is about.

<comment><USER11> It refers to the generation of electricity. "National Grid" implies that, since that is the name of the system of wires that carries electricity throughout the UK. But only if you have the necessary context.

</comment></comment><comment><USER29> I interned at Numenta [0] in 2012. Numenta is building an open-source machine intelligence product [1] based on the human brain. Specifically, the algorithms are based on the theory of "hierarchical temporal memory" (HTM) [2] as described by Numenta founder Jeff Hawkins [3] in his book _On Intelligence_ [4]. The basic idea is that the neocortex has a generalized learning framework that acts on generalized input from all five senses. For example, one study enabled blind people to "see" a ball in front of them and grasp it with their hands, by encoding the image of the ball onto electrical impulses on taste buds, using a device in contact with the tongue. I can't find a link to the original study, but here's an article that describes one such device. [5] The conclusion drawn from this is that, even though blind people have lost their sight, their neocortex is able to understand inputs from _any_ sensory source (in this case, tastebuds). The Numenta algorithms generalize this idea to feed time series data into a virtual "neocortex" that builds custom ML models for each data source and chooses the best one (a form of online learning that eliminates the need for data scientists to create custom models for each data source).

Because the Numenta algorithms are optimized for time-series data, their areas of strength are prediction and anomaly detection. When I worked there (5 years ago, they've made a lot of progress since then), one of their main "case studies" was energy usage in large buildings. Jeff Hawkins gave the keynote presentation at Strangeloop 2012 where he discussed this specific application of the algorithms, lowering energy bills in factories by predicting the next day's usage in advance. [6]

My understanding is that the algorithms worked particularly well for energy consumption data (e.g. energy drops at night on weekdays, drops on weekends, spikes in meeting room X at 10-11am every day, etc). I would not be surprised at all if DeepMind is able to capture savings using similar methods.

[0] [https://www.numenta.com/](https://www.numenta.com/)

[1] [https://www.numenta.org/](https://www.numenta.org/)

[2] [https://en.wikipedia.org/wiki/Hierarchical_temporal_memory](https://en.wikipedia.org/wiki/Hierarchical_temporal_memory)

[3] [https://en.wikipedia.org/wiki/Jeff_Hawkins](https://en.wikipedia.org/wiki/Jeff_Hawkins)

[4] [https://en.wikipedia.org/wiki/On_Intelligence](https://en.wikipedia.org/wiki/On_Intelligence)

[5] [http://www.theplaidzebra.com/device-allows-blind-people- see-...](http://www.theplaidzebra.com/device-allows-blind-people-see-tongues/)

[6] [https://www.numenta.com/blog/2012/10/22/jeff-hawkins-at- stra...](https://www.numenta.com/blog/2012/10/22/jeff-hawkins-at-strange- loop/) (link to video at bottom of blogpost). You need to login to download the PDF slides, so I made an imgur album of the relevant slides to this discussion: [https://imgur.com/a/5ULak](https://imgur.com/a/5ULak)

<comment><USER30> You're aware that numenta is considered a joke in the serious machine learning community, right?

<comment><USER29> Yes, and quite unjustifiably so in my opinion, which is why I sourced all those links in my comment. From what I've seen, Numenta is very good at a specific class of problems (time series prediction and anomaly detection).

Feel free to underestimate them. It's really not my problem.

And do pompous, abrasive comments like yours really add anything to the discussion? Why don't you elaborate on why they are a "joke" to serious intellectuals like yourself.

<comment><USER30> Because they continously claim they're "ahead of everyone" and how everyone else is stupid and their glorious htm will beat everyone....and then proceeds to get destroyed by convnets...and then moves the goalposts to anomaly detection only...and then gets beaten on their own heavily rigged benchmark dataset.

</comment></comment></comment></comment><comment><USER31> Honestly, why is this news? :)

</comment><comment><USER32> On the photo #4 you can see a man pointing a pretty insecure computer, windows xp :) Should Not be used xp anymore because there is no more security updates or I'm wrong?

The direct link of the image is: [https://cdn.arstechnica.net/wp- content/uploads/sites/3/2017/...](https://cdn.arstechnica.net/wp- content/uploads/sites/3/2017/03/National-Grid-workers-in-the-control- room_highres-980x653.jpg)

<comment><USER33> The image has been used in a number of articles, the oldest of which I was able to find was from 2013 - I would assume the image is older than that even.

</comment></comment><comment><USER34> They will reduce energy usage by 10% and then raise prices because they aren't making enough money. It's happened in Canada with Ontario hydro, and in California with water.</comment>


Energy cost of 'mining' Bitcoin more than twice that of copper or gold - <AUTHOR> https://medium.com/bexpro/energy-cost-of-mining-bitcoin-more-than-twice-that-of-copper-or-gold-e3fa8f9c9f95 <comment><USER2> Indeed, I've always felt that the increase in difficulty of hashing in bitcoin was too fast. This translatesmdirectly in the energy cost. U fortunately there is no way to back up, only to freeze this increase for a long time...</comment>


Debian or Ubuntu for server? - <AUTHOR>

<comment><USER2> I've been using Debian stable as a server for the past 8 years. The stability has been top-notch and I actually prefer having a distro that doesn't update very often. The less time I can spend updating a server the more time I can spend delivering value to my customers.

<comment><AUTHOR> Your not the only one, I've heard very good things about Debian as well.

</comment></comment><comment><USER3> Debian or Ubuntu LTS releases are fine. Avoid the usual Ubuntu releases, as their lifecycle is too damned short. Likewise for Fedora (if you like Red Hat based free systems, CentOS will do).

I wrote an article about this based on my experience with thousands of Webmin/Virtualmin/Usermin users:

<http://www.obsceneart.com/?p=30>

<comment><AUTHOR> Thanks man this article should be very helpful!

</comment></comment><comment><USER4> All linuses are supposed to be rock-solid on a server. I went with Ubuntu because I figured it's not going away any time soon and because there seem to be more documentation available online.

We've been running 6.06 TLS with no problems for almost a year and just recently we moved our staging/production to 7.04 and we (as expected) are seeing no difference. We compiled apache and all libs we needed from source and never used apt-get for anything.

Besides, is it really important? IMO production server is just that: a production environment. You set it up just once and you're not supposed to mess around alot.

<comment><USER3> "IMO production server is just that: a production environment. You set it up just once and you're not supposed to mess around alot."

That's why you should have stuck with LTS. 7.04 will likely be EOL'ed in the next few months (unless they branch another LTS version of it), and then you'll be forced to upgrade under duress. Long life cycle is probably single most important factor in choosing a good server distribution, because "you're not supposed to mess around alot".

<comment><USER4> Correction: I wanted to say staging/testing instead of staging/production. Production is runnin on 6.06

<comment><USER3> That's wise. When they do an LTS version, then bumping to 7.x is sane. ;-)

</comment></comment></comment></comment><comment><AUTHOR> Hi guys I'm about to configure a VPS for my web app(for testing and learning purposes plus it's my first time to launch a site in my life much less configure a webserver.) And upon recommendation of my webhost(a2b2) Debian and Ubuntu would be the best choice as I only have a small VPS to begin with. So what do YCers think? which should I choose?

<comment><USER5> Go with Debian stable. It's rock-solid.

I've done very poorly with Ubuntu. I've tried installing it twice. The first time, it installed successfully but then when I rebooted it trashed my RAID configuration and dropped into single-user mode. The second time, which was last week, the installer kept hanging in bizarre places. The whole distribution just seems to be geared toward very simple hardware configurations and chokes at the slightest violation of its expectations.

Also consider a BSD, though.

<comment><AUTHOR> Thanks for the response I'm definitely leaning on Debian...

</comment></comment></comment><comment><USER6> I'd recommend a distro designed for server use, like CentOS. You'll find its packages are a little out of date because they are well tested and known to be stable. The default install is hardened and security updates are prompt. Also automatic updates are pre-configured and just need to be enabled.

<comment><USER7> I will second CentOS... it's solid.

<comment><USER8> What are you using on your workstation? If you are using Ubuntu on your desktop, I would deploy Ubuntu on the server also. This allows you to combine your desktop and testing machines into one. Then, you only need a dedicated staging (virtual) machine and the production machine.

Otherwise, I also recommend CentOS, especially if your hosting provider lets you run it with SELinux enabled.

