Ask HN: What makes an online course amazing? - <AUTHOR> For those of you who have taken online classes (MOOCs, at college, etc.), what have been the things that made the best classes stand out? (Or conversely, what made the bad ones bad?)
Why I'm asking: I teach a college data science 101 class with at least 1 section online every semester (and will now be switching to all online for at least the next month - thanks, coronavirus...). At the same time, I'm in the process of redesigning the course, and making new teaching materials and assignments.
I've taken completed several amazing MOOCs in the past (e.g. Princeton's Algorithms I & II, Stanford's Machine Learning), as well as abandoned many more that were simply terrible, so I am no stranger to the online student experience, and I know the things that made certain courses amazing for me personally (e.g. great videos, and well integrated assignments with automated feedback). However, every learner is different, and I would love to hear different perspectives so that I can better redesign my own course.
Was it something about the videos? The assignments? The structure? The instructor? Or something else? Thanks! <comment><USER2> For me the biggest game-changer for online video lectures has been this Chrome plugin that allows for fine-grained control of video speed: [https://chrome.google.com/webstore/detail/video-speed- contro...](https://chrome.google.com/webstore/detail/video-speed- controller/nffaoalbilbmmfgbnbgppjihopabppdk?hl=en)

If you have control over the courseware platform used for your course, make sure it uses a compatible video player based on html5 video and not some custom implementation (very rare).

In case video speed controls is not available on your courseware, you can pre- process videos to speed them up to 1.5x using this script (save as `fastervid.sh` and run on video lectures before uploading)

        #!/bin/bash
        if [ -z $1 ]; then
          echo "usage $0 input_video.mp4"
          exit -1
        fi

        echo "Converting $1 to 1.5x speed..."
        ffmpeg -i "$1"  -filter_complex "[0:v]setpts=0.6666666666666*PTS[v];[0:a]atempo=1.5[a]" -map "[v]" -map "[a]" "tmp-$1"

        echo "Delaying audio of $1 by 60ms"
        ffmpeg -i "tmp-$1" -itsoffset 0.06 -i "tmp-$1" -map "0:0" -map "1:1" -acodec copy -vcodec copy  "faster-$1"

        # cleanup temp file
        rm "tmp-$1"

<comment><USER2> Completely unrelated to the video speedup hacks, but also in the vein of getting a lot of information across faster, one thing you can do for your courses would be to create Concept Maps.

The CmapTools software is very good for this: [https://cmap.ihmc.us/cmaptools/](https://cmap.ihmc.us/cmaptools/)

Overall I find concept maps on of the best tools to show an overview of the course (macro maps) or topic (zoomed in maps). As a teacher with extra context about data science you can easily put together something like this for your course that will show learners what there is to learn and allow them to keep track of their progress (e.g. wow when we started all these words were unknown to me, but now I know about 70% of the words on this map already).

I have heard teachers use CmapTools in more active way (asking learners produce concept maps individually or collaboratively), but don't have experience with that myself.

A paper about concept maps: [https://cmap.ihmc.us/docs/pdf/TheoryUnderlyingConceptMaps.pd...](https://cmap.ihmc.us/docs/pdf/TheoryUnderlyingConceptMaps.pdf)

And an example of the concept maps I use in my books: [https://minireference.com/static/tutorials/conceptmap.pdf](https://minireference.com/static/tutorials/conceptmap.pdf)

<comment><USER3> More in this vein, it genuinely floors me that UML-like diagrams (used very loosely and without strictness) aren't more of a thing.

There are so many walls of text out there going over a system's flow that could be expressed in just a couple paragraphs and a companion sequence diagram.

</comment></comment></comment><comment><USER4> It might not be the most useful answer given the context of your question. But in my experience the thing that made the best courses stand out were the depth of understanding of the instructor and their basic didactic skills. Are they able to explain the concepts clearly to a novice student? Are they able to structure the course into a logical progression of topics?

To me, what I consider to be secondary aspects such as interactive quizzes or homework assignments never really made a difference. One thing I noticed that really did not work well for me was asking quiz questions in between that did not require understanding just memorization of what was just said 30 seconds ago. It's like you're checking if they're paying attention v.s. are grasping underlying concepts.

I would recommend you check out CS50 by David Malan (if you haven't already) as it's somewhat of a gold standard for MOOCs in my book.

Good luck with your MOOC! The world needs more of them, make sure you make them as publicly accessible as possible.

<comment><USER5> > One thing I noticed that really did not work well for me was asking quiz > questions in between that did not require understanding just memorization of > what was just said 30 seconds ago.

Be careful of saying what works well versus what doesn't work well based on perception. I pretty much always use this kind of inline question in lectures, usually gauged to require the student to make a single deductive step from the material just presented. And they all look at me like I'm an idiot for expecting something that simple...except that then some of them get it wrong and have to reintegrate the knowledge, and the number of queries after the fact from misunderstandings of the material went down dramatically when I started doing it.

So I actually tell the students up front that this seems absurd, but play along, because it really does help the integration of knowledge.

</comment></comment><comment><USER6> My answer is very general and I only have experience taking a lot of online courses via sites like udemy but the key factor that makes any course stand out is practical real life examples. It makes everything super interesting and you learn a lot more quickly.

Also I've seen that a bit of humor does wonders for learning. Recently did an online course called StatQuest with Josh Starmer(1). I never knew stats / ml could be made this interesting.

(1) [https://www.youtube.com/user/joshstarmer](https://www.youtube.com/user/joshstarmer)

<comment><USER7> Perhaps an unpopular opinion, but I feel humor detracts from a course most of the time. It's like breaking the 4th wall in cinema: you can do it, and some people do it to great effect, but as a rule you probably shouldn't.

Dan Ariely is unusually gifted, so his humor works.

For the vast majority of courses, I prefer when they stick closely to the material, so I can watch it at 1.7x or 2x without breaking stride.

</comment></comment><comment><USER8> You should keep in mind the key difference between your offering run of the mill MOOCs--you're students have to complete your course if they want to maintain their GPAs and graduate.

This should substantially change how you teach your class. A normal MOOC has to make learning "easy" so that students keep coming back. Unfortunately, when learning is "easy" it doesn't stick very well.

Effective learning needs to be challenging and force students to dig deep and think critically about what you're teaching them. If you give out hints or shortcuts, they'll probably like you more, but they're not going to build the deep understanding they need to succeed in further courses and in their career. If you're good at making them think critically, the whole learning process will feel hard for them, possibly as if they aren't learning anything, and they might resent you for that. So it's good that they're stuck with you. Do the right thing and make sure they're really understanding the material and not just memorizing formulas and patterns.

</comment><comment><USER9> I've taken Georgia Tech's OMSCS program. What really sets this apart is the active feedback on assignments / course interaction from Professors and TAs in Piazza.

Current online courses have really watered down content and zero/terrible ways of evaluating the material.

Things that I like too see in an online course:

\- Keep assignments on a regular basis (on par with your campus schedule). Quizzes are great to keep them engaged but do not use them to replace regular assignments.

\- Design them to be auto-graded as much as possible. Bonus points if there was some way the students can evaluate their solution locally.

\- Something like Piazza/Forum setup to answer student questions and have an appropriate number of TAs.

\- Post all the resources used in the videos to be accessible for later reference (slides and links).

If you're recording content for future offerings, ensure that the content is consistently updated to stay relevant.

</comment><comment><USER10> To the extent that students are writing code: a high quality "autograder" test suite. A tight feedback loop on the correctness of your work/understanding is the most powerful learning aid I've ever encountered.

Although it's a step on the right direction, I'm not a fan of Coursera's "upload a zip file and wait 10 minutes" approach: even that much delay means you've lost your mental "working set" by the time feedback comes. My college professors would give those to us as Make targets in the project scaffolds, which made it closer to "TDD."

In a similar vein, thoughtfully designed interactive environments with good difficulty progression, like Micro-corruption [0]. It's easy to imagine something like this for data science (here's an RStudio workbench and a dataset, go find the needle in the haystack, etc).

[0] [https://microcorruption.com/login](https://microcorruption.com/login)

</comment><comment><USER11> All of the following in one website or tool/sw:

1/ Interactive tutorials and quiz format like brilliant.org

2/ A Wikipedia like comprehensive wiki embeded with course website for all kinds of reference.

3/ An online community — could be a piazza/forum.

4/ A github like service integrated with course site specifically for that course where students can submit their projects and be evaluated by other forum members/mentors etc.

</comment><comment><USER12> Dan Ariely's MOOC on Irrational Behavior (coursera) remains my favorite online course and one of the best overall.

The content was engaging. It included guest talks. The course didn't shy from hard work, including dozens of required and recommended papers. The curated papers were my favorite part. The course exposed me to an entire ecosystem that I was unaware of. Too many MOOCs are watered down but this one was just right.

My best advice is to create a course that management will resent open sourcing because it is so valuable. Demand autonomy and use it create a legacy.

</comment><comment><USER13> The biggest issue I've seen in online courses is production values. In fact I think crap production values and the lack of a quality bar is why platforms like Coursera have done poorly compared to their potential.

