First Krita Beta for Android and ChromeOS in Play Store - <AUTHOR> https://krita.org/en/item/first-krita-beta-for-android-and-chromeos-in-play-store/ <comment><USER2> I'm not an artist myself but I follow David Revoy, who [0] uses Krita and other open-source software extensively for his Pepper & Carrot comic [1]. His blog [0] is full of posts about how he does his work using open-source tools.

There are plenty of fantastic artists who use Krita but I find him interesting because of how dedicated he is to using open-source software for all his work.

[0]: [https://www.davidrevoy.com/](https://www.davidrevoy.com/)

[1]: [https://www.peppercarrot.com/](https://www.peppercarrot.com/)

</comment><comment><USER3> I'm surprised, speaking as the maintainer of Krita, to have a first video review already: [https://www.youtube.com/watch?v=D7oFUmVfiww](https://www.youtube.com/watch?v=D7oFUmVfiww) :-)

<comment><USER4> The review mentions that the screen is a bit small for all of Krita and suggests that using something like a big iPad probably provides a better experience.

As this is only about Android I thought of promoting my take on this problem. In fact I released a small program I use to take handwritten notes via iPad on my Linux system just a few weeks ago. It works on both Android and iOS and basically turns these devices into graphic tablets. You can take a look at: [https://github.com/H-M-H/Weylus](https://github.com/H-M-H/Weylus)

</comment></comment><comment><USER5> Congrats for the release!

I love Krita. Actually, my kids love it so much. I've had a Wacom tablet for years and thanks to Krita my kids are expanding their artistic skills rapidly. I wish the people behind it all the best!

<comment><USER6> I wish more parents bought their kids drawing tablets. Kids try out all kinds of things, but it's hard to try out something that you don't have the equipment for. Sure, drawing on paper is a possibility, but it's not quite the same thing as digital art that tends to be much easier to share and get feedback on.

<comment><USER7> The leading brand is quite expensive (at least here in Germany), especially when it comes to reasonable sizes (A4/letter). I've been putting this off for years.

Finally - a few months ago - I aquired something remarkable cheaper, a chinese Gaomon M106K. It turned out, it is not cheap at all in the other sense of the word. Good quality and support at least for my use case (a bit different, handwritten formulas and sometimes some sketched diagrams). But my youngest kids use it for painting with Krita too.

<comment><USER8> Nobody wants A4 tablet trust me its not worth it. Ive seen so many pros replace them with A5 or even A6 because its better and more convinient.

On the other hand any other brand than the leading brand is truly terrible.

<comment><USER9> Actual pros replace them with cintiq or similar and are always larger than A4. I've never seen a full time designer move down size, because you lose fidelity at the same zoom level and are constantly fiddling with zoom which is a source of major frustration

<comment><USER8> Of course you want cintiq as big as possible but not tablet. With A4 you get to a point where you have to move a lot around the table with hand in front of you while you are looking straight at your screen its just akward. You dont have space for keyboard etc.

<comment><USER10> An illustrator friend bought an A3 Wacom years ago. It was so big that if you put legs on it it'd be a reasonable sized desk by itself.

He ended up changing the mapping to only use a small portion near the front as he could barely reach the back.

<comment><USER7> I'm doing this for my A4-sized tablet too. At times. I still have the option (and I'm using it) for the full tablet area. I don't have this for the postcard-sized scribblers.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> >Unlike the Windows and Steam store, we don't ask for money for Krita in the store, since it's the only way people can install Krita on those devices, but you can buy a supporter badge from within Krita to support development.

I wish more free software projects would do that. You can download Krita for free but if you want to support the project you can buy it from Steam or Windows Store.

<comment><USER12> If you know about the project you can donate the money to them directly to avoid Steam/Windows taking a cut, but for lots of people who dont want to worry about updating their software it gives you something in return for the donation.

</comment></comment><comment><USER13> People really should give Krita a go if they want escape the Adobe bubble. I was really impressed with it for drawing over GIMP.

<comment><USER5> I completely agree with you on this. I was considering GIMP as the only relevant substitute for Adobe until I've played a bit with Krita. Really amazing piece of work.