<comment><USER9> CentOS is a very common distro for rails production environments. Several high profile hosting cos use it, like RailsMachine for example. Hard to go wrong with CentOS.

</comment></comment></comment></comment><comment><USER10> Initially I used Debian's "testing" release. With PostgreSQL 8.1 now in stable, I recently switched to "stable". I develop on an Ubuntu notebook and have never had any nasty surprises deploying from development to production.

<comment><USER11> I've been running Debian on a VPS for about two years and the ease of maintenance and overall sensible default security policies make it a great server OS. I'll always go for an OS where my default system is well-tested, stable, and trivial to maintain. I can then spend some time manually installing the latest versions of the two apps (web server and db) whose latest features I may need.

It seems to me that Ubuntu is pretty much like Debian with a more shorter upgrade cycle. Is that impression accurate? Also, does Ubuntu have any extra overhead that a Debian system might not have?

<comment><USER10> AFAICT the only extra overhead with Ubuntu is that there are more desktop- oriented packages installed by default. Yes, the upgrade cycle is shorter than debian stable, but it's longer than debian testing. It doesn't sound to me like you'd have any reason to switch your server from debian to Ubuntu.

</comment></comment></comment><comment><USER12> For the server use debian if you are going to use the server for anything serious, for your desktop you could use ubuntu. There is no reason IMHO that you would want to use ubuntu on a production server.

</comment><comment><USER13> fedora 7 FTW!</comment>


Adobe to remove Flash Player from web site after December 2020 - <AUTHOR> https://www.adobe.com/products/flashplayer/end-of-life.html <comment><USER2> All: Note that this thread has lots more comments than appear on this page. Click 'More' at the bottom to see the rest.

</comment><comment> j-james Newgrounds has done a lot of work on preserving old Flash content. Some standouts are their own Flash player and an SWF to MP4 converter, but what I find most interesting is Ruffle.

Ruffle is a Flash emulator written in Rust that can be used as a browser extension, a desktop client, or a website polyfill. It's still a work in progress, but eventually websites with heavy use of Flash content (like many late-2000s webcomics, or even Newgrounds itself) could use the polyfill to replace Flash content with WASM blobs.

The roadmap was updated recently, and provides a good overview of Ruffle's current capabilities. There's also a demo instance that can run arbitary SWFs, with a few examples available.

[https://www.newgrounds.com/flash/player](https://www.newgrounds.com/flash/player)

[https://github.com/Herschel/Swivel](https://github.com/Herschel/Swivel)

[https://github.com/ruffle-rs/ruffle](https://github.com/ruffle-rs/ruffle)

Roadmap: [https://github.com/ruffle- rs/ruffle/wiki/Roadmap](https://github.com/ruffle-rs/ruffle/wiki/Roadmap)

Demo: [http://ruffle-rs.s3-website-us- west-1.amazonaws.com/builds/w...](http://ruffle-rs.s3-website-us- west-1.amazonaws.com/builds/web-demo/index.html?file=synj1.swf)

<comment><USER3> I don't really understand why this isn't the migration path for any legacy tech... Just containerize and emulate it. If there is a security problem, it's only inside your container. No big deal.

<comment><USER4> Because re-implementing Flash is an _enormous_ amount of work. Back when Flash was popular there were numerous attempts to reimplement it for use on Linux. None of them really got beyond the proof of concept stage.

Based on that I'm pretty skeptical that Ruffle will succeed, although I guess it does have the huge advantage that Flash is no longer a moving target and they really only have to get it to work with existing Flash movies - nobody is creating new ones.

<comment><USER5> As far as I remember it was difficult to re-implement because the Flash player was backwards compatible with all Flash versions. And this was also why there were so many security issues.

<comment><USER6> I believe it was mainly legal issues that the community, with their obsession with the purity of open-source, didn't want to accept contributions from those who had done any RE'ing of the official implementation.

The SWF format itself is tiny in comparison to the web standards like HTML, JS, or CSS.

<comment><USER7> I spent a bit of time trying to figure out why previous reimplementation efforts didn't get anywhere. Here's where they get stuck

swf format: 100% implemented

Tamarind AS3 VM: Open sourced by adobe.

AS1, AS2, AS3: Not technically 100% but effectively so

Flash platform API: Enormous and bug ridden, like mapping the coastline of finland. you can get 90% through this and have 90% to go, over and over again for however many decades you care to work on it. It's not like the stuff here is _hard_ , it's just the sheer quantity of stuff, like, for instance, the precise way that XML whitespace gets parsed by the XML parser into a DOM matters. The gamma interpretation of RGBA colours. And so on.

Flash rendering pipeline: No one has succeeded in figuring out how this works, at all. You can get far enough for strongbad, but for 100% compatibility, the CheerpX approach is the only one that I think has any chance of success.

<comment><USER8> Your reply to this comment is dead for some reason. As a response: I really, really wish Mozilla hadn't abandoned Shumway. I also wish they'd written it as a standalone translator instead of making it depends on Firefox. The worst part is that I've got several flash sites I used to visit that are still around, but now can't be used because even though they worked with Shumway, Shumway itself no longer works with Firefox.

<comment><USER7> I was shadowbanned by dang for expressing disappointment in some HN commenter's defense of coronavirus conspiracy videos. I really wish there were a way to delete my account and all my posts, but this is apparently the best they can do.

also, you may be interested in the openflash project

[https://github.com/open-flash](https://github.com/open-flash)

and the shuobject api

[https://github.com/mozilla/shumway/blob/16451d8836fa85f4b16e...](https://github.com/mozilla/shumway/blob/16451d8836fa85f4b16eeda8b4bda2fa9e2b22b0/extension/shuobject/examples/demo.html)

<comment><USER9> Open-Flash author here. Open-Flash was originally intended to be a fork of Shumway, but it ultimately became a fully separate project intended to provided modular libraries to handle SWF files. I had less time to push the project forward in the last few months.

It currently provides one of the strongest models for parsed SWF files and AVM1 bytecode, and the corresponding parsers and emitters. These libraries are in use to process SWF files automatically (remap identifiers, edit tags, compress files). The end goal was to provide a player, but Ruffle already has relatively good support, so the goal is shifting to automatically convert SWF files to other languages and help with migrations. The current focus is on AVM1 (Actionscript 2) decompilation.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Flash became popular because of 2 things:

1/ Its IDE which made creating creative and interactive content mixing video/vector graphics sounds and code easier

2/ it's API that provided things that were not possible when browsers had none of these API (video streaming, socket programming...). At some point you could even write 2D shaders or inject C/C++ code with something called Alchemy.

Point 2 is now largely covered by browser web API, although one might argue that the performances might not be always as good as they were in flash, especially when it comes to vector graphics or realtime audio processing. But 3D and webgl are more performant than flash in the browser.

Point 1: well there isn't really an equivalent, and even Adobe Animate isn't really doing exactly what flash did when it comes to authoring content for browsers. So there is still a potential market here. I'd like to see something node based when it comes to coding. Artists love their nodes.

The real problem is obviously running old flash content like games. Some of these games were really good. I remember playing one which was a hotel management simulator and it was really really fun. But it's a bit like a these jar games in the 2000' one cannot run on modern mobile phones anymore. Without an effort to preserve these, they will all be lost.

<comment><USER11> > 1/ Its IDE which made creating creative and interactive content mixing > video/vector graphics sounds and code easier

Why is it that with all our computer power, we somehow can't create _authoring tools_ as good as we had in the past?

HyperCard, DreamWeaver, Visual Basic 6, etc. all seem to be _dramatically_ better for common people (read: not career programmers) than any modern equivalent we have.

<comment><USER12> Your common people back then were far more computer-literate than most of career programmers today. Requirements for the entry into profession is so much lower from any point of view: time, difficulty and cost.

Another side is that programming and web is no longer novelty so common people prefer to just pay for someone else for their time rather than learn anything on their own.

Most people prefer to pay their auto mechanic, plumber or electrician even though most of people are capable of fixing many of their problems just by following simple tutorial and common sense. Programming is no different here: it's just easier or more time efficient to pay to someone else.

<comment><USER13> Plus life is so much easier when you don't have to worry about i18n, encryption of any kind, HiDPI displays, Unicode of any sort, really any of dozens of things that modern users expect to just work.