The most obvious issue is usually microphone quality. It's baffling that people spend so much effort developing a course and multiply that effort by a shit microphone. If you aren't willing to spend/get money for a good microphone, your philosophy on what is important for online teaching may have some blind spots IMO.

</comment><comment><USER14> I have developed a collaborative learning framework to support the development of learning experiences. The 4 key phases are

1\. Resource curation 2\. Guided active retrieval practice (questions, tasks, self assessment and feedback) 3\. Collaborative experiences (professional examples, tadks and feedback) 4\. Reflection and connection. (Connecting this learning to what has happened before or is likely to happen next

I will get the chapter (With evidence) up on a preprint server shortly -likely the end of the month. If you want the model - dm me on Twitter @maher_au

</comment><comment><USER15> Appropriate assignments. For me, that often makes or breaks a MOOC. I want to be stumped in an intellectual way, but not a cryptic way. I don't want to feel like I'm just trying to decode the professors cryptic problem. I want to feel like it's a genuine hurdle to learn the content well, yet still accessible, and definitely not busy work.

Good example: write an interpreter for the given (made up and simple) programming language. We had to figure out how to implement certain language features such as clojures.

Bad example: in networking course, we had to recall details about certain protocols, and do calculations. While this might be useful to know how to do in practice, it didn't contribute anything to my understanding, and it just always felt like tedious busy work, and lacked projects that contributed to the course goals.

I don't know data science, but here's a project I've heard of: Somebody's hobby was disc golf. Discs come with ratings on them (I'm assuming things like curve and distance). They created a controlled experiment to take various data points from many discs, and compare them to their stated ratings, and apply a bunch of data science-y things to the data.

Edit: I'd add some type of reference resources like a wiki, and ideally some auto-grader that gives feedback if possible (like what tests failed)

<comment><USER16> What MOOC did you take where you had to write an interpreter?

<comment><USER15> [https://www.coursera.org/learn/programming-languages- part-b](https://www.coursera.org/learn/programming-languages-part-b)

This is Part B, but there's also parts A and C. While I recommend the whole course, you don't need to take it all if you just want the interpreter project.

The networking course was discontinued, but these are the videos: [https://www.youtube.com/playlist?list=PLEAYkSg4uSQ2dr0XO_Nwa...](https://www.youtube.com/playlist?list=PLEAYkSg4uSQ2dr0XO_Nwa5OcdEcaaELSG)

The videos aren't terrible, but the homework was worthless.

<comment><USER16> Thank you.

</comment></comment></comment></comment><comment><USER17> I was going to say that all my favorite courses were kind of unique, and didn't share any particular characteristics, but writing this comment I found they actually all share excellent problem sets and an engaging instructor. Having taken ~25-30 online courses, the ones that stood out were:

\- Discrete Optimization (Coursera/Melbourne university, Pascal van Hentenryck): had competitive optimization assignments and course leaderboards. The professor oozed enthousiasm and the nature of the assignments was great for the competitive setup (many different approaches possible, and there were always problems which you would not be able to solve to optimality).

\- Microeconomics (EdX/MIT, Jonathan Gruber): very good assignments that made you discover things yourself. Professor presented with a lot of humor and this course was clearly refined over many iterations on campus. Lectures were actually recorded in a classroom setting so not tuned for MOOC delivery at all.

Honorable mentions for Computer Graphics (EdX/UC San Diego, Ravi Ramamoorthi, perfect pacing and balanced, broad set of assignments) and Underactuated Robotics (EdX/MIT, Russ Tedrake, fascinating material and challenging, elegant assignments).

</comment><comment><USER18> Hands-on, practical examples. If a class only includes video explanations and some quizzes on what was said in the lectures, I usually forget the subject matter quickly. The best MOOCs that I've taken are the ones that have periodic "lab" assignments which ask me to think and apply the subject matter in ways that the lectures may not have explained in precise detail.

Without naming names, here are two examples:

I once took a MOOC about "bare-metal" microcontroller programming which didn't include any microcontroller coding. Useless.

I once took a MOOC about digital circuit design which used an in-browser circuit simulator for problem sets and labs. Extremely helpful.

I feel sort of cheated when I work through an online course, only to find out that it would have worked just as well if it were a series of YouTube videos.

For college-level data structures, maybe you could ask students to implement their favorite DS from a set of tricky ones? You could write automated tests to verify them so grading is easier for you and development is easier for them.

</comment><comment><USER19> I've taken almost 10 MOOCs and 5 courses in GT's OMSCS program, spanning from a member of Ng's first ML course, to a currently lackluster offering I'm taking for credit.

To take a step back, I think what makes a course great is just its ability to transfer knowledge to students and to spark curiosity (further learning after course finishes). Usually, when you take a course in person, the folks teaching the class have ample opportunity to ensure that transfer is happening, in online courses, the onus is really on the student.

Thus, in an online course, you need to provide clear learning goals, for instance, "dynamic programming", a set of lectures that teaches those concepts, then homework or project based work that directly refers to what has been said in the lectures. Decide what your resources are, say, a book, your videos, and a few homework assignments, then try to have the resources build off each other, and make sure information is available in multiple places. Sometimes with difficult concepts, you need things explained twice, from two different sources!

The next aspect of a great course is the fostering of a learning community. Make sure the students have a place where they can engage (slack, discord, et cetera) and ask questions. Having students make a social connection has been shown to increase their outcomes in online learning, and for me, the early Coursera courses were amazing for this.

Finally, there is the aspect of of running the course. Some students don't do well learning online, and I some of this can be explained by the loss of human to human contact and relationship building and mentoring that can help struggling students during in person office hours. A percentage of students truly rely on this, and there is no online alternative. If you don't grok them pythonz, data science can be a nightmare (R 4 lyfe!!!).

Someone much smarted than me figured out you need 3 things to learn: time invested, a consistent environment, and feedback. Make sure you have enough TAs to actually give student feedback, or figure out an autograder for problems of varying difficulty.

</comment><comment><USER20> I would say these aspects are important:

An instructor's understanding of the topic he or she is teaching. It is hard to describe but the vision and the depth are just different. In some occasions, I find that it is my preparation prevents me from fully understanding what the instructors are seeing.

An instructor's passion for the topic, which brings moments for learners to feel "this is fascinating /amazing /cool /interesting. I have never thought about that". It seems that passion cannot be faked or manipulated, which means one cannot be prepared to demonstrate passion when teaching a course.

Teaching and presentation skills, can be trained.

Visualization and other technicals, can always be improved.

</comment><comment><USER21> One of the things I like in courses is that fact I can know who's studying with me and in few cases I actually became friend with one or two people.

Also in online courses it's an important factor that not many e-learning sites fully understand the potential

</comment><comment><USER22> Exercises and frequent quizzes. Passive learning is not learning.

<comment><USER23> Agree with frequent tests. Also live video as much as possible.

</comment></comment><comment><USER24> This might not really translate to you since the context I have taken online courses in is that I have wanted to learn more so that I could be a more effective software engineer. So I'm looking for things that show applications quickly.

Courses I've gotten a lot out of: Andrew Ng's ML course and Yaser Abu- Mostafa's learning from data course.

In both courses I really felt like I was learning something meaningful. I very clearly remember how mind blowing it was to me that you could turn complex high level tasks into curve fitting. I excitedly told a colleague of this thing I had learned about called linear regression who turned out to be surprised I had not taken a statistics class. Same thing for generalization bounds & VC dimension in Yaser's class.

I don't know if this can really be generalized to all courses since it might just be matching students to courses that make sense to them, but the worst line in a MOOC is "Well, this is boring, but you're just going to have to grind through it so that we can solve problems later". Shout out to the Convex Optimization MOOC I dropped.

For Data Science 101 this should be easy. Find some problems that students could imagine wanting to work on and use those problems to drive what you talk about.

Also, a pet peeve of mine is courses trying to make me do math by hand. I am 100% going to ask a math package to do an integral for me every time this happens. Sure, somebody has to know all the math deeply, but it's not me.

So I guess the main takeaway here is that you need to understand your audience. What is appropriate for me is probably not appropriate for 1st semester college kids.

</comment><comment><USER25> I don't want amazing. I want efficient! Teach me at a speed not to slow and not too fast. Cover the correct topics.

A course with missable sections would be good so that if you already know ES6 you don't need to listen through it on every JS course. Cheat sheets might help with this too.

I don't care much for a super interesting voice as long as it's a reasonable voice (not monotonous or unclear) and I can learn the thing.

</comment><comment> jerome-jh Having taken a number of MOOCs, I would say, for the videos:

\- the speaker must be standing

\- the tone should be light, not necessarily funny, but definitely not always the same

\- there should be illustrations

\- anecdotes, personal notes, interviews: maybe not at every video but at least one per chapter.

\- videos should last less than 15min.

The talk must not aim to be exhaustive. Students will master the material through provided readings, exercises or quizzes. Some may only watch the videos, others will do the full course.