<comment><USER7> To be fair, GIMP considers itself also an image processing software, not (or only partially) a painting program. At least, it emphasizes this aspect and it shows (yes it mentions also artistic usage).

I'm using it this way as a tool (being a software writer in this industry), but the tasks belonging to it and those for Krita have a virtually empty intersection.

<comment><USER13> You're absolutely correct, but you know how these things go: people look up FOSS Photoshop (or more likely "free photoshop alternative") on a search engine and GIMP is the first hit and when the tools for drawing aren't as sophisticated, users will say "GIMP sux" because it doesn't match their expectations if they're a drawer even if it's a perfectly adequate image processor.

</comment></comment></comment></comment><comment><USER14> Awesome news. This part caught my attention though:

>Unlike the Windows and Steam store, we don't ask for money for Krita in the store, since it's the only way people can install Krita on those devices, but you can buy a supporter badge from within Krita to support development.

I don't know about the Windows store because I don't use Windows, but doesn't the Steam store allow you to put up free tools? Godot Engine is available for free on Steam, IIRC.

<comment><USER15> Yes, what they mean is that on windows you can get krita for free outside of the windows store or steam. While on Android most users are stuck with the Google Play store because it's very difficult to use another store.

<comment><USER16> You are thinking of iOS. On Android using a different store or sideload is easy.

<comment><USER17> >On Android using a different store or sideload is easy.

Asking users to use developer mode is not easy, and a huge barrier to entry that most would just not bother and download something else from the Play Store instead.

<comment><USER18> Developer mode has never been required on Android. App sources are managed by regular settings (Android 8+). Before that, there was a single switch for all non-Play-Store sources.

1\. User downloads an .apk using a browser

2\. User tries to open it

3\. Android prompts the user to allow the browser as a trusted source

4\. User agrees by flipping a switch

5\. Installation resumes

6\. User enjoys the app

[https://developer.android.com/distribute/marketing- tools/alt...](https://developer.android.com/distribute/marketing- tools/alternative-distribution)

[https://android.gadgethacks.com/how- to/android-101-sideload-...](https://android.gadgethacks.com/how- to/android-101-sideload-apps-by-enabling-unknown-sources-install-unknown- apps-0161947/)

<comment><USER19> This is not a great substitute for installing through an app store because the app will not update automatically.

This is, however, a great thing to have.

A better substitute would be using F-Droid. By the way, some free software apps are not gratis on the Play Store but are on F-Droid.

It can still be confusing to manage two app stores for some people, while installing an app from a downloaded executable is usual on Windows, so Krita probably did the right thing.

<comment><USER18> Good question: why is Krita not on F-Droid? Probably a matter of time and effort, not a technical reason. I guess they sensibly got into the most visible marketplaces first.

<comment><USER20> Exactly, it is on our plans, would take a bit of time.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> ur-whale Fantastic news.

Just installed this on my Galaxy tab. It still has some rough edges, but it is miles ahead of all the drawing adware I had used so far.

Oh and, thank you Krita developers: it actually feels like a desktop app (as in: you can load and save files, and there's an actual "exit" button").

<comment><USER21> Thanks a lot as well! Got Galaxy Tab S6 for drawing and the software available on Android has not really been that good when compared to what is available on desktop Linux with Krita, Mypaint and others. :)

</comment></comment><comment><USER22> Tried it out. Loved it. I have one of those moderately expensive Samsung Chromebooks with its own pen, and the pressure sensitivity stuff works great. I can see myself building an art workflow around my Chromebook with Krita. Previously the only options on Chromebooks or Android were proprietary apps that had ads, including Autodesk Sketchbook which I used to love but they added ads, DeviantArt integration, and nerfed the UX.

So getting an open source, full-featured alternative is fantastic for me.

<comment><USER23> They have ads on autodesk sketchbook? When I had an android phone I paid for it and they made it free a few months later. Now I am on iphone and even the free apps have much less ads.

<comment><USER22> It was years ago and I forgot what change they made. It was either ads or "sign up for a free account". Whatever it was, it pissed me off -- and enough others that Autodesk apparently walked it back.