<comment><USER14> Sometimes you had. Timezones, encryption for sensitive places, zillions of European standards (one PER language), and so on.

</comment></comment></comment></comment></comment><comment><USER15> I don't know if everyone here is familiar with this, but the decline of Flash began or was greatly influenced by Apple's decision to not let flash run on iPhones/iPads. Steve Jobs even wrote an open letter about it[1].

[1][https://www.apple.com/hotnews/thoughts-on- flash/](https://www.apple.com/hotnews/thoughts-on-flash/)

<comment><USER16> I think that's rewriting history a bit. The decline certainly didn't begin with Apple's decision. Apple saw where things were headed, and jumped on (an early) bandwagon. Everyone already hated and was avoiding flash at that point. I hope in a few years people don't start saying that Apple killed Flash, as I remember specifically that was not what happened at that time.

<comment><USER17> Sorry, that is precisely what happened.

In the Linux / programming world Flash was a pariah that didn't conform to their standards. But it was booming for creatives and end-users. In 2010, almost all websites used Flash video and Flash gaming was exploding on Facebook. (Apple had to fake their Keynote to demonstrate the iPhone could view the "entire internet.")

Security complaints are a weak argument: both Apple and Google have had security issues on their proprietary platforms. (I'll concede Adobe was a very poor steward.)

Jobs' hit job was a calculated sucker punch, leveraging an exciting new platform to lock out competition. The iPhone wasn't powerful enough to play Flash and made Apple look weak. The iPhone business model depends on consumer lock-down, so making Flash compatible was counter-productive.

<comment><USER18> > _The iPhone wasn 't powerful enough to play Flash…_

No, Flash Lite ran on significantly-less-powerful feature phones. (Remember, in the early days of the iPhone, Flash was desktop-only.[1])

> _Jobs ' hit job was a calculated sucker punch, leveraging an exciting new > platform to lock out competition._

You speak as if Jobs instigated this when in reality, this was a response to Adobe holding Jobs' platforms hostage for a long time, and in many ways. Flash's ongoing instability and inefficiency on MacOS was just the straw that broke the camel's back.

[1] [https://www.wired.com/2010/04/adobe-flash- jobs/](https://www.wired.com/2010/04/adobe-flash-jobs/): _" Flash was designed for the desktop world, for web and large screens, not the user experiences you want to create in these new devices with touch, accelerometers and GPS," Luh said. "It wasn't designed with that in mind at all."_

<comment><USER19> Roughly nothing used Flash Lite, outside of a few weird embedded use cases like the Chumby. Web content was almost exclusively full-on Flash.

<comment><USER18> > _Roughly nothing used Flash Lite, outside of a few weird embedded use cases > like the Chumby._

I recall it a bit differently. By December 2006, Adobe claimed that Flash Lite had shipped on 220 million devices[1].

That was probably the apex, though — by 2010, it was all over.

> _Web content was almost exclusively full-on Flash._

Yes, always IIRC. Flash Lite content wasn't delivered via the web.

[1] [https://en.wikipedia.org/wiki/Adobe_Flash_Lite](https://en.wikipedia.org/wiki/Adobe_Flash_Lite)

<comment><USER20> I remember installing Opera and Flash Lite in my Windows Mobile smartphone and it being able to run Flash content. Was it a sluggish hand warmer? Sure, but then it was a 300 MHz TI OMAP (overclocked, of course!) and at most 128 MB of RAM, probably even less.

<comment><USER18> Interesting! I stand corrected about it not working in mobile browsers, thank you.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Someone please give this memo to Citibank which still uses Flash for their virtual credit card number feature! [1]

[1] [https://www.cardbenefits.citi.com/Products/Virtual- Account-N...](https://www.cardbenefits.citi.com/Products/Virtual-Account- Numbers)

<comment><USER22> I dunno, maybe it's better if no one does. I expect they'd just remove the feature instead of rewriting it.

<comment><USER23> They'll lose me as a customer if they do. I suspect there are lots of other people in the same boat.

<comment><USER24> CapitalOne also offers virtual numbers but only from a browser extension called Eno

<comment><USER23> Good to know, but I fled CapOne a year ago because they stopped supporting OFA and broke Moneydance transaction downloading. And, I hate what their website has become since the acquisition of Ing. Ing was great, I wish they never sold to CapOne.

</comment></comment></comment></comment></comment><comment><USER25> "Adobe will be removing Flash Player download pages from its site and Flash- based content will be blocked from running in Adobe Flash Player after the EOL Date."

This blocking seems really dumb to me. At least throw up a warning. It will cause old web content to be completely inaccessible, throwing away years of human creativity. Most likely there will be some legacy systems somewhere that will then use a hacked version of flash laden with malware because it's the only thing available so some legacy system written by long gone people can be used.

<comment><USER26> I think hacked versions of Flash are statistically more likely to be secure than the official version, though.

Why do you think that the official Flash player would provide a secure environment going forward? It never has, and so without Adobe's active support, I imagine it would get even worse. Official Flash has always been a security nightmare.

<comment><USER27> > I think hacked versions of Flash are statistically more likely to be secure > than the official version, though.

I would think exactly the opposite, primarily because you have no idea who put together that hacked copy. God knows there is already enough malware that pretends to be an update to Adobe Flash.

</comment></comment></comment><comment><USER27> I didn't have Flash on my computer for several years, but I installed it last week. I'm planning to take the GRE, which is being given remotely due to Covid. A proctor watches you through your webcam, which I find this completely creepy, but what can I do?

Anyway, this system apparently requires Flash.

<comment><USER28> What is a GRE ?

<comment><USER29> A Graduate Record Examination; a standardized admission test.

If you hope to be admitted to grad school in the US (and Canada, methinks), the GRE is mandatory at many, if not most, establishments.

<comment><USER30> The tide is starting to change although it is departmental specific. In biology, some of the best departments in the nation are waiving the GRE because wouldn't you know, being able to do high school algebra in a certain amount of time and having a wide nonscientific vocabulary are not good predictors of your ability as a scientist.

<comment><USER31> A more cynical explanation is they're willing to take anyone's money.

<comment><USER27> If that were the case, they'd have to be also seeing fewer applicants, or opening up more spots for students. (Since I'm not familiar with what GP is referring to, I can't say if that's the case, but they would be much better indicators.)

</comment></comment></comment></comment></comment></comment><comment><USER32> I'm still confused by the statement 'Flash-based content will be blocked from running in Adobe Flash Player after the EOL Date.' are they literally going to stop the flash player loading SWF files on the 1st of January?

<comment><USER33> Browsers will prevent from loading all flash content?

They already block flash by default. The next step must be to remove the "run anyway" button and ignore the flash plugin.

</comment></comment><comment><USER34> What are we to do about all the useful tools, pages and games that were either written in or utilized Flash? I realize some of this stuff will be rewritten in HTML5, but what about the things that are not?

How will we preserve all those classic flash games that we wasted our time playing in the early 2000s?

<comment><USER35> _shrug_ Never build a towering edifice on a closed-source, closed-protocol, single-company-owned engine and infrastructure ever again, because there is no solution to this problem?

<comment><USER27> You're right, we should all write software exclusively for Linux, and then only on RISC-V CPUs! :)

<comment> yjftsjthsd-h I mean, you joke, but that would make you immune to this kind of problem.

<comment><USER27> Right, and that's why I phrased it as I did. I agree with the great grandparent, kind of—if you _have_ the ability to use 100% open technologies, you absolutely should, and power to you!

But at the same time, proprietary technologies rules much of our world, back then, now, and likely in the future.

<comment><USER35> The difference between SWF and code written for RISC archtiectures is options. The "single-company-owned" part is what killed SWF.

If there had been multiple SWF engines out there, to a common interpreter protocol, SWF content might have had a better chance of outliving the death of Adobe Flash.

<comment> yjftsjthsd-h That's a fair point. I suppose it's not even guaranteed with FOSS, but open source makes it much easier to not have one company totally control the software/ecosystem, if nothing else because it keeps forking as an option.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Why can't Adobe open source flash? It would be a massive help to people trying to create alternative implementations of flash to keep legacy websites working

<comment><USER37> It was terribly insecure throughout its life. I can only imagine how many more security vulnerabilities would be exposed once it goes open source.