You will probably not have the time to prepare quality videos before the COVID-19 outbreak, so you may limit yourself to an introductory video for every chapter. You may also provide the solution for a couple of exercises in a video on the model of Kahn academy.

You should watch the making-of at the end of "Mindshift" on Coursera, by Barbara Oakley.

Note that "Introduction to logic" on Coursera has no videos but provides great tools and both funny and serious exercises.

 _Bad videos may spoil the course by making your students bored before they even start learning. So insist on quality, not quantity._

<comment><USER26> Why does it feel important to you that the speaker be standing?

<comment><USER27> Standing uses body language to convey authority and confidence when presenting. I'd theorize this helps the consumer of educational content in being engaged, which is more difficult when watching videos versus being present during an in person lecture.

<comment><USER26> but if the teacher is fully shown, or perhaps the upper body (in Japanese culture, people like to see the upper body during webcam sessions, not just the head), then it would still convey authority and confidence while watching the video?

Authority seems to come in part from the actual height difference, so that could be lost if the student watches a video... But standing still gives other benefits, see [https://www.genardmethod.com/blog/bid/161977/Sitting-or- Stan...](https://www.genardmethod.com/blog/bid/161977/Sitting-or-Standing- Which-Makes-for-More-Effective-Presentations)

</comment></comment></comment></comment><comment><USER16> I'm curious about why people aren't naming any courses that exemplify the good or bad things they're mentioning.

</comment><comment><USER28> MOOC's are super boring for people who don't like watching videos.

I really hope somone builds a mooc on top of something like leetcode.com . Start with easy problems see how far you get, get a hint, if you can't then watch a video of concept you are missing and so on.

<comment><USER29> I used to love watching video but since I started reading more books I just can't watch for more than 5 minutes. Recently I discover educative.io which is like reading articles. It's great if you don't like watching videos and want to learn software engineering stuff.

</comment></comment><comment><USER30> It's not easy for me to explain (and I would imagine not easy to create in lesson plans) but I think it's something Colt Steele consistently does well in his Web Dev Bootcamp on Udemy.

Here's my best effort at articulating his teaching style: He walks students directly into the mistakes they're going to make and then helps guide them out. Most instructors will teach the concept and leave it to students to avoid making mistakes. I learn a lot a better when I know what mistakes to look out for _and_ what to do when I've encountered one. But more importantly, I feel like I've really mastered the material when I'm confident that I can get myself out of any mess I can get myself into.

<comment><USER31> Can you give a specific example of this technique?

</comment></comment><comment><USER32> Check out David Joyner's work at Georgia Tech:

[http://lucylabs.gatech.edu/](http://lucylabs.gatech.edu/)

One of the keys for me is how I get feedback. Multiple choice quizzes can be well-designed. Most are not. But they scale well.

Personally I like very challenging assignments, but with very lenient grading and partial credit, with lots of detailed feedback from the grader.

If you're teaching a college course, maybe you have enough TAs to make that happen. You'll see some of Dr. Joyner's work is on scaling grading systems and feedback.

</comment><comment><USER33> In my formal education days, I was perma-frustrated that none of my teachers had achieved anything impressive with their work (apart from being published), and I often felt like I was being handed out second-hand knowledge to regurgitate during the exams... and I had to get a job to pay for that level of education!

To me what's really good about MOOCs is that I can have access to some of the best content and teachers from MIT, etc all from the comfort of my living room.

</comment><comment><USER34> Cost of a 3-credit course f2f ar Stanford is $ 5.000. But the real cost of an online course ( same course ) , is less than $ 10 . I tell them sell it at $ 100 . But there is a dilemna . How come the same thing is $ 5000 and $ 100 . Even the one for $ 100 is better . Solve the equation . I say make a consortium of online degree programs . Provide degrees from consortium . Any idea .

</comment><comment><USER35> 2 cents:

I think the internet is the best way to distribute information, but for me one of the worst places to learn.

If the learning is solely done via the computer I will fail to even get near to completing the course (self-study, no pressure). But by using pens, paper, books etc, my ability gets to a normal level.

So, encourage them to behave close to the way they do in your classes.

</comment><comment><USER36> I'm a technologist in Education. This frightens a lot of educators who are pretenders in Academia trying to lead technology development.

Supporting instructors, and instruction directly has been my main area of focus for the past year, in addition to being directly involved in developing online education platforms for the past 20 years in K-12, Academia and Industry.

I'm not sure if you have a tech background, but making sure you have competent technology advisement at all stages is quickly emerging as a key differentiator. If decision makers in academia haven't had technical literacy to make technical decisions, it shouldn't be a surprise if the experiences are not engaging, because they aren't leveraging digital interactions for what they're capable of, and instead only what a limited non-technical academic background can imagine.

Important:

\- Not taking the lecture format classroom of the past 100 years and putting it online in video. MOOCs are handicapped before they even begin, quite often. Sure, great instructors who can explain well are good, but they are the exception, and not the norm. Another key problem remains.. god help you if you have to change the video. The key I focus on is how students are experiencing MOOCs as being the main lens. Academic institutions can have a hard time letting the frame go to be student centric instead of instruction-centric. Online education shouldn't be rooted in the practice of distance education (correspondence, textbooks, phone calls)

\- The baseline of the student is that they are far more digitally literate and competent than the institutions they are walking to and most often more than their instructors.

\- Much of the Academic online education world is designed and anchored in a past of a web browser on a desktop.. by educators who do not have competency in the possibilities or capabilities of tech.

\- When it comes to making digitally engaging learning experiences, first you have to consider if academics rarely learn how to teach, let alone digitally.

\- I would seriously pay attention to how students are interacting and studying digitally and focus far less on the existing taxonomies and nomenclature as it does not relate well to self-directed learning.

\- The Copernican view of curriculum being the sacred cow of Academia is rooted in Math not changing much in a few hundred years, and generally the rate of change in curriculum being slow. In the real world, Academia is quickly reaching a point where they cannot update fast enough to keep pace with the change in the world, and the gap between students and entering a job is increasing.

\- Again, see what students are doing to stay relevant - it's not always formal education.

\- Learning how to learn is a course I reference early and often to all sides as the key skill being missed.

<comment><USER37> In work and learning I keep getting back to an analogy with a trainer and an athlete. People have been training for a long time. The goal is to excel, constantly improve and ideally become the best. The job of the trainer is to monitor if the athlete is working hard enough to improve while not overdoing it. If recovery takes to long the gains will be smaller. One might even get injured. Every type of training has clear goals one of which is the duration of the challenge. A work day is usually 8 hours not a 30 min race to the end. It seems to me a huge challenge to do this remotely. It seems the camera shouldn't be pointed at the teacher but at the student.

</comment></comment><comment><USER38> To me it's giving the right intuition and perspectives. I don't really care about the "raw" material/math, it comes only after good visualization based intuition.

</comment><comment><USER34> admi,nistrators . Page design is real bad . Make it attractive .</comment>


Whats new with Java 9. Lots of goodies - <AUTHOR> http://alchemytechsolutions.com/java-developers-eagerly-anticipate-newest-proposals-for-java-9/

<comment><USER2> Doesn't HSA support comes in Java 9 too?</comment>


I Just Hacked a State Election. I'm 17 - <AUTHOR> https://www.politico.com/magazine/story/2018/08/21/i-just-hacked-a-state-election-17-not-a-good-hacker-219374 <comment><USER2> _> The replica state election websites used in this year's competition were built on MySQL_

So the replica website built and designed by the DEFCON instructors to be vulnerable to SQLi for the purposes of demonstration was vulnerable to SQLi. Not that I was expecting anything less - but talk about clickbait...

</comment><comment><USER3>
      I was able to shut down the website that would tally the votes, bringing the election to a screeching halt.

Ridiculous clickbait title and claims. Such misdeeds do nothing to stop or "hack" a state _election_ ; at worst, it could delay _tabulation_.

</comment><comment><USER4> Why are we blaming all of this election hacking on Russia when clearly our own governments don't care the least about election integrity?

Get rid of all of this, go back to paper ballots.</comment>


Russian Ships Near Data Cables Are Too Close for U.S. Comfort - <AUTHOR> http://www.nytimes.com/2015/10/26/world/europe/russian-presence-near-undersea-cables-concerns-us.html <comment><USER2> "Russian Ships Near Data Cables Are Too Close for U.S. Comfort"

Because they might spot the US sub upgrading the taps on the cables.

</comment><comment><USER3> Is that Pentagon asking for more money..? :-)

<comment><USER4> Dear Congress,

Christmas is coming up, and we think we've all been good this year, and deserve something nice under the tree. We know it was hard to get the Ford- class carrier project going to replace our aging carrier fleet, and that cost a lot of money...

But, let's face it: America's most important strategic assets are photos of kittens and photos of boobs on the Internet. We believe Russia is using their submarines to intercept our kittens and boobs. So, if it wouldn't be too much, could we FINALLY get that giant robot we've been asking for? It could just wade into the ocean and pick up the subs and toss them back to Russia like a football. What is more patriotic than football?