It only stressed to me the need for an open-source solution -- which Krita on Android fills nicely.

</comment></comment></comment><comment><USER24> I bought a Wacom tablet to use with Krita and have been totally unable to figure out how to make it work. Every tutorial/video out there is for Windows and most of the settings that affect Krita are done in a windows setting area. I use Fedora/Gnome and don't have access to that level of settings (tho there are some settings available through Gnome via libwacom, which itself is awesome).

Anyone using Krita with a Wacom tablet under Linux? How do you draw?

<comment><USER25> Yes I am using Krita with wacom on Linux. On linux wacom and most other tablets are just plug and play. They just work. krita is just a click away from the software center.

<comment><USER24> How did you configure Krita? I see almost nothing in the "tablet settings" section besides pressure. When Krita has focus and I draw on the tablet, it does nothing. Every other app treats the tablet like a mouse.

<comment><USER26> Every other app treating the tablet like a mouse is the normal and desired behaviour. As others said, Wacom tablets on linux should just be plug and play. I literally just plug it in, open krita and start drawing. Big difference from the literally hours I spent on macOS trying to find the right drivers for this older model.

I would add that I did have some issues with the Flatpak version of Krita where the tablet didn't draw as expected. Replacing it with the standard deb from apt repositories fixed that though.

</comment></comment></comment></comment><comment><USER27> Aw, it does not work well on mobile phones, because the dialogues are cropped and unscrollable. I am going to keep an eye on it though, some apps like sketchbook are somewhat working but they are limited. Having krita equivalent for the phone would be awesome.

<comment><USER28> I have yet to find something that works better than medibang for all around doodling on phones and tablets. However, I'm excited to keep an eye on this as well.

<comment><USER21> AFAIK Ibis Paint targets Android smartphones, possibply even as their main target. They have various helper tools for finger based drawing and even their tutorial videos are dony by hand on a normal size smartphone (eq. not on an Android tablet with precize pen support).

</comment></comment></comment><comment><USER29> Congrats Krita team for Android tablet release!

I bought a pen tablet with screen recently, the Gaimon PD1161. Incredibly cheap compared to the Wacom Cintiq, and it works great with Krita (on Windows). My girlfriend uses it all the time now: [https://www.youtube.com/user/PapillonMarianne/videos](https://www.youtube.com/user/PapillonMarianne/videos)

</comment><comment><USER30> Just reiterating the same point - Krita plus a drawing tablet is a perfect combination for kids. It handles both drawing and animating really well.

<comment><USER31> The symmetry drawing mode is amazing for kids to play with. Any scribble becomes instantly pretty.

</comment></comment><comment><USER32> In the last 6 to 9 months I have been learning Drawing (Pen/Paper), Digital paining (Krita) and 3D modeling (Blender) in my free time.

I must say, I had to try very hard to not explore Photoshop and other 3D tools, It wasn't easy when I see most professionals using Photoshop, 3DS, Maya, etc. From time to time i get frustrated with low quality Youtube's tutorials, numerous times I had to remind myself to have patience, and stick with Krita & Blender.

Now I in love with Blender, and getting used to like Krita with Wacom table.

</comment><comment> Maha-pudma I'm interested in starting drawing on my computer. What tablet is best for Linux?

<comment><USER3> Wacom. The very, very best is a second hand Wacom Intuos 3, if you can get a few spare pens. That's before Wacome started adding all kinds of smart interpolation curves to the tablet hardware itself. My Intuos 3 is eleven years old and going strong. We got it back then: [https://dot.kde.org/2007/11/16/art-tablets- krita](https://dot.kde.org/2007/11/16/art-tablets-krita)

<comment><USER33> I'm curious: what do these smart interpolation curves do, and why do you consider them bad?

<comment><USER3> They change the inputs to the painting application in a way that the user cannot influence; the app no longer gets the raw hardware take, but something that's "improved" and "smoothed out". And that's limiting. We can do our own smoothing, thank you very much, and leave the amount to our user's discretion.