<comment><USER36> Does it really matter now? Pretty sure only nostalgic web users use flash to view old games, clips and such

<comment><USER37> Apparently bank logins, online exams...

</comment></comment></comment></comment><comment><USER38> I have [http://www.vatican.va/various/cappelle/sistina_vr/index.html](http://www.vatican.va/various/cappelle/sistina_vr/index.html) in my bookmarks. A really beautiful depiction of the Sixtine Chapel. But I have no Idea how to load it on a modern OS. I have also no idea if the vatican has plans to update ist for more modern technologies.

There are even more [http://www.vatican.va/various/basiliche/index_en.html](http://www.vatican.va/various/basiliche/index_en.html) if you dig around a little, but I have no clue how to preserve them...

</comment><comment><USER39> Installing Flash used to be one of the very first things I did when configuring a new system. Now? I can't even remember the last time I actually used it.

<comment><USER40> Because it is bundled in with most OSs now. You have it without even realizing it. ... For now ...

</comment></comment><comment><USER41> Is there a standalone player for old flash content? If people wanted to still view old things created in it.

<comment><USER27> Yes, Adobe makes Flash Projector:

• Windows: [https://fpdownload.macromedia.com/pub/flashplayer/updaters/3...](https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flashplayer_32_sa.exe)

• Mac: [https://fpdownload.macromedia.com/pub/flashplayer/updaters/3...](https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flashplayer_32_sa.dmg)

• Linux: [https://fpdownload.macromedia.com/pub/flashplayer/updaters/3...](https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz)

You can just open the swf file you want and run it directly. It's great.

Linux users might alternately want to use the community-packaged Flatpak: [https://flathub.org/apps/details/com.adobe.Flash-Player- Proj...](https://flathub.org/apps/details/com.adobe.Flash-Player-Projector) All other links come from [https://www.adobe.com/support/flashplayer/debug_downloads.ht...](https://www.adobe.com/support/flashplayer/debug_downloads.html)

Kind of stupid that these will also presumably be removed from Adobe's official download page, since this is exactly how Flash content ought to be run going forwards: as individual legacy files you've downloaded and inspected. I would advise downloading and backing up a copy now.

<comment><USER42> This won't work in practice for most Flash games. They're almost all "site- locked", so they refuse to execute anywhere except in a browser on the domain where they came from.

<comment><USER43> I know SWFs can be decompiled -- can they be modified? Can the sitelock code be disabled or altered?

<comment><USER42> Yes, but I don't think it's something that would easily be automated, so every game would have to have its protection reverse engineered by hand.

</comment></comment></comment></comment></comment><comment><USER44> Flash was a dumpster fire of performance and security issues and being a closed platform in direct competition with the web we have today, I won't shed a tear over this.

What will be sorely missed though, are the brilliant authoring tools that Flash came with. For a very short time in history there was one tool that allowed designers and developers to truly collaborate on rich interactive experiences. It was amazing what that unlocked.

</comment><comment><USER45> I don't get it why my Windows 10 installation is still downloading updates for Flash Player. I deselected it in some setting which was to be found somewhere (Windows 10 settings are a horrible maze), but for some reason it still thinks it needs to protect me from this deactivated piece of malware.

</comment><comment><USER46> I think I can speak for millions of security-minded folks: Well, it's about time.

</comment><comment><USER47> This has been a looooooong time coming. Very few websites still use flash.

The only sad thing about it is that it'll become much harder to play thousands of old-school flash games.

<comment><USER48> [https://www.newgrounds.com/flash/player](https://www.newgrounds.com/flash/player)

Newgrounds, at least, will never have its players lose the ability to play its old Flash games.

</comment></comment><comment><USER49> Gosh, I always think the websites in the FLASH era is the most versatile and really have no limitations, just see today's websites, all plain, simple, and boring as hell. Yeah I can understand the vulnerabilities and slowdown of Flash, but it really shines at that golden age! R.I.P

<comment><USER50> It was so simple to create 2D games. Is there some comparable engine/tool nowadays?

<comment><USER49> I am not an expert in the gaming field, but you can check Godot engine for 2D games, people say it is a really amazing tool. Of course you can choose Unity, but many people now prefer Godot for 2D games.

I mean, the Flash maybe not the best option for creating a game, but for Flash website era, I think those weird, funny, and highly interactive websites are really shining at the age, I miss that time!

</comment></comment></comment><comment><USER51> Just to share this archival project:

[https://bluemaxima.org/flashpoint/](https://bluemaxima.org/flashpoint/)

Basically it's a massive bundle of flash (and other plugins) together with a curated list of games and animations. It spawns a local web server to trick the games into "thinking" they are still being run on their original servers (this doesn't work for games that required a multiplayer server obviously, it's only to workaround the common portal exclusivity rights that were common in the golden era of Flash games).

It's really a labor of love and an incredible window into a slice of web history from the early 2000's

</comment><comment><USER52> If it's of such low value that it's being discontinued and all the browser vendors are blocking it; why not open source?

<comment><USER53> Flash evolved into Adobe Animate, which is used today for many television shows:

[https://www.adobe.com/products/animate.html](https://www.adobe.com/products/animate.html)

[https://en.wikipedia.org/wiki/List_of_Flash_animated_televis...](https://en.wikipedia.org/wiki/List_of_Flash_animated_television_series)

Disclaimer: I work for Adobe, but not on Animate.

<comment><USER54> I doubt open sourcing the player would hurt that revenue stream.

</comment></comment></comment><comment><USER55> Flash Player itself has a lot of security vulnerabilities but Adobe Flash as IDE still has no competitor even today IMHO. There is no such tool that combines code and graphics with ease like Adobe Flash. You can use it as an animator, you can use it as graphic designer, you can use it as developer. All these features just came together perfectly and it made sense. I am still missing this usability.

</comment><comment><USER56> The internet would be a lot duller without some of the creativity Flash animations allowed, imagine a world without Cirno's Perfect Math Class.

[https://www.youtube.com/watch?v=V_bQNPG2OyE&](https://www.youtube.com/watch?v=V_bQNPG2OyE&)

</comment><comment><USER57> Good thing Haxe[1] and OpenFl[2] are around and doing well.

[1] - [https://haxe.org/](https://haxe.org/)

[2] - [https://www.openfl.org/](https://www.openfl.org/)

</comment><comment><USER6> In other words, they are implicitly telling us that we should archive their entire site... although I suspect the IA has already done so.

The only thing really bad about Flash was the security, but otherwise it is an extremely efficient vector/animation format that AFAIK none of the "open standards" have managed to come close to. Seeing Flash disappear, only to be replaced by SVG (yuck!), JavaScript, HTML, and CSS, was extremely disturbing.

(I have written a SWF to PDF converter. Parsing the format itself is quite straightforward, I could've probably written most of a player if I went further and added the interactive stuff too.)

<comment><USER58> Security, the fact that it was a closed standard, touchscreen support, battery life... most of the issues brought up by Steve Jobs are still valid: [https://www.apple.com/hotnews/thoughts-on- flash/](https://www.apple.com/hotnews/thoughts-on-flash/)

<comment><USER6> _the fact that it was a closed standard_

The standard has been freely available for over a decade now.

 _touchscreen support_

That's an implementation issue.

 _battery life_

Also an implementation issue. Jobs was talking _only_ about video, but I bet the "instruction path length" from reading a file to rendering a vector graphic is probably an order of magnitude if not more for a browser reading an SVG than Flash reading a SWF.

Those who have played Flash games will likely remember its very acceptable performance on a sub-GHz processor with 128MB of RAM or less. I don't think the HTML5 equivalent in a modern browser would even work on such a system.

That said, it was much better when it was _Macromedia_ Flash, i.e. after Adobe bought it they bloated it greatly (which is where most of the security problems came from.)

</comment></comment></comment><comment><USER59> Kongregate's John Cooney did a flash games postmortem @ GDC which seems appropriate here:

[https://www.youtube.com/watch?v=65crLKNQR0E](https://www.youtube.com/watch?v=65crLKNQR0E)

</comment><comment><USER60> Genuine question: if Flash weren't a security nightmare, would it be a better environment for producing games and dynamic content than what we have today? I've never done anything in Flash.

<comment><USER43> Add-on question: what _do_ we have today? Has anything filled this void?

<comment><USER61> HTML5, the canvas API and all the new browser APIs right after it.