Signed,

Your dear friends over at the Pentagon

P.S.,

We did an office poll, freshly baked apple pie and bald eagles tied, narrowly beating football as the most patriotic thing ever.

</comment></comment><comment><USER5> The world will be watching slightly less porn in the next US-Russian stand- off...

Do many European companies use US based datacenters for their core systems? Even before the Snowden revelations I would expect latency to push many to not do so.

I guess it would rather affect smaller companies who rely on infrastructures like salesforce.com or office 365 (not that I have any idea about where these two examples store their data).

Also wouldn't all the .com and .net domain become unresolvable once the TTL have passed? That could create havoc.

<comment><USER6> I would actually love some massive disruption for a couple of days (either man made or natural) - it would expose some faults in the cloud strategies of a lot of companies.

<comment><USER7> My company is running full steam into a situation where a loss of internet means our product is down and the devs are sitting in their chairs spinning because we can't access code, build servers, and binary build artifacts.

</comment></comment></comment><comment><USER8> "We are worried about other nations doing the exact same thing we have been caught doing."</comment>


JMAP: A modern, open email protocol - <AUTHOR> https://www.ietf.org/blog/jmap/ <comment><USER2> One of the things I particularly recall reading is FastMail devs explaining that the standardization process led to changes and improvements. (Even their about page says that "JMAP was built by the community, and continues to _improve via_ the IETF standardization process.")

Really thrilled the FastMail team is working on this, and doing it in the way that changes to mail should be handled: Going through proper Internet standards bodies. It's in stark contrast to AMP4Email, which is being implemented by Google wholly without respect to Internet standards.

<comment><USER3> _Really thrilled the FastMail team is working on this_

Sorry to be 'that guy'. I like Fastmail but maybe they could fix some of the irritating bugs we keep asking for resolutions on before embarking on fun protocol invention missions. Two killers:

(1) When forwarding an email there is no link between the forwarded email and the original thread (TOTAL TIME WASTER), when reported they "don't consider it a bug [because of SMTP ID handling in existing daemons]". Missing the point here so hard guys!

(2) When creating a new filter it doesn't have a checkbox to include matching emails. This means you have to manually go replicate the search again, for consistency, to get things where they should be.

Frustrated at lack of response from reporting these as a commercial user. Inventing new protocols should not be higher priority than fundamental annoyances that are wasting customer time NOW.

<comment><USER4> Did you consider that they might only be wasting _your_ time? I haven't ever felt any frustration at any of the things you named.

<comment><USER3> Both are standard features on GMail, which beats your sample size of 1.

<comment><USER5> And I didn't care about them there either.

But you know, you could send them the feature requests - they actually implemented something I asked for on mobile, so at least one team is listening.

</comment></comment></comment></comment></comment><comment><USER6> If this takes off, it would remove one of the last few holdouts of non-HTTP application specific protocols. That just leaves us with SMTP really. While using HTTP is not necessarily a bad thing, it's certainly an interesting indication of how application developers prefer convention based protocol definitions (JSON over HTTP) instead of having a strictly defined protocol over a duplex stream (IMAP over TCP).

<comment><USER7> Why is this happening? Forgetting ubiquity of tooling, is there something technical about HTTP that makes it so attractive?

I get JSON. People don't want to write text-parsers. But what's attractive about this abuse of HTTP? This isn't hypertext.

Is it so complicated to work with a duplex-stream? Could a library alleviate the complications?

Could it be that developers are more familiar with HTTP than with TCP and so TCP scares them even though it's simpler to use?

<comment><USER8> > This isn't hypertext.

That ship has long sailed. HTTP is no longer just hypertext -- it's a ubiquitous and well-understood transport for RPCs, with lots of tooling and infrastructure support across the Internet.

I think at its core, HTTP abstracts away some of what you would want in a request-response protocol, but not really all of it. But _simply because of the ubiquity of tooling_, you get a whole lot of other stuff for free (load balancing, DDoS detection, in-browser debugging, etc.)

> Is it so complicated to work with a duplex-stream? Could a library alleviate > the complications?

Yes, TCP streams are very complicated to work with (in my experience) -- there are way too many failure modes and corner cases to consider. IMO, your language's go-to HTTP library is that library that alleviates the complications.

All this said, I personally think gRPC is the right approach for RPCs, and I hope to see broader adoption of it over the coming years.

<comment><USER7> > Yes, TCP streams are very complicated to work with (in my experience) -- > there are way too many failure modes and corner cases to consider.

Isn't it the same thing, but simpler and more flexible? You write a message, and then you read a reply, rinse and repeat. Could you expand on such things that are complicated with TCP that HTTP helps with?

<comment><USER8> When you're working with sockets there's lots to think about that you can simply ignore with an HTTP library -- connection setup and teardown, buffering, serialization, byte ordering etc. But more importantly, you'll have to build your own status/error handling, cache control, content encoding, TLS etc. (Simply, doing TLS correctly itself is not easy.)

To be clear, I'm not saying that there's no place for socket programming -- there definitely is. I've spent a good part of my life doing obscure network programming on all kinds of platforms, so I try not to use TCP/UDP unless I have a really good reason. (It's kinda the same reason I won't use C or C++ -- too much to worry about for most general purposes.)

<comment><USER7> Thanks for the reply. This gives me a better understanding of the issue here.

> connection setup and teardown

If there's no benefit in avoiding setting up and tearing down a connection with each request like one typically does with HTTP, then I can see how it might be an annoyance compared to making a single function call from a library that makes the request and returns the response.

> buffering

A parser should deal with that. It could be JSON parser.

> serialization

That's still a problem with HTTP. People typically use JSON for this and it doesn't depend on HTTP.

> byte ordering

parser/JSON's job.

> your own status/error handling, cache control, content encoding

That can be beneficial or it can be problematic. If you need such things, then yeah, it's cool to not have to think about making your own. However, if you don't or if your needs don't align with what HTTP provides, that can be problematic. For example, from a cursory search I see the following in the JMAP spec:

> Implementors must take care to avoid inappropriate caching of the session > object at the HTTP layer. Since the client should only refetch when it > detects there is a change (via the sessionState property of an API > response), it is RECOMMENDED to disable HTTP caching altogether, for example > by setting `Cache-Control: no-cache, no-store, must-revalidate` on the > response.

So, HTTP provides caching, but not the caching mechanism that's needed, so it's recommended to explicitly disable it completely.

With respect to status and error handling, it seems JMAP still had to define their own errors to be described in JSON[1], so not a perfect fit there either.

On the content encoding, I'm not sure if JMAP would use something other than application/json, so it seems like something that wouldn't need to be specified if one didn't use HTTP.

I know the discussion is not really about JMAP. I'm just using JMAP as an example on the above.

> TLS etc. (Simply, doing TLS correctly itself is not easy.)

I would hope that there's a library equivalent of the shell's:

      openssl s_client -connect $host:$port

I don't know why a library would have to be much more complicated. Maybe I'm being naive, but I think that if one wouldn't specify special TLS parameters to an HTTP library, then there's no reason why one would need to if they skip the HTTP library and go straight to using a TLS library. IOW, I don't see why an HTTP library would be more helpful on setting up TLS than using a TLS library directly.

[1] [https://jmap.io/spec-core.html#initial-jmap-error-codes- regi...](https://jmap.io/spec-core.html#initial-jmap-error-codes-registry)

</comment></comment></comment></comment></comment></comment><comment><USER9> What are the optimizations in JMAP that make it faster than, say, Solid? Solid is built on a bunch of W3C Web, Security, and Linked Data Standards; LDP: Linked Data Protocol, JSON-LD: JSON Linked Data, WebID-TLS, REST, WebSockets, LDN: Linked Data Notifications. [1][2] Different worlds, I suppose.

There's no reason you couldn't represent RFC5322 data with RDF as JSONLD. There's now a way to do streaming JSON-LD.

LDP does paging and querying.

Solid supports pubsub with WebSockets and LDN. It may or may not (yet?) be as efficient for synchronization as JMAP, but it's definitely designed for all types of objects with linked data web standards; and client APIs can just parse JSON-LD.

[1] [https://github.com/solid/information#solid- specifications](https://github.com/solid/information#solid-specifications)

[2] [https://github.com/solid/solid- spec/issues/123](https://github.com/solid/solid-spec/issues/123) "WebSockets and HTTP/2" SSE (Server-Side Events)

[https://jmap.io/](https://jmap.io/)

JMAP: JSON Meta Application Protocol [https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol)

Is there a OpenAPI Specification for JMAP? There are a bunch of tools for Swagger / OpenAPIs: DRY interactive API docs, server implementations, code generators: [https://swagger.io/tools/open- source/](https://swagger.io/tools/open-source/) [https://openapi.tools/](https://openapi.tools/)

Does JMAP support labels; such that I don't need to download a message and an attachment and mark it as read twice like labels over IMAP?

How does this integrate with webauthn; is that a different layer?

(edit) Other email things: openpgpjs; Web Key Directory /.well- known/openpgpkey/*; if there's no webserver on the MX domain, you can use the ACME DNS challenge to get free 3-month certs from LetsEncrypt.