</comment></comment></comment></comment><comment><USER34> Been using Krita for a few weeks, UI looks quite similar to Adobe stuff, it's better than GIMP for out of box drawing if you're a beginner.

I also got a Huion H1060P which works better than I expected.

It's actually got me craving for drawing on paper again too, and it's great because of psychological drawing barriers because this way I can hide all my mistakes on my hard drives. And it's a steep curve, like learning to program.

</comment><comment><USER31> Unfortunately this crashes immediately on my Galaxy Note 12.2.

<comment><USER20> Please open a thread on [https://krita-artists.org/](https://krita- artists.org/) so that we can help

</comment></comment><comment><USER35> Great work team Krita!

I wish there was a mode conducive to less control and creativity a la ArtRage. I am not a professional digital artist and all the control that digital drawing platforms have encumbers my creative workflow. Any chance we'll get this in Krita? In ArtRage for example colors interact more like in real life and don't need to separate objects in layers but just paint over the way layers naturally happen.

</comment><comment><USER7> Not a support forum here - but does someone know, if there are ways to resize UI fonts for the Windows Krita application without touching the Windows setting for the whole monitor?

The only way still working for me is an arcane - in fact deprecated for a long time - Qt environment variable (QT_DEVICE_PIXEL_RATIO), that makes a difference for at least a portable Krita installation.

<comment><USER12> This is a big deal. If you use a display drawing tablet, the likelihood of it having the same resolution as your display monitor are becoming less and less, and if I can't scale krita on its own the UI becomes a mess.

<comment><USER3> We're really dependent on the Qt framework here. And they've been messing around with hidpi support for ages, and never, ever get it really right. The current state, in 5.15 is still "fractional scaling, well, deal with one pixel gaps between decorations in widgets (like lines).

</comment></comment></comment><comment><USER36> Congratulations Krita.

But, Play store is showing that "Device is incompatible" to my phone. Is this restricted to Tablets?

Another suggestion. Can't Mobile compatible UI be created (using MAUIKIT/Qt) so that Krita can become best image software for phones too ?

<comment><USER20> Yes only for tablets and chromebooks for now.

It uses Qtwidgets and mauikit qml so it would be a heck of a job to port that to qml

<comment><USER37> Why not publish it for phones too? Something to do with UI polishing (widget arrangement, responsiveness)?

I have a phablet (6+ inches, high resolution and DPI) with pressure-sensitive stylus and I'd love to see Krita running on it, even if the UI is not optimized yet.

<comment><USER38> If your device supports OpenGL ES and is Android 6+ You can get signed APK for your phablet from here: [https://krita-artists.org/t/making-and-testing-the- android-b...](https://krita-artists.org/t/making-and-testing-the-android- build-from-source/436/101)

</comment></comment></comment></comment><comment><USER39> Congratulations, on finally having a tablet version of Krita. I think years ago they planned to make one for Windows Phone but we all know what happened there.

Looking forward to the phone version.

</comment><comment><USER40> What development tools/framework did they use to write it?

<comment><USER38> Krita is primarily C++/Qt based. Qt does technically support Android. So any app written in it could work, but nevertheless, it was imperative to tweak Qt code to get Krita useable on Android. :-)

</comment></comment><comment><USER41> This sounds great for the kids. Does anyone have experience of the combination Wacom/similar with a (cheap) Chromebook?

<comment><USER42> I got my daughter a Huion tablet and a laptop in the Chromebook price range. It did take a bit of work to get everything working for her in Linux, but it works great. She loves it and draws a ton.

I also bought a HP Spectre x360 recently. Krita works really well on it too.

</comment></comment><comment><USER43> According to screenshots Android version is tablet only. Also, store says "device incompatible" (Samsung S8+)

<comment><USER20> Android Tablets and Chromebooks, the ui isn't much usable for smartphones

<comment><USER5> It's a pity it doesn't work on Samsung Galaxy Note devices. With the "built in" pen it would be a spot on despite the smaller screen size.

</comment></comment></comment><comment><USER44> Desktop Android just got better. Now we need a touch monitor with a good pen.

</comment><comment><USER45> What are the best Chromebook and tablet to run this on?