</comment></comment></comment><comment><USER24> I never played any flash games and I never really understood the difference between the flash and shockwave plugins for games, but , I always installed flash because it was a wonderful video player. Before flash video was common most things were quicktime and the quicktime plugin was SLOW.

The other nice thing about flash is unlike quicktime there was a linux version.

Sure, flash is obsolete and unloved now, but it really was better than what came before it.

</comment><comment><USER62> I just came here to say the Flash IDE was the best vector graphics editor I knew and I have not find a replacement. The way the color of two objects was used to determine the boolean operation between them was brilliant. You could add a bezier point by dragging a selection through a surface, you could remove a bezier point by narrowing the surface. The aligning gizmo always worked the way you needed it to work.

</comment><comment><USER63> I wonder how much this will enable another wave of "Adobo Flash Player Browser Toolbar"-like adware since the official source will be removed.

</comment><comment><USER64> Flash is a good candidate for webassembly as target.

Add updated controls for touch, discourage usage of hover, and compile the flash player to web assembly, targeting animations, ads, etc. Then provide a paid cdn for deliveeing content.

I remember using flash a long time ago, and what i loved most is the way you could do complex animations with such little effort.

<comment><USER65> If Adobe could re-release the flash IDE but make it target webassembly, it would probably be a hit if they marketed it right. I don't think there's anything since that has surpassed the flash development experience

</comment></comment><comment><USER66> I won't say it's not about time, but the decision to block the execution of flash content after said date and the removal of the downloads, complicates matters for system administrators.

We have a legacy blade enclosure at the office that needs an old version of flash for configuration, and also our vSphere web interface is flash based.

</comment><comment><USER67> One of my fave Flash animations was a Stick Figure Animation, called "Time to Die."

I don't know if it can still be found anywhere, but it was a riot (and rather bloody).

You would pick which weapon they would "test," and one of the choices would result in a Snake Pliskin-type of character getting loose, and slaughtering everyone.

</comment><comment><USER68> TIL Flash still exists on other platforms.

Flash was dropped around 10 years ago for Linux, and never existed on iOS.

I'd no idea it was still a thing on other platforms.

I do feel bad in that we've lost the ability to run lots of games, but most of them were to trivial to download/redistribute anyway, regrettably. Their fate was kinda already sealed.

</comment><comment><USER69> Welcome news!

This guy is trying to emulate x86 in the browser and run the actual Flash player within that:

[https://medium.com/leaningtech/running-flash-in- webassembly-...](https://medium.com/leaningtech/running-flash-in-webassembly- using-cheerpx-an-update-d500b6fbc44e)

</comment><comment><USER70> Discussion from 2017 when Adobe released the end-of-life information: [https://news.ycombinator.com/item?id=14848786](https://news.ycombinator.com/item?id=14848786) \- "We will stop updating and distributing the Flash Player at the end of 2020"

</comment><comment><USER71> I've got flashbacks to the time when I started creating my first website at a young age in the 2000s. Flash was this unreachable height for me and I just started testing HTML and how the internet even works. Now I'm a full time software engineer and happy on how far the web has gone until today :)

</comment><comment><USER72> Happy Tree Friends, Weebls' Stuff, z0r.de - the internet would be - will be! - different without Flash.

</comment><comment><USER73> I miss Flash. It was fun. The web was fun. We got paid to make stuff move around and come up with crazy image masking animations and just experiment. The product had to go, but sadly, it would have no place in today's much more serious web anyway.

Long live Macromedia and (F)uture Sp(lash) Animator.

</comment><comment><USER74> I hoped to live to the day when Flash is dead, so at least something good has happened in my life (a few years ago already).

Now, looking forward to PDF being abandoned for scientific publication and 'white papers'.

</comment><comment><USER75> I remember around 2007 a tower defense came - desktop tower defense by hand drawn games... I guess that flash version is long gone but did find it nice wish someone would build an html5 version

</comment><comment><USER76> Steve Jobs on Flash 10 years ago:

[https://www.apple.com/hotnews/thoughts-on- flash/](https://www.apple.com/hotnews/thoughts-on-flash/)

</comment><comment><USER77> The little HN reader in me thinks this is great news, but the other part of me is worried because %DAYJOB% is providing support for a product that depends majorly on Adobe Flash (and IE11).

</comment><comment><USER78> It would be nice if Adobe could release some of Flash player as open source, or at least help document the format to help preserve the content that made Adobe so much money in the past.

</comment><comment><USER79> We still don't have an easy way to make Flash-like games that work in the browser across platform.

Shame on Adobe for killing all Macromedia products. Fireworks, Macromedia, and Flash.

<comment><USER80> I still use Fireworks every day. It's the best graphic design tool ever created in my opinion. Everything else has become so complicated. With my Adobe Cloud subscription they still let me download it thankfully, but I'm a little worried that in 5 years, when I upgrade my PC, I'll never be able to install it again.

</comment></comment><comment><USER81> End of an era. I grew up learning how to use Flash and did little animations and even some websites in it. It was a lovely platform for non-programmer types.

</comment><comment><USER82> Probably because no one uses it since most of the world is on Chrome. If G is maintaining the Pepper flash player for free, why would Adobe need to bother.

</comment><comment><USER83> my biggest hope is that government entities stop making training content in flash. the freaking DISA cybersecurity training is in flash for crying out loud

</comment><comment><USER84> Yet, somehow, Flash Player updates are now being distributed through Windows Update (to systems where Flash was never purposefully installed).

</comment><comment><USER85> Looks like we only have a short time left to sit the younger generation down and force them to sit through all of Strong Bad's emails.

</comment><comment><USER86> Don't worry, there will still be thousands of sites hosting flash player update exes just waiting for you to download

</comment><comment><USER87> So, there have been a pile of open source Flash emulation efforts - gnash, Shumway ...

They all seem to get half way then flounder.

What's up with that?

</comment><comment><USER27> So, while it's still easily available, are there any particular flash games or content I should check out?

</comment><comment><USER88> Interestingly clicking on the link in Safari prompts a "Would you like to use Flash?" user dialog...

</comment><comment><USER89> I feel like I'm going to make a a VirtualBox image dedicated purely for Flash viewing.

</comment><comment><USER90> Does this mean we won't be able to access zombo.com anymore ?

Truly an end of an era :(

<comment><USER91> Welcome to HTML5 Zombo Com! The only limit is yourself. [https://html5zombo.com/](https://html5zombo.com/)

</comment></comment><comment><USER92> Adobe announced it in _2017_.

That's how it's done, Apple.

</comment><comment><USER93> Wait... this didn't happen like 5 years ago?

</comment><comment><USER94> It's time to go lol

</comment><comment><USER95> why did Adobe not open source core flash technology?

</comment><comment><USER96> RIP

</comment><comment><USER97> Good news

</comment><comment><USER98> Don't let the door hit you in the ass on the way out

</comment><comment><USER99> This was announced in 2017. It's already removed from all browsers already.

<comment><USER100> Still works fine for me in Chrome 83.

<comment><USER101> Apparently it's being removed in January 2021.

[https://www.chromium.org/flash-roadmap#TOC-Flash-Support- Rem...](https://www.chromium.org/flash-roadmap#TOC-Flash-Support-Removed-from- Chromium-Target:-Chrome-88---Jan-2021-)</comment></comment></comment>


Hero – A handy, fast and powerful Go template engine - <AUTHOR> https://github.com/shiyanhui/hero <comment><USER2> I've seen a few articles from Golang users saying that, after trying to fight the standard library in many ways, they just end up using it since they realise it's the best balance between usable and extensible. Taking how great the Golang templating engine is, I'm not sure this is a step forward.

<comment><USER3> I don't like Go Templates. My issue is that you can't have small calculations easily. You'd have to add a lot of helper functions or prepare everything before passing to template engine. Now there is too much coupling. And not that fun. This one allowing inline Go code solves that issue.

Disclaimer: I wrote a template engine ([https://github.com/eknkc/amber](https://github.com/eknkc/amber)) to make this easier (and I like that Jade syntax)

<comment><USER4> I always considered the actual template to be the presentation layer relative to the templating context. Having worked on large scale applications it has become apparent to me that performing business logic in the presentation is not the way to go. In my opinion, a templating application should be architectured in such way that your data is transformed to exactly how you want it to be presented prior to it getting to the presentation layer. Up in presentation, you should really only have to worry about checking if a condition is true or false or iterating a collection. From what I have seen of Golang, some (not all) design decisions seem to have been made to make it difficult to make such mistakes easily, so I would not be surprised if making it difficult to do logic in the template was a conscious decision.