[https://wiki.gnupg.org/WKD](https://wiki.gnupg.org/WKD)

<comment><USER10> > There's no reason you couldn't represent RFC5322 data with RDF as JSONLD. > There's now a way to do streaming JSON-LD.

Is there a reason you'd want to? I clicked all your links but I still have no idea what Solid is.

<comment><USER11> Here's another link to click -

[https://en.wikipedia.org/wiki/Solid_(web_decentralization_pr...](https://en.wikipedia.org/wiki/Solid_\(web_decentralization_project\))

</comment></comment></comment><comment><USER12> I clicked on this with a lot of hope — alas, this only seems to address the "mailbox access" part of E-mail. I think that part actually works fairly well today (not optimally, but well enough in practice). The part that really needs fixing is SMTP.

<comment><USER13> IMAP is a really broken protocol; I'd characterize it as a database synchronization protocol that wasn't designed to be one. You need to rely on certain extensions to have a hope of being bug-free [1], and even those can be problematic (UIDVALIDITY changed, gotta clear your entire inbox!).

[1] The IMAP protocol used to rely heavily on message sequence numbers, where each message in the folder was numbered sequentially from 1-N, and deleting messages caused all subsequent messages to have their number decremented by one. But you can have multiple connections active on the same mailbox, and you can't always immediately notify the other connections of when things get deleted, so every connection can have a slightly different mapping. So everyone uses UIDs now, which are guaranteed to be unique, until the server feels like deleting them all and restarting from scratch (i.e., updating UIDVALIDITY), so every message has a different UID now.

<comment><USER14> Where UID is used now sounds like a good use case for UUIDs (or GUIDs?) that don't ever change.

<comment><USER13> I don't specifically know the history of IMAP, particularly IMAP UID, but the semantics of UID to me implies that it was originally specified to permit its implementation as the file offsets into the mbox files that backed the store, and I believe some IMAP servers implemented it that way.

Some IMAP server implementations have a custom attribute they use to indicate a globally-unique message ID.

</comment></comment></comment></comment><comment><USER15> This is very exciting! It's been a long time coming.

Should we take this IETF blog post as an indication that the standardization work is almost done?

<comment><USER16> The core work is done, yes, draft-ietf-jmap-core-17 and draft-ietf-jmap- mail-16 [edit: fixed draft name] are in the RFC editor's queue, how long it takes to get through that queue can depend on a lot of variables. At the end it goes to "AUTH48" which is notionally 48 hours long but a few weeks is more likely in practice, and then it gets cut a number and becomes an RFC.

The Working Group still has open items, including calendaring (because people never can build a mail system that doesn't involve calendaring for some reason), handling "read receipt" type features and because this is Current Year a mechanism to involve WebSockets. Either those will eventually also be polished into standards, or they'll be abandoned at some point and undelivered.

</comment></comment><comment><USER17> There is so much NIH going on in this protocol, it's as if the authors we're completely unaware of modern HTTP API design.

They're not just doing IMAP over http, they invented their own error bodies, schema's , negotiation and RPC.

<comment><USER18> I think their goal is to have transport layer be a pluggable subsystem, divorced from their request-response protocol.

They even essentially say that HTTP is not necessary to their protocol, so I think it's pretty apparent that HTTP is a utilitarian choice, but they're not trying to build email-over-http.

<comment><USER19> _"pluggable subsystem"_

SOAP had same rationalization.

</comment></comment></comment><comment><USER20> Article uses the word "modern" 5 times, including in the title. Sort of a pet peeve of mine for this sort of thing. New does not imply better.

Article also mentions that JSON is used...

<comment><USER21> What drawbacks do you see in JSON here? For machine to machine communication it is a pretty good serialization format I would say (It is not great for many other things, but this sound like its strong point)

<comment><USER20> It seemed to me that the article was only using the fact of JSON use as more evidence of modernness. It implied that JSON didn't map that well into their problem space but they overcame.

<comment><USER21> In a sense they are right. Modernness in the sense that it is a well understood format and not a DSL with non-trivial semantics and parsing.

</comment></comment></comment></comment><comment><USER22> [https://jmap.io/#push-mechanism](https://jmap.io/#push-mechanism) JMAP going to use rfc8030 push for mobile and EventSource (kind of http long polling) for desktop clients, as I understood. I don't like that idea, it's even worse than IMAP4 IDLE. Why not just WebSockets for mobile and desktop clients?

</comment><comment><USER23> Looking at the request it contains properties like collapseThreads and sort, moving this sort of functionality server side is a regression. This is an API for hosted services, it's disingenuous to compare it to imap.

<comment><USER24> Do you see anything that should (or could) be done via IMAP but not via JMAP? Adding support for higher level operations to the protocol can be worth the complexity if it removes network roundtrips. Not everyone is lucky enough to have a reliable, fast, low latency link to his IMAP server.

<comment><USER23> > Not everyone is lucky enough to have a reliable, fast, low latency link to > his IMAP server.

This is a protocol from the 80's, I'm sure it doesn't require anything we'd consider a fast connection today, latency may have changed though, mail servers used to be geographically closer.

> Adding support for higher level operations to the protocol can be worth the > complexity if it removes network roundtrips.

It also benefits SaaS providers by having the complexity on their end and potentially limits apps. In my example of "collapseThreads" why does this need to be an option at all instead of something like "parentId" and leaving it up to the client?

More features also means more ways to abuse them, imagine google saying "yes we support JMAP in gmail" then ignoring certain features.

<comment><USER21> > This is a protocol from the 80's, I'm sure it doesn't require anything we'd > consider a fast connection today,

But it does require long lasting stable connections, which is what you want to avoid on a mobile that tries to connect for only a few second at a time and the go back to low-power mode.

</comment></comment></comment></comment><comment><USER25> Getting a FastMail subscription over a decade ago really has been one of the best tech decisions that I ever made. They are a great mail provider, and I am very happy that my money helps fund work like JMAP.

</comment><comment><USER26> Hopefully Microsoft Exchange protocol will become a thing of a past now. It is always the biggest problem of Linux desktop integration in Windows-only corporate ecosystem.

</comment><comment><USER27> Almost all email clients are no longer actively developed. Hardly anyone is going to implement it.

</comment><comment><USER28> Unpopular prediction: Gmail will never implement JMAP, so it's already dead in the water.

<comment><USER2> Why wouldn't Google implement JMAP? Interestingly enough JMAP adds support for Gmail-specific behaviors like labels, which IMAP lacks. This would allow other apps and services to better integrate with Gmail's quirky behavior, improving the experience for Gmail users.

<comment><USER29> IMAP doesn't lack Gmail's "labels", Gmail just never bothered implementing their labels as IMAP labels, leading to every IMAP client requiring horrible hacks to work around Gmail's inane implementation.

Google are unlikely to implement JMAP for the same reason they've:

\- ignored pleas to implement IMAP properly going back to its inception

\- have IMAP disabled by default for new users, and for most corporate users (requiring a GSuite admin to explicitly enable IMAP if employees want to access their corporate email with a client).

Google benefit massively from people not using IMAP clients and being forced into their product UIs.

That said, I wouldn't call it dead in the water for this reason. Google's tactics here have reduced the overall usage of IMAP clients, but they also serve as strong motivation for that small niche of users to move away from Gmail.

</comment></comment></comment><comment><USER30> Does it solve SPAM problem?

<comment><USER7> I haven't read JMAP, but I don't think that's the problem it's tackling.

Also, I think SPAM is as solved as it can be with blacklists, heuristics-based filtering software like spamassasin, and personal filtering with sieve scripts. What else would anyone suggest?

<comment><USER31> Spam could be half-fixed with forcing DKIM, SPF, DMARC and TLS. The very least there would be no impersonation of other domain names (filtering the rest into a spam box will become much easier after that) and insecure transportation then.

<comment><USER32> How would sender authentication solve the problem? A large amount of spam is sent from throwaway domains with SPF and DKIM in place, and another large part of it is sent through hijacked web sites and email accounts.

<comment><USER31> As I have said, it would very least avoid spam looking real from real domains, which is half of the issue. The throwaway part could be fixed by making spam illegal and actually cracking down on it.</comment></comment></comment></comment></comment>


Linux Is Coming to Windows 8 PCs... Slowly - <AUTHOR> http://ostatic.com/blog/linux-is-coming-to-windows-8-pcs-slowly

<comment><USER2> This whole UEFI secure boot thing is a deliberate attempt to lock out competing third party OSs. I'm surprised there haven't been antitrust inquiries in the US or EU about it.

<comment><USER3> This is a mischaracterization.

UEFI secure boot is not required to run Windows 8.

It is required to slap a Windows 8 logo on a new machine.

That is a decision made by hardware vendors, not Microsoft. Since it is hard to imagine a serious advertising campaign based around a competitor's lack of such logos, such decisions reflect the desktop Linux market.

I suspect that hardware vendors are happy to make desktop Linux harder to install because I vividly imagine indignant support calls from novice Linux installers adopting FOSS as an ideology.