<comment><USER21> I would say for Android tablets Galaxy Tab S6 is still the best bet for drawing.

</comment></comment><comment><USER46> Many ChromeOS devices do not support Android apps.

</comment><comment><USER47> Kudos to your guys!</comment>


Ask HN: Packet interceptor - <AUTHOR> What are the best network packet interceptor for Mac? I would like to know what is happening on my machine. <comment> a-fried-egg Wireshark

</comment><comment><USER2> tcpdump -i any -vv -nn -w - | strings. And let's of course not forget sysdig. I believe they have a Mac version</comment>


Show HN: Use Chrome Headless in the Cloud from the Browser - <AUTHOR> https://webautomation.guru/?hn=1 <comment><AUTHOR> Some known issues:

\- A screenshot of the remote page is not triggered on app load, so you may have tabs open that appear empty. Remedy: click the tab head / click or scroll the blank page to trigger a screenshot.

\- Scrolling by mousewheel, and some typing does NOT work in FF. Remedy: Scroll by touch / click on the scrollbar.

\- If not tabs are open, using the omnibox / addressbar is not intuitive. Remedy: open a tab (the + sign at top left), then type a URI or search query.

\- The headless instance you connect to is cookie-linked, and there's only 15 of them, so you may collide with someone else's session. Remedy: open incognito tabs to connect to different sessions.

Also, invite you to criticise, give feedback and share bugs for this prototype realtime web interface for Chrome headless.

<comment><USER2> Do you have contact details for sensitive bug reports?

<comment><AUTHOR> thanks. is this ok? [https://goo.gl/forms/Ra2EZLUF2dxg3PpD2](https://goo.gl/forms/Ra2EZLUF2dxg3PpD2)

<comment><USER2> That's great. Have submitted feedback.

<comment><AUTHOR> Thanks for feedback. switching it off until I find a workaround.

<comment><AUTHOR> Found a work around, switching it back on.

<comment><USER3> There's an XSS, put this into your address bar

google.com/?<script>alert('e')</script>

<comment><AUTHOR> thank you. I don't know how to fix it right now. I will work something out tomorrow.

<comment><AUTHOR> okay. fixed.

<comment><AUTHOR> thanks for feedback. switching it off.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Anonymous directly targets US Govt. over PROTECT IP Act - <AUTHOR> http://www.thinq.co.uk/2011/5/23/anonymous-targets-us-chamber-commerce-websit/

<comment><USER2> This headline is misleading. According to the article, Anonymous is targeting the US Chamber of Commerce [http://en.wikipedia.org/wiki/United_States_Chamber_of_Commer...](http://en.wikipedia.org/wiki/United_States_Chamber_of_Commerce) which is a business lobby, not part of the US Government.</comment>


Study: marketers question effectiveness of retargeting ads - <AUTHOR> https://www.marketingdive.com/news/study-83-of-marketers-question-effectiveness-of-retargeting-ads/523002/ <comment><USER2> The ads should have an easy to use way of giving feedback that actually does something the viewer wants. For instance, it could allow the viewer to say (with a couple clicks, and without leaving the page):

I already purchased this

I already purchased a competing product

I am not interested in this anymore

I was never interested in this

I don't want this displayed because it might reveal something private to an onlooker (example: gift purchase for spouse)

I'm not interested in this product but I might be interested in competing products

I'm in the market for ______________ and I don't mind getting ads for them

Thanks for the reminder, not now but maybe later

Ads that track me really annoy me

This would allow the viewer to feel more in control (assuming the advertiser actually attempts to respect their wishes) as well as giving them valuable feedback (that they can decide for themselves how meaningful it is). It might reduce the number of people that install ad blockers.

I'm one of those that these ads are likely to be effective on: I often browse Amazon or Ebay and don't make a purchase, but will purchase it later when I'm reminded and am in the right mood to spend a bit of money. I don't mind them tracking me....most of the time. Right now I'm seeing a lot of ads for skateboard wheels, digital pianos and Dremel bits.... and I actually kind of like those ads because those are things that make me happy, and I have no ill will whatsoever for people that manufacture those things. I also have no ill will for the site I am on and would like them to have a revenue model.