<comment><USER3> While I agree in theory, I can't stand that in practice :).

For example, let's say I want to show a usage stat, I'd pass something like { usage: 100, limit: 1000 } to the template engine. Let's say I want to add a percentage. I believe the calculation should be on the presentation layer. That's how I decide to present this particular data.

Go templates lack that functionality for no good reason. And if I'm gonna calculate that on the backend, why exactly am I using a template engine? I'd concatenate strings.

<comment><USER5> Actually you can do function calls on Go templates [1], and indeed this is what is done in practice. Libraries got written to do this, and badly integrated [2].

You will quickly find if you use this that it's in fact worse: go templates have LISP syntax. A set of atoms, specified in reverse Polish notation, doing function application to all but the first atom.

[1] [https://golang.org/pkg/text/template/#Template.Funcs](https://golang.org/pkg/text/template/#Template.Funcs)

[2] [https://github.com/Masterminds/sprig](https://github.com/Masterminds/sprig)

<comment><USER3> Yeah this is the reason I went ahead and wrote the template engine I mentioned in the parent comment. It compiles down to go templates. I inject generic math functions [1] and convert an expression like 4 + 5 * 3 to go template function calls. It's ugly but the compiler generates it so whatever :)

[1] [https://github.com/eknkc/amber/blob/master/runtime.go](https://github.com/eknkc/amber/blob/master/runtime.go)

</comment></comment></comment></comment></comment></comment><comment><USER6> Another day, another string-based template engine that will lead to invalid output and injection attacks. You don't need a new language specifically for templates, you need to use a real programming language with real data structures that represent the HTML/XML nodes.

[http://www.more-magic.net/posts/structurally-fixing- injectio...](http://www.more-magic.net/posts/structurally-fixing-injection- bugs.html)

</comment><comment><USER7> Is template parsing a major bottleneck ?

What I know, most web apps need template parsing only at the beginning. Once initial startup is done, delivery of content is mostly constant.

<comment><USER8> It shouldn't be. I prefer template engines that I like the syntax and documentation the most.

For low traffic efficacy doesn't matter, for high traffic you should always cache the templates.

<comment><USER9> Ideally, a template should be compiled into native code.

<comment><USER10> Not necessarily.

1\. that requires parsing the template at compile-time (making it non- overridable at runtime) or the ability to generate executable code at runtime which break in NX-mandatory environment (e.g. appstore applications)

2\. the runtime version may be much faster than the compile-time one, e.g. the rust Regex crate has both a runtime Regex structure and a regex! compiler plugin, the latter is currently _significantly slower at runtime_ : [https://github.com/rust-lang/regex#usage-regex-compiler- plug...](https://github.com/rust-lang/regex#usage-regex-compiler-plugin)

<comment><USER9> Yes, "compile/load/execute" can take longer than simply "eval". You have to consider amortized costs: how often do you need to recompile your template (or your regex)? Likewise, are you really going to override the template at runtime or is the variable part of the template already compiled as branches in the resulting code? Whatever needs to be dynamic _can_ be dynamic while compiling as much as possible ahead of time.

</comment></comment></comment></comment></comment><comment><USER11> Pretty slick.

It's unfortunate the post title was "fastest go template engine" since that draws away from how different the API is from the standard lib (think ERB/EJS v Mustache).

While I'm personally in the "logicless" camp, I know a lot of people who'd appreciate this. Even I would when building something quick and dirty.

</comment><comment><USER12> Emacs users, I've just added compatibility to web-mode.el (see [http://web- mode.org](http://web-mode.org)) Screenshot: [http://imgur.com/rlb2VWB](http://imgur.com/rlb2VWB)

<comment><USER13> Thank you! Web-mode is a lovely package.

</comment></comment><comment><USER14> I don't see a single positive comment on here.

Sorry, OP.

Nice work on your plugin and impressive benchmark statistics!

</comment><comment><USER15> Template parsing doesnt need to be super duper fast. Most of the time you can cache the whole result.

I think its more important, to choose a good template language thats easy, and doesnt mix code with template content.

<comment><AUTHOR> Hero aims to be easy of use and fast.

</comment></comment><comment><USER16> Would love to see this adopted by Hugo. The default templating engine is ugly as hell.

</comment><comment><USER17> Not escaping by default seems like a misfeature.

<comment><USER10> According to the readme it seems to be escaping by default, kinda: <%= is escaped and <%== is raw output.

So while the raw version is a bit too easy for my tastes (and the first to be listed) the escaped version is still easier/shorter than raw.

</comment></comment><comment><USER18> I'm for templating solutions that don't use a DSL or .html files, like this one[1] I was developing but failed to put up in comparison with the others in the goTemplateBenchmark repo.

[1]: [https://github.com/fiatjaf/hyperscript- go](https://github.com/fiatjaf/hyperscript-go)

</comment><comment><USER19> The benchmarks in the README show a whole lot of templating engines, but weirdly omit the standard library module: [https://golang.org/pkg/text/template](https://golang.org/pkg/text/template)

That's more than enough to raise my eyebrow.

<comment><AUTHOR> "Golang" is the standard library. And the code is here [https://github.com/SlinSo/goTemplateBenchmark/tree/master/go](https://github.com/SlinSo/goTemplateBenchmark/tree/master/go).

<comment><USER19> Huh, how could I miss this? (Maybe because the "G" looks too much like "C", so I scanned "Co..." and skipped that entry.)

</comment></comment></comment><comment><USER20> The benchmarks look good but if you're that abstracted from HTML I'd rather just go all the way; something Jade-like takes this from being a half measure to a full commitment.

</comment><comment><USER21> Is that an ASP.NET / JSP ported in Go?

</comment><comment><USER22> Adding a whole dependency to shave a few milliseconds off serve times (at most) seems like a bad deal to me.

All the usual bad stuff that comes with dependencies: will it be maintained? Will it have breaking changes? Will it leftpad?

And everyone knows the standard library template format, all the editors support it, if another coder joins the team they'll know it.

Meh, maybe I'm just not the target market for this...

<comment> grey-area These are not even milliseconds, the charts are in microseconds and a reduction of 40 to < 10 µs... so basically just noise when compared with the other things most apps will be doing, a 0.04 ms reduction.

I agree it's not worth the focus on fast, they should be focussed on improving the API for the stdlib templates (for example loading templates is not obvious, what I'd like to do is point it at a directory and load all templates under that dir, being able to set layouts and partials would be nice etc). Speed is not a big problem with the existing templating.

<comment><AUTHOR> It's not noise. The benchmark's result is stable. Maybe the benchmark is too simple. In production the templates are more complex than the benchmarks, so the speed does count! But that doesn't mean that the easy-of-use is not important. I want Hero to be fast, and easy of use too.

<comment> grey-area It's very hard to benchmark things which are that fast, and very easy to make mistakes (for example optimising away the thing you think you are measuring because your benchmark does no real work with it and the compiler notices). So on this homepage you have two benchmarks, which give these stats for stdlib:

Time: ~0.04ms

Memory usage: 2Kb

There is no context here and just a link to another benchmark which most aren't going to bother to read. If your selling point is that you're the fastest, you need to tell people why that's important, and what exactly is faster. These graphs give zero details on the work done, and the timings/memory usage suggest trivial work is done in the benchmark, which means it's likely to be wrong. Is it measuring loading or evaluating or both at once? How many templates, what is in them? Are they properly evaluated with lots of keys in them? Do they test functions, methods, built-in functions?

If you're interested in speed, I'd suggest setting up your own real-world benchmark, with separate charts for parse time (typically done once, of little importance) and evaluation time for sets of templates which are 30-100 templates big and include lots of dynamic content and other templates. That's close to real world use and will tell you if your library is a lot faster, it might even give you far more impressive numbers (reduced render time of typical templates from 100ms to 10ms for example).

Personally, like the parent, fastest is about 10th on my priorities list as long as speed is adequate (and 0.04ms per template is adequate), below: Correctness, Contextual escaping (very handy in stdlib, not supported?), Ease of Use, Partials, Layouts, Syntax, Docs, Adding another dependency, etc.