<comment><USER4> To be precise, having an optional secure boot is required for the Windows logo certification. If it cannot be disabled, no logo certification.

See "Windows Hardware Certification Requirements for Client and Server Systems" [1], requirement "System.Fundamentals.Firmware.UEFISecureBoot", items 17 and 18.

[1] [http://msdn.microsoft.com/en- us/library/windows/hardware/jj1...](http://msdn.microsoft.com/en- us/library/windows/hardware/jj128256.aspx)

<comment><USER5> From your link:

> On non-ARM systems, it is required to implement the ability to disable > Secure Boot via firmware setup.

To be more precise, this is only true for non-ARM systems. This is evil, since it's entirely possible to have an ARM desktop/laptop, and I really hope there's some kind of anti-trust legislation here. At least Apple offers a way to boot into an alternative OS, even though it is still a bit locked down.

<comment><USER3> What way is offered by Apple to boot other OS's on their ARM devices such as iPads, iPods, and iPhones?

</comment></comment></comment></comment></comment><comment><USER6> It seems like what MS may be getting (or trying to get), at least in part, from this is a return to (or continuation of, I suppose) GNU/Linux as strictly an "enthusiast" OS. A BIOS tweak won't stop me, but it would definitely stop my mom.

I'm currently in school and I see a surprising number of students using Ubuntu, even outside the CS department. Not a lot, by any means, but more than I would have guessed. I wonder how many of them would be using it if it required a weird workaround or really anything more than "put the disc in and reboot".

<comment><USER7> > I wonder how many of them would be using it if it required a weird > workaround or really anything more than "put the disc in and reboot".

Well, "put the disc in and reboot" doesn't work right now on most PCs, does it? You have to go into the BIOS and change the boot order, or pull up the boot menu to make a custom selection.

<comment><USER6> It worked on the Thinkpad I bought a few weeks ago... I think most machines are configured to boot from the optical drive first. Even if there is a boot menu, that is still much less scary than having to hunt through a series of menus to find and change an obscure setting.

As we in this community are probably all aware, even small obstacles like having to enter a name or type a credit card number can drastically reduce conversion rates on the web. I think this is a reasonable analogue. Even objectively small obstacles can be important.

<comment><USER8> You said

> Even if there is a boot menu, that is still much less scary than having to > hunt through a series of menus to find and change an obscure setting.

My mom heard

> Even if there is a scary series of menus to find and change an obscure > setting, that is still much less scary than having to hunt through a series > of menus to find and change an obscure setting.

</comment></comment></comment></comment><comment><USER9> Aren't the only systems that are "required" to have UEFI Secure Boot--and to prevent end user disabling of this setting--based on ARM? I was under the impression that nothing had changed for the x86 architecture.

<comment><USER10> x86 vendors that want to qualify for the "Designed for Windows 8" logo program have to include UEFI secure boot and enable it by default, though they can allow users to disable it or install their own keys. That creates an extra hoop to jump through to install anything other than Windows 8.

ARM systems designed for Windows 8 have the same requirement, and additionally must not allow users to disable it or install their own keys.

<comment><USER11> >though they can allow users to disable it or install their own keys

Prior to the launch, Microsoft said it was actually _required_ that vendors allow Secure Boot to be disabled on x86.

<comment><USER10> Other way around: the original spec did _not_ require vendors to support disabling UEFI secure boot or using "custom mode" (meaning installing your own key). See <http://mjg59.livejournal.com/139232.html> for one reference to that: "Windows 8 certification does not require that the user be able to disable UEFI secure boot, and we've already been informed by hardware vendors that some hardware will not have this option."

Microsoft changed the spec in the wake of the controversy around UEFI secure boot. The current version of the spec (available from [http://msdn.microsoft.com/en- us/library/windows/hardware/hh7...](http://msdn.microsoft.com/en- us/library/windows/hardware/hh748200)) does mandate the ability to use custom mode or disable UEFI secure boot, for non-ARM systems only.

</comment></comment></comment></comment><comment><USER12> I wonder if this will have an implication for running Linux on Surfaces, I hope it does because they're a very neat (and affordable - inb4 Asus Transformer) piece of hardware but I have little use for another Windows machine.

<comment><USER13> The Surface doesn't carry the third-party signing key, so in the absence of a flaw in the firmware implementation you're not going to be able to run anything other than Windows.

<comment><USER12> That's great info, thanks. Disappointing but gratefully received.

</comment></comment></comment><comment><USER14> Reminds me of when apple switched to intel hardware and it was believed that you couldn't boot windows. Throw some money after it and people will find a way.

<comment><USER15> Booting Windows on x86 Macs (pre-Boot Camp) was mainly a problem of hardware support; Windows simply didn't support booting via UEFI in 2006, and Macs didn't ship with BIOS emulation.

Linux can boot on UEFI systems; the problem here is Secure Boot as configured on Win8 systems simply won't let you boot anything else without the proper signatures (or disabling it).

</comment></comment><comment><USER3> _"Installing Linux on most Windows 8 computers is still no easy task."_

Windows 8 Professional includes the Hyper-V hypervisor. Many PC's recent enough to have UEFI will have a compatible processor (i3 and later).

For many tasks a virtualized installation probably has adequate performance - contemporary hardware and Hyper-V are pretty powerful relative to the machines of a few tears ago.

Of course, for some, not booting directly to Linux might create a performance concern. For others it is an ideological issue. However, one which is created by the decisions of hardware vendors and market realities, not Microsoft.

<comment><USER16> While "virtualization of everything" seemed like a real future few years ago, at my experience of having Ubuntu installed as virtual machine for coworkers that use windows (but have to do python on linux) -- it completely suck. We ended out either having separate machines or just finding alternatives to windows-apps for those people.

<comment><USER17> I tried this at my office in August. When hosting the VM on my (somewhat old) laptop, raw performance was the issue -- there wasn't enough RAM and CPU to run both Win7 and the VM concurrently, and as an intern I couldn't justify the laptop upgrade.

When moving the VM to a server, the raw performance issues went away, but network lag became a pretty serious obstacle when using the GUI. In the end, I ended up just SSHing into the VM, and mounting part of its filesystem using Samba.

(And assuming that I had been able to get a working graphical environment, it's still a very low standard of "working." There are dozens of little annoyances when you're nesting a completely separate window manager inside your current window manager.)

</comment></comment></comment><comment><USER18> UEFI Secure Boot on ARM machines (Windows RT) cannot be disabled but this is to protect revenue, not the machine. This allows subsidized hardware, hoping that Windows Store app sales will make up for the loss. This is the same business model as the Xbox.

Secure Boot on x86/x64 machines is required to have an option to disable, or the machine will not get Windows 8 certified.

</comment><comment><USER19> One more pubkey/privkey layer I assume. Some people think that several locked doors are more secure. I shall say that several locked doors would be more secure if the time is limited for the intruder. We, from the hacking world, have a good amount of time to unlock this one more layer. Well well well, one more layer that does nothing but prevents computers from computing.</comment>


Gmail vs Pine - <AUTHOR> http://snarfed.org/space/gmail_vs_pine

<comment><USER2> "If no email is selected, the Y key should archive the email under the cursor. This should be common sense." Nope, bad idea. I inadvertently hit keys often enough that the message "No messages are selected" is engraved in my brain. Don't make these bad key hits do actions.

</comment><comment><USER3> If you click the little blue arrow in the top-right corner of an individual message, there is a "Filter messages like this" option. It has been there for quite some time. Also, marking a message as read is "<shift> \+ i".

<comment><USER4> You can also select messages that aren't on the screen. You click "Select: All" and then "Select all conversations that match this search".

</comment></comment><comment><USER5> Decent critique of Gmail, but the title seems a bit of a misnomer -- it really seems like an article about Gmail, with a few mentions of Pine thrown in. Given that it's presented as "X vs. Y", I would have at least expected the "Bad" and "Ugly" sections to have some comparison showing how Pine was better in those regards.

</comment><comment><USER6> I actually use Gnus and Mutt with my Gmail accounts, via the offlineimap <http://github.com/jgoerzen/offlineimap> Python app. It creates a (ridiculously huge) maildir and then I can freely browse it with Gnus, Mutt or any other MUA. It syncs read/unread, labels/folders, etc. both directions. It has filtering, renaming, and other nice stuff you can put between your maildirs and Gmail accounts.

I run it on a cronjob. With this setup, I get the great Gmail interface (and push support to my iPhone/Nexus One) when I'm on the go, and the lightning- fast Gnus/Mutt interfaces for blazing through mailing lists when I'm at a computer.

One problem is that sometimes offlineimap throws exceptions and doesn't finish a sync. I think it needs some touching up or updating. I haven't lost any data, though.

<comment><USER7> Would you mind posting your offlineimap and Gnus configuration (sans passwords) somewhere. I've had a few false starts with Gnus and always get lost customizing something. Maybe there's a nice tutorial for this somewhere?

<comment><USER8>
      ;; Gnus
      ;; . http://jfm3-repl.blogspot.com/2007_12_01_archive.html
      (setq mail-user-agent 'gnus-user-agent)	     ; always use gnus for email
      (setq message-send-mail-partially-limit nil) ; never split messages
      (setq message-signature nil)		     ; no .signature
      (add-hook 'message-send-hook 'ispell-message) ; spell check on sent

      ;; . encrypt .authinfo file
      (require 'epa-file)
      (epa-file-enable)
      (setq epa-file-cache-passphrase-for-symmetric-encryption t)
      ;; .  define mail/news sources
      (setq gnus-select-method '(nnnil "")
          gnus-secondary-select-methods
            '(
    	  (nnml "")
    	  ;; to add rss: type G R in *Group* buffer; when asked, paste url
    	  (nnimap "gmail"
    		  (nnimap-authinfo-file "/path/to/.authinfo.gpg")
    		  (nnimap-address "imap.gmail.com")
    		  (nnimap-server-port 993)
    		  (nnimap-stream ssl))
    	  ))
      ;; Accessing the [Gmail] folders http://www.emacswiki.org/emacs/GnusGmail
      (setq gnus-invalid-group-regexp "[:`'\"]\\|^$")
      (setq gnus-ignored-newsgroups "")
      ;; After that, S s to the groups as specified above. Before doing
      ;; anything else, G c configure each Gmail line, and hit [done]. Gnus
      ;; will pick up "another" group, this time without the nnimap+gmail
      ;; designator. C-k the old group and it works! (I don't know why; I
      ;; originally wanted gcc-self "nnimap+gmail:[Gmail]/Sent Mail" on
      ;; INBOX and this was the easiest way to arrange that. Magically, it
      ;; picked up the new INBOX and everything worked, even across
      ;; sessions.)

      ;; . save sent items
      (setq gnus-message-archive-method '(nnimap "gmail"))
      (setq gnus-message-archive-group "nnimap+gmail:[Gmail]/Sent Mail")
      (setq gnus-gcc-mark-as-read t)
      ;; .
      (setq gnus-thread-sort-functions
          '(gnus-thread-sort-by-number
            gnus-thread-sort-by-date
            gnus-thread-sort-by-total-score))
      (setq gnus-summary-line-format
          "%U%R%z %d %I%(%[%-25,25n%]%) %s\n")

</comment></comment></comment><comment><USER9> The single reason that I choose gmail over desktop clients are the conversations - the ability to see all email _bodies_ of one email exchange in a single page is indispensable for me. Another smaller reason is a search. If some desktop client would implement conversations (but by displaying email bodies, not only headers like Outlook or Thunderbird do), I would probably switch.

</comment><comment><USER10> How old is this article? It says April 2010 at the top, but most the comments are from 2005-2006.

<comment><AUTHOR> I think it's from 2005. The Gmail logo he uses still says 'beta', and he links to this blog entry from 2005: <http://www.zeldman.com/daily/0405d.shtml>

<comment><USER11> The last releases of Pine appear to be in '05 too.

<comment><USER12> Univ of Washington switched to an Apache License, and started calling it "alpine". Last release appears to have been in August 2008: <http://www.washington.edu/alpine/changes.html>

</comment></comment></comment></comment><comment><USER13> It's interesting that so many of his issues still apply.

My personal beef: have you ever had a message mis-identified as part of a conversation? Or, ever had someone reply to a message with a slightly mangled subject line or other hint to GMail that it's a separate discussion?

I will declare my undying appreciation for anyone who tells my how to manually separate a message from (and alternatively, attach a message to) a conversation.

The inability to "bounce", ie. re-send, was also very jarring for my personal workflow. I understand why it's not there by default, both from a user understanding perspective and from a technical "don't break SPF/DKIM" one, but it's unbelievably annoying not being able to "bounce" a message from account to another (ie. from an apps account to a gmail.com account, for example).

I'm surprised to see so many people who are happy with Gmail's labeling; conceptually, tagging email is fantastic, but the UI experience in Gmail is awful. (Too much friction is involved. When I sit down to label something I don't want to select one or two from a drop-down, I want to just type a series of applicable tags in one shot, perhaps with a bit of ajax auto-fill-in. With so many other nods to keyboardists elsewhere, this still surprises me.)

Not that complaining about this stuff on HN will address any of it for me. ;)

</comment><comment><USER14> I got to agree about the lack of "bounce" - I could never move my work email to gmail for that reason alone (not to mention my preference of writing emails in my native editor).

<comment><USER15> I was a little confused by this one - what's the usecase for manually bouncing mail?

<comment><USER14> Sorry, "bounce" is the command for "Resend mail" (not rejecting email) in a lot of unix mailers. Say A sends an email to B who sends it to C.

If B forwards it to C, the email appears to come from B. If B "bounces" it to C, the email appears to come from A.

(it's the Resent-to header in RFC 822 IIRC)

So say you get a bug report from A than you know only C can fix, by bouncing it to them they get to easily reply directly to A and get on with it, leaving you out of it...

</comment></comment></comment><comment><USER16> And there is room for improvement in gmail yet. I've always been incredibly frustrated by gmail's inability to forward complete conversations. Here they are, all together. And now I can forward them to someone, one at a time, or I can... do what? Go to "print", copy the HTML output back into an email?

<comment><USER17> Actually, isn't there a 'forward all' option now? I know I've used it several times.

<comment><USER16> Oh, thank you, I haven't realized that they added this!

</comment></comment></comment><comment><USER18> Old as the article may be, if anyone is interested: <http://sup.rubyforge.org> is a gmail-inspired command-line mail client. Threading, tagging, full-text search, hooks etc.

<comment><USER19> And it has one of the best IMAP-centric rants, ever:

<http://sup.rubyforge.org/svn/trunk/lib/sup/imap.rb>

"fucking imap fucking sucks. what the FUCK kind of committee of dunces designed this shit."

Classic.

</comment></comment><comment><USER20> Using Labs "Mark as Read Button" will reduce the steps required to mark messages as read to two steps (mentioned as the first in ugly)

<comment><USER21> Alternatively, you can type <period><down><enter>. Period opens the "more actions" menu and you can then use arrows/enter to navigate the menu.

<comment><USER22> Even better, just hit Shift+I ...

</comment></comment></comment><comment><USER23> the last thing I need switching from gmail to pine :)</comment>


New era of fast genetic engineering - <AUTHOR> http://www.newscientist.com/article/mg22129530.900-right-on-target-new-era-of-fast-genetic-engineering.html#.Uuf4hXfTlok <comment><USER2> >This is not a problem that can be solved by computers. Ultimately, there is only one way to be sure what a particular bit of DNA does – you have to alter it in real, living cells to see what happens.

Ah, the old "comment out this line" style of understanding code.

<comment><USER3> The debugger hasn't been born yet.

</comment></comment><comment><USER4> For those who are in this field, I have a question, and will be grateful for an answer. How far-reaching is this technique can be for Cancer treatments? I understand Cancer is not a simple disease that can be delineated.

<comment><USER5> As a researcher in the field, it's a big question. There are lots of answers. Most of the time, the answer will be, 'maybe, and maybe more if we can get it to the right place at the right time - but it's often hard to know where/when that is'.

More specifically, and more concretely, there are certain kinds of cancers (and diseases/disorders) that this will be very effective against. And some advanced iteration of this technology will be curative - entirely. This is of an entirely different kind of medicine than bathing trillions of cells in a potent chemical in the hopes that one of those molecules might slow another molecule - somewhere. This kind of genetic engineering would enable a biological feature to be entirely restored, changed, or removed.

Those cancers this will be effective against are those where a particular, knowable, and targetable gene has a known and particular mutation. And this is actually a large class of cancers. Cancers often initiate as mutations that destroy the elaborate series of 'checkpoints' your body has instituted to prevent runaway growth. If one of those proteins that guards against runaway growth gets damaged, then there are far more ways to get cancer. If you can repair that checkpoint (via (genetic) therapies), you can halt, slow, or even destroy what caused that (particular) cancer. The analogy of the cells in your body as a society is not a bad one. And cancer, as a 'criminal' is not particularly dangerous to the whole. It only becomes dangerous when the police, the courts, and the military are also crippled. And we have learned _a lot_ about how those regulatory objects function in the past two decades. However being able to restore them or affect them in a living being has been orders of magnitude more difficult than simply watching to see what they do. It would be fair to say we know understand most of the key elements, and many of the details of their roles of what's happening in the society of your body. However making direct changes to that society in a living being is still tricky, and our tools blunt. What you see here is the sharpening of these new tools - tools that offer the opportunity to restore (or improve) those regulatory objects to a broken system.

To say it another way - there is no way I could imagine a cancer to be 'cured' by small molecules (alone). Small molecules work great against 'the different' \- but by definition, cancer is not different from its host. I think this is why the drugs of the 20th century were so ineffective against cancer while simultaneously so effective against parasites, bacteria and even viruses for the most part. The only way I could (from first principles) expect to prevent or alter a process like cancer is using tools like the ones talked about here.