As a third party dependency for a core feature which would require me to impose your library on everyone who uses my library/app, your argument has to be very strong and there have to be multiple reasons to adopt the library and strong guarantees about future development/support. Speed is not enough, even if it was an order of magnitude better on significantly slower results (say 100ms -> 10ms), it would be just one bullet point and far down the list.

I hope this is helpful.

</comment></comment></comment></comment><comment><USER23> Jsp4go

</comment><comment><USER24> OMG I wish Python/Jinja2 had any performance near these numbers, I render some complex pages at 15-25ms

</comment><comment><USER25> I acknowledge the capability of the engine which seems rather impressive. But unfortunately it's basically obsolete.

How exactly are designers supposed to easily update? Why reinvent the wheel when far more matured templating engines exist?

As the web moves to the front end, this seems like a step backwards

<comment><USER26> Depends on the point of view, I see as a step backwards to dump a pile of JavaScript on the browser.

Many web sites are perfectly fine with pure HTML/CSS.</comment></comment>


Ask HN: Trust and remote work - <AUTHOR>

We've recently started building a team of remote developers for our startup; but I'm having some trust issues and would like to hear how people have resolved similar situations.
We've been hiring to work on a new side project which I feel is going too slowly. The team I have working on the project are very good and I'm quite impressed with whats coming out but its just taking a little long. I could easily replicate the amount of work they are getting done in just a couple hours per day.
To be honest if they're just a little slower I'm alright with that -- my main concern is simply that they're not working as hard as they could be. I know it could be a motivation problem but I don't really have any clue how to solve that remotely? Maybe I just need to challenge them on their speed, but I feel that could end badly. <comment><USER2> My advice from the perspective of a remote worker:

Rule #1: Communicate directly, precisely, and clearly.

It's not about how _hard_ someone works, when you're managing remote workers, in that it's not about how many hours (to be clear: too few or too many). You have absolutely no way to micromanage their time, so you must set expectations at the project level. "Feature/Component X needs to be done by day Y, and if that deadline is going to slip you need to let me know as soon as you see that happen so that I can plan accordingly." You might have someone who gets Feature X done on day one and slacks off the rest of the time. But you got what you wanted.

If you expect them to be available and contactable at certain times of the day, state it clearly. If you don't care _as long as the job gets done_ , don't hold them to certain hours and state that clearly.

Rule #2: Remote workers, especially ones who are new to working remotely, can tend to feel "left out" or "lonely". This is, in my opinion, the equivalent of the manager of remote workers feeling like their workers are not completing work in a timely enough fashion. In an office environment where you can toss a piece of paper at your boss, you can get constant feedback. In a remote environment, that's impossible to replicate completely and dangerous to try to replicate for people who write software (where interruption kills productivity). Whenever there is a lack of communication, both parties tend to jump to the worst possible conclusion. The manager assumes the employee is being lazy, the employee assumes his manager is incapable of handling remote workers and is looking to fire him at any moment (so some of that slack time is spent getting the resume together and shopping it at alternative places of employment). Back to Rule #1.

 _I know it could be a motivation problem ... maybe I just need to challenge them on their speed..._

Yes, but do it by giving them clear deadlines, not by questioning their lack of motivation. When the work is completed _properly_ and on-time, ask for feedback about the deadline to ascertain if you were being too reasonable or very unreasonable. When it slips, say these words: "What do I need to do differently to ensure you can reach the deadline next time?" This is a nice trick. If your developer says "nothing, I just needed more time", you can carefully launch into questions about (1) whether or not they have the right skill-set, (2) if they're having difficulties with the remote work arrangement and how that can be solved. You sound like a pretty decent guy who would give his employees a good deal of slack if they're _just a little slower_. Work that angle a little bit, but be careful to not allow that to be something that can be taken advantage of.

Consider a Skype video call on occasion. Video calls just "feel" more connected.

Just to add a little perspective to my advice:

I work remotely. Three days in a remote office, two days from home. My bosses have ranged from being on different continents to being as close as six hours drive away. My "remote office" is 7 people, none of which work in my division. I was new to working remotely six years ago, prior to which I had a "boss two cubicles over" sort of working arrangement. It took a little while to adjust, but I had a very good manager who who managed both his local and remote employees this way (some of his staff start work at 5:00 AM, some start at 10:00 AM, he doesn't care as long as _the work gets done_ ). I also write software all day, sometimes as part of a team, sometimes as a lone developer. So use that when deciding to take my advice. My situation may not fit with your circumstances.

</comment><comment><USER3> You need to synchronize your operations and shake out the trust issue.

Set up a mandatory morning and afternoon call at the same time every day. 15 minutes.

Spend the first two minutes of each call recapping your current milestones. If it takes more than 2 minutes you're talking about the wrong stuff. See below.

"Yesterday we expected to get to X." Then reiterate what the team members told you in the last meeting.

Person 1: What are you working on? Need anything? Next step? Person 2: What are you working on? Need anything? Next step? Person 3: What are you working on? Need anything? Next step?

Anything taking more than 2 minutes take offline, or stay on the bridge line after the others are gone. If you do this for a few weeks you'll quickly spot who is flaking, working for another company or project on the side, or who really just needed more direction from you.

When people experience trust issues, there's a good reason: either they are insecure, or someone is untrustworthy. I've managed large corporate customers remotely for years, performed complex projects remote. Once you get the process under way you can move to a single morning call.

Do not skip it. Do not reschedule it. Do not miss it. Get in the habit and your team will fall in line. The rest of the issues will sort themselves out.

</comment><comment><USER4> Setting expectations is important. You should let them know what your observation is about the amount of time that you expect the work to take, and give them the opportunity to explain to you why it's taking longer.

Agile/Scrum are good for this, because they give people the responsibility to commit to which work they'll be completing on a given day, and explain why they're blocked or moving more slowly.

Perhaps you should have a daily 15-minute scrum meeting to get a sense of exactly where they are and how things are going? More communication always makes things more transparent.

If you can't do that, set a deadline. Work will always expand to fit the allotted time, so make sure you're keeping the timeframe short enough to make sure the team knows that the project completion date is not open-ended.

</comment><comment><USER5> Have you tried to voice your concern to them? If not, I think you should give that a go. For all you know, that's all it would take. :-)</comment>


Jo - JSON output from a shell - <AUTHOR> https://github.com/jpmens/jo <comment><USER2> Neat. An ad hoc alternative to this if you have Python 2.7 handy and can't or don't want to compile C code could be something like

      $ python -c 'import json, sys;\
      kv = sys.argv[1::];\
      v = [int(x) if x.isdigit() else eval(x.title()) if x in ["false", "true"]\
          else x for x in kv[1::2]];\
      print json.dumps(dict(zip(kv[::2], v)), ensure_ascii=False, indent=2)
     ' key1 value1 key2 'string value 2' number 5589 boolean1 true boolean2 false

which produces the output

      {
        "key2": "string value 2",
        "key1": "value1",
        "number": 5589,
        "boolean2": false,
        "boolean1": true
      }

I, for one, am excited to hear that native JSON (and XML, and HTML) output is coming to FreeBSD's userland courtesy of libxo (see [https://wiki.freebsd.org/LibXo](https://wiki.freebsd.org/LibXo)). I hope GNU Core Utilities eventually go the same way or a full-featured alternative appears for Linux that does.

</comment><comment><USER3> Very nice. This looks like a great complement to `jt` ([https://github.com/micha/json-table](https://github.com/micha/json-table)) - a tool to turn JSON into plain text tables. Both seem to be super simple tools written in C with no heavy dependencies.

<comment><USER4> Snark side comment, jt seems to have one of the worst "curl | bash" instructions ever:

        sudo bash -c "cd /usr/local && wget -O - https://github.com/micha/json-table/releases/download/2.0.0/jt-2.0.0.tar.gz | tar xzvf -"

<comment><USER5> ?

That's not curl | bash.

That's wget | tar.

</comment></comment></comment><comment><USER6> Awesome complimentary program to the `jq` tool.

However... I do wish the name was `json` not `jo`. In my case more for personal reasons regarding painful memories attached to the name 'Jo', but I also think the tool creates JSON, so why not call it `json` or `jp` short for 'json print' ... but the matter appears settled. Oh well.