<comment><USER6> How can knocking out a certain gene (for all cells in your body) kill a cancer cell? For instance, for many cancer cells with a defect in 'P53' (a gene which can induce cell death), knocking out this defective gene would not help - would it?

Or would you need a two step process, like a molecule which connects to the marker and then use a second step to knock-out a gene essential for cell survival? Or can this technique be used to repair a certain gene?

<comment><USER5> The most interesting part of the above tool is not its ability to _knock out_ a specific gene, but its ability to knock out a _specific_ gene. The key word is 'specificity'. Knocking out is just the easiest proof of principle thing you can do once you find a sequence. Finding it with specificity in a live organism is the magnificent part.

There is an entire field dedicated to editing genetic code - and it's getting really good. The issue is targeting it to the right spot in a live organism (and conversely, not targeting your editing machinery to the wrong spot). If you can get to it, there's lots you can do besides knocking out a gene. If we call the p53 gene the judge or head executioner in our scheme above, it's finding him that's the problem. If you can pinpoint the corrupt judge, you can easily (relative to finding him) install a replacement. What you don't want to do is accidentally replace your police force or your teachers with judges/executioners (even if they're good ones) - and that ability to target is the greatest issue with engineering the genetics of live cells currently.

(As a side note, this is EXACTLY what the HPV virus does - it runs around assassinating that judge with relentless precision - and thus is a prime cause for allowing cancer to run rampant. The vaccine against HPV prevents these assassinations.)

Further, and only slightly more in the future, once you have access to the genetics, you can start to run logic programs inside the cells. You can start to release the (genetically encoded) tools IFF the cell is $cancerous, where $cancerous is defined as a further set of genetic conditions within the cell. In this way you could surveill the entire society while only targeting the bad guys.

<comment><USER6> Right! I wasn't aware that the editing process is quite easy once you can target a specific gene. Awesome! :)

<comment><USER7> Specifically, you can target just the _defective_ version of the gene. In theory, your good copies could be ignored, only removing the bad genes from the cancer tissue.

However, I don't think that this will ever be applied on a whole-body scale because the off-target effects aren't well characterized at this point. That is, of course, unless you have a bad cancer and have no other options. At that point, having off-target effects is the least of your concerns.

The problem with gene editing in this context is that the changes are permanent. So if you miss and edit a good cell, that cell is now damaged, or may only have 1 good copy of a gene, and thus be more susceptible in the future. In some cases, shRNA to silence a gene may prove more effective because it is temporary.

Right now these are only used in the lab for research.

</comment></comment></comment></comment></comment></comment><comment><USER8> As a futurist, I love reading quotes like this:

"What used to take two years or more can now be done in six weeks, says Zhang. "That's a big difference." For those who have spent years trying to make just one or two specific changes to plants or animals, this is revolutionary.

<comment><USER9> What's a "futurist"?

<comment><USER2> The parent is obviously a "social scientist whose specialty is to attempt to systematically explore predictions and possibilities about the future and how they can emerge from the present, whether that of human society in particular or of life on earth in general." Obviously. [http://en.wikipedia.org/wiki/Futurist](http://en.wikipedia.org/wiki/Futurist)

</comment></comment></comment><comment><USER10> I find it amusing that the underlying technology that made this study possible was patented (end of page 1), but that a royalty free alternative solution was found. In science people are often quick to patent each new breakthrough, which sometimes just prevents other scientist from building on that initial breakthrough. I think it is an important lesson to realize that not every new discovery is worth patenting. Perhaps only when a technology is truly ready to be brought to market in the foreseeable future should a patent be considered. Otherwise, the patent could become a distraction to the importance of the breakthrough itself.

<comment><USER11> All the technologies described in this article have many competing patent claims by academics at Harvard, MIT, Berkeley, and a few others. Obviously it's hard to tell right now which patents will go through, but I'm pretty sure they won't be royalty free. The main difference is that the procedure is now so easy that most academics will just infringe.</comment></comment>


In a First, Renewable Energy Is Poised to Eclipse Coal in U.S. - <AUTHOR> https://www.nytimes.com/2020/05/13/climate/coronavirus-coal-electricity-renewables.html <comment><USER2> Hopefully, the investments we're seeing in nuclear will help make it (politically) competitive again to fill the need for baseline power that natural gas is filling. Lower costs to build a plant would lower the activation energy needed to get plants running, non-weaponizeable fuels would help geopolitically, amd especially decreased or less dangerous nuclear waste would be politically hugely important. In the absence of a breakthrough with fusion, fission power could go a long way to cutting carbon emissions

</comment><comment><USER3> In the electricity sector, yes. Not so much when it comes to process heat and district heating.

Renewables still contribute less than 10% to the overall energy consumption in the US:

> > [https://www.youtube.com/watch?v=31Bi2LpLoK8](https://www.youtube.com/watch?v=31Bi2LpLoK8)

In Germany, where renewables already contribute up to 40% in the electricity sectors (13% of the overall energy consumption), the emissions in the electricity sector are still very bad with up to 600 grams of CO2 emitted per kWh while France emits only 50 grams on average. At the same time, a kWh costs around 30 cents per kWh in Germany while the price in France is half of that.

> [https://www.electricitymap.org/](https://www.electricitymap.org/)

> > [https://www.globalpetrolprices.com/Japan/electricity_prices/](https://www.globalpetrolprices.com/Japan/electricity_prices/)

See also this study which has researched the negative effects of Germany's outphasing of nuclear and the switch to renewables:

> [https://www.haas.berkeley.edu/wp- > content/uploads/WP304.pdf](https://www.haas.berkeley.edu/wp- > content/uploads/WP304.pdf)

What we need is nuclear, it saves lives:

> > [https://www.giss.nasa.gov/research/briefs/kharecha_02/](https://www.giss.nasa.gov/research/briefs/kharecha_02/)

Renewables cannot and will never be able to power an industry nation unless the country in question has the possibility for large hydro power plants.

But hydro power has dramatic negative effects on nature and humans:

> [https://www.internationalrivers.org/resources/the- > forgotten-...](https://www.internationalrivers.org/resources/the-forgotten- > legacy-of-the-banqiao-dam-collapse-7821)

> [https://www.middleeasteye.net/discover/turkey-ilisu-dam- > hasa...](https://www.middleeasteye.net/discover/turkey-ilisu-dam-hasankeyf- > water)

<comment><USER4> > Not so much when it comes to process heat and district heating.

Are you saying we are using more _coal_ than renewables for heating? Or are you comparing all fossil fuel usage v. renewables?</comment></comment>


A Simple Cell Phone - <AUTHOR> The reason you all clicked into this message is because thats what we all want. I'm tired of apple, google, etc...
I want a startup to create a cell phone that frees my data to whomever i want (dropbox, gdrive, etc..) , allows me to chose whatever integrated messaging platform i want (whatsapp, something else you guys start), allows me freedom to pick companies and brands i trust for all parts of that...
I don't have the hardware skill set, but if anyone does, i'll join that mission.
We need to create a phone for humans... not for people to mind control us. <comment><USER2> This probably is not quite what you are looking for, but Walmart has sub-$30 pay as you go phones. They are not smart phones, just traditional flip phones.

Mine was $12 but they discontinued that one. It works great, long battery life, can't do "apps". If someone sends me malware, the phone just throws up some binary as text in the message or says "I cant display this".

</comment><comment><USER3> You might want to look into Librem [https://puri.sm/](https://puri.sm/) , it's quite an exciting project</comment>


Show HN: Likely Target – News liked by others who share your interests - <AUTHOR> http://likelytarget.com/

<comment><USER2> Great idea, I can't tell you how tiring I'm finding the one-dimension "trending" trend as it provides exactly no value to me.

But this has always been a pretty challenging thing to make work so I appreciate the attempt.

Does the front page rank by overall votes? Seems to me it might make sense to randomize by diversity of link upvote/downvotes (maybe the more divisive links?) as I'm having a hard time finding stories I'm interested in and they do seem rather too similar.

<comment><AUTHOR> Thanks! There's no front page; every page is unique. Before you vote the page is a random selection of the most popular stuff. After voting you also get related links. It'll need more users before it'll really shine.</comment></comment>


Ask HN: A QR code generator that allowed you to edit the image inside it. - <AUTHOR>

Could someone possibly link me to it then bury the topic? Sorry if this isn't appropriate, I need it for an event I'm helping to organise. <comment><USER2> <http://research.swtch.com/qart> ???</comment>


When Pigs Fly: Apache Pig, Open Source and Understanding Systems - <AUTHOR> http://sna-projects.com/blog/2010/06/when-pigs-fly-apache-pig-open-source-and-understanding-systems/

<comment><USER2> Glad Russell wrote this up, he has been doing some cool things with Pig, Voldemort, & Ruby lately.

</comment><comment><AUTHOR> This blog post was a phase I LinkedIn Analytics interview. If you read to the bottom, you passed. Contact us to proceed to the next stage.

<comment><USER3> Well I have interest but no experience ;)

</comment></comment><comment><USER4> very worth the read, cool stuff</comment>