<comment><USER7> echo 'alias json="$(which jo)"' >> ~/.bashrc

<comment><USER6> Yes I can always do this sort of thing. But it would be nice to not 'maintain the illusion' when the future day comes that I've got `jo` installed on my various desktops and laptops, inside containers, on snowflake servers, on cattle servers, used by a growing collection of shell scripts written for various versions of sh and bash, etc...

<comment><USER8> I feel the same.

All these smart small tools are amazing, but they suppose the user has only one computer and does everything on it. so he can just install once and that's it.

I normally use 4 different desktops and 2 VPSs weekly. Although I tend to do most of the work in one of the VPSs, the more I customize it with tools like this, the more all the other computers will miss things.

What is the solution?

<comment><USER9> I found that learning ansible and storing my machine customization as a deployable playbook was totally worth the effort involved.

<comment><USER8> Does that ansible thing support incremental deploys? Such that installing 'jo' here will idempotently install it on other machines?

<comment><USER10> Late to the party but yes. The idea behind ansible seems to be (I'm new to using it) that you can run the command a million times over a million machines and it'll only install new things to the machines that don't already have it

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Awesome looking tool. One thing I noticed, however:

        $ false; echo success@$? | jo
        {"success":true}

i.e. jo's translation of integers to booleans does not match that of a typical shell.

<comment><USER12> Because the shell substitutes the return code before passing to jo, jo sees 'success@1'. How do you expect jo to know where the 1 came from to change its interpretation?

Edit: or you're saying jo should always consider 0 true and 1 false to match shell return code conventions?

<comment><USER11> > How do you expect jo to know where the 1 came from to change its > interpretation?

It was merely an observation. Of course, one can simply negate the value before passing it to jo.

jo looked as though it was for use in the shell though, so I was curious as to the design decision here.

<comment><USER12> > It was merely an observation... jo looked as though it was for use in the > shell though, so I was curious as to the design decision here.

I think it makes sense how it is, since if I typed "success@1" I wouldn't expect that to output "{success: false}" but I definitely appreciate your point about a case like "success@$?".

> Of course, one can simply negate the value before passing it to jo.

What's the shortest way to do that? This?

        echo success@$(test $? -ne 0; echo $?)

<comment><USER12> Shortest way:

        $ false; echo success@$((! $?))
        success@0

</comment></comment></comment></comment></comment><comment><USER13> `jo` is conflicting with autojump on my system.

Other than that it looks pretty handy.

        ls | jo -a -B</comment>


The Last JSON Spec - <AUTHOR> https://www.tbray.org/ongoing/When/201x/2017/12/14/RFC-8259-STD-90 <comment><USER2> I'd be happy about a JSON spec that allows for comments...

<comment><USER3> I'd rather have trailing commas, so every line can have the same format. Other people choose JSON for their config file format, and I don't have a say in it. I just have to do extra editing each time I reorder the lines or add a new one, because too bad. And I have to manually edit JSON when I'm writing code to handle other people's JSON APIs to test my code.

I'll probably never _not_ have to manually edit JSON, so JSON's insistence that using the same format for your final line as for all the others won't ever be allowed will remain a never ending, unnecessary nuisance in the spirit of JavaScript itself: the "too bad, too late now" school of design. Except that in this case, even JavaScript corrected that particular nuisance and allows trailing commas.

<comment><USER4> If you want a JSON-ish config format, I'd recommend to check out HOCON [1], basically a superset of JSON that fixes all he things that make it annoying for config files.

[1] [https://github.com/lightbend/config](https://github.com/lightbend/config)

<comment><USER5> If we're proposing supersets of json, why wouldn't one just use yaml?

</comment></comment></comment></comment><comment><USER6> > "On the other hand, we still lack a decent high-quality JSON Schema > language."

This turns data integration with JSON into a total nightmare. And to make matters worse, Swagger is a total shitshow. Combine the different flavors of JSON schema with OpenAPI/Swagger and you have are left with a regression from SOAP/XML that approaches the same complexity with with fewer features and no standards.

Even mf COBOL has a standard schema definition for data. For new projects I'm still cranking out XSD definitions and doing transformations to JSON if I have to. Even if they come out with a decent schema format I would probably skip it and jump straight to gRPC, Thrift, or some other IDL and just continue to treat JSON as an "also supports".

</comment><comment><USER7> "we still lack a decent high-quality JSON Schema language"

Yes. Why?

<comment><USER8> The JSON Schema spec was abandoned by its original authors, and was picked up by a series of other people with varying levels of standards experience (myself included).

Personally, I had some promising support from my then-employer (including an IETF connection), but then it kind of petered out, and I was buried under other stuff and had to pass it on. The team who picked it up since them seem pretty on-the-ball as far as I can see, so I would still recommend it as a useful project to contribute to.

It is supported by some tools - last I heard, Visual Studio could use JSON Schema for autocomplete and validation, as well as a couple of databases. I used to get a few million NPM downloads a month on my validator, so someone's clearly using it.

<comment><USER9> As far as I know, Snowplow is one of the largest active users of JSON Schema, and we maintain one of the larger repositories of JSON Schemas on the internet, [https://github.com/snowplow/iglu- central](https://github.com/snowplow/iglu-central)

After something of a hiatus, we are re-starting active work on our schema registry technology ([https://github.com/snowplow/iglu](https://github.com/snowplow/iglu)). We'd love to be involved in new design work on the JSON Schema spec. How do we get the old (or new!) band back together?

</comment></comment></comment><comment><USER10> FYI: I've put together an Awesome JSON (What's Next?) page [1] collecting all JSON next flavors incl. JSON5, HJSON, HanSON, SON, CSON, USON, JSONX/JSON11 and many more. Yes, comments (in JSON 1.1), please :-) Cheers. [1] [https://github.com/jsonii/awesome-json- next](https://github.com/jsonii/awesome-json-next)

</comment><comment><USER10> FYI: For the Microservices Austria meetup I've put together a talk titled "Meet Jason - The Universal Data Exchange Format - What's Next?", find the notes (transcript) @ [https://github.com/geraldb/talks/blob/master/jsonnext.md](https://github.com/geraldb/talks/blob/master/jsonnext.md) Yes, comments (in JSON 1.1), please :-). Cheers.

</comment><comment><USER11> Fine that they didn't another insecurity as in the latest updates. JSON is still the only secure transportation protocol if you don't use the RFC 9159 simplification, [http://search.cpan.org/~mlehmann/JSON- XS-3.02/XS.pm#SECURITY...](http://search.cpan.org/~mlehmann/JSON- XS-3.02/XS.pm#SECURITY_CONSIDERATIONS)

<comment><USER12> What do you mean by "only secure transportation protocol"? There's nothing inherently insecure in XML, yaml, asn1, bson, cbor, msgpack, out whatever other popular format. Implementations may fail, but that's a different problem.

<comment><USER13> * YAML is pretty much inherently insecure, custom tags are part of the YAML spec and are interpreted by default by most implementations, the YAML 1.2 spec only _recommends_ defaulting to the "core" schemaor a lesser one and (AFAIK) at no point even suggests disabling explicit tags.

* XML is most definitely inherently insecure if you don't disable or strictly limit _standard_ features (entity definition/expansion, external entity definition, DTD retrieval).

I don't know about the others, I do know that ASN.1 has a long and storied history of vulnerable implementations (and it's unclear whether there's ever been a secure one) which tells me that even if the format is not inherently insecure, in practical terms it is.

<comment><USER14> ASN.1's main issue is that it was created in the 80's, so most implementations were programmed before folks understood software security.

Also, it has had almost 40 years of additions, so it is now a large spec.

<comment><USER15> ASN.1's main issue is that BER/DER/CER are awful, and they are awful because they are TLV (tag, length, value) encoding rules. ASN.1 itself is a bit clunky, but has _everything_ you'll ever need.

Too many people have reinvented ASN.1 badly. Protocol Buffers, I'm looking at you!

</comment></comment></comment></comment></comment><comment><USER16> It's a lot of fun reading the spec and realizing you can hold the entire thing in your head, and probably also make a decent implementation in the language of your choice.

It would be neat to take that as a model and try to compose a new type of browser where each functional module must consist of a spec that is similarly succinct and easy to implement, perhaps with the exception of ECMAscript.</comment>