But I don't want them constantly trying to sell me women's bikinis just because, in a moment of weakness or boredom, I clicked on a picture of a cute girl because I wanted to see it bigger....and they won't simply let me tell them that.

<comment> munk-a Ads are not something that benefits me, the Ad viewer. I do not want to spend time training your marketing department. Your product is not entitled to my eyeballs. I will (personally) always strive to ignore your existence and minimize your advertising's impact on any of my decisions because your marketing department does not have my best interests at heart.

Advertisements were something we grudgingly accepted for reduced service costs, IMO they have reduced their own value so far that the quantity we are expected to consume is ridiculous. I would really appreciate the whole industry getting regulated out of existence.

<comment><USER3> So I realize that this is going to be an unpopular opinion but I'm going to go out on a limb and hope for the best.

I have a small business, and it's a business that people love.

When I first opened my business I was getting almost no customers because I had no way of informing people about my business.

With advertising, I'm getting clients and my business is doing well. I don't use manipulative tactics or remarketing, but I do use targeted ads to find out what kind of people are looking for my services and market to them by including a short direct blurb about what I do.

As a result, people who need my services can get it at a price they can afford. Another happy result of advertising is I am able to have my own business and bring greater competition to a market place that is dominated by old boys type businesses. The only down side is that some people who didn't want to see a blurb had to see it.

Why is this bad?

Maybe manipulative advertising tactics are bad, maybe advertising that relies on building brand recognition rather than stating value is bad. But I really don't understand why paying to inform people that my business exists and tell them what I do is a bad thing. I think it's a great thing.

I can say this, without modern affordable advertising my business wouldn't exist. Not because I don't provide value, not because there are better more competitive businesses but because people would have no way of finding out that I exist. I don't have the money for a fancy storefront with a fancy sign. I don't have the money to be at the front of the yellow pages. I don't have the age and established connections to get people through referral. All I have is a good idea, and the only way to communicate that idea to the public is advertising.

Maybe there is bad advertising and abuses of advertising. But please let's think twice before throwing out the baby with the bath water.

There was that famous study by Lee Benham who found that eye glasses were 20% cheaper in places that allowed for advertising. I don't know how much we can generalize that finding but I do think that a strong argument can be made that information is big component of the competitive marketplace. Meaning basically I have to be able to inform people about my product. If only huge businesses that can advertise on TV or get sports endorsements or have politicians or celebrities mention them have the capacity to inform people about their products, then they will dominate the market. Internet marketing is the great equalizer that gives little guys like me a chance.

<comment><USER4> Instead of unsolicited ads why would it not work with targeting people actively looking for things only?

Right now I'm researching a product I'm about to buy, because I have an actual need. In the process I consult various sources listing and comparing products of that category. Allthough most of those sources can't be trusted to provide unbiased information, I'm pretty confident the sum will give me a pretty good overview of the search space.

</comment></comment></comment></comment><comment><USER5> The main issue with retargeting is that most advertiser go all-in with it.

Instead of being a (friendly?) reminder that "hey, want to check us out again?", it's more like "hi, you've seen this 25 times at least, you sure you don't want to click me?"

So they spend an awful lot of money on what is visual spam rather than being a bit more measured in their frequency cap.

<comment><USER6> Most platforms let you choose a frequency cap. Its only the bad/cheap platforms that serve unlimited or high f-caps. For retargeting I typically do 1 ad per 1 hour, with a max of 10 a day and 250/mo.

<comment><USER7> Sorry are you saying that 10 times per day and 250 times per month is showing restraint?

I personally like retargeting and I'm infinitely more likely to click on it than other things I see in the same box.

The monotony of the channel makes it appear almost like a browser history. Not exactly thrilling, but when the competition is outbrain and snake oil, it's a non-trivial improvement.

<comment><USER6> Oh sorry that was unclear. That is the hypothetical maximum, pretty much no one ever gets there its just a safeguard. Frequency is something I can optimize to, so if a lower frequency performs better I can hit users less often.

Agreed on outbrain/taboola/etc.. I don't know how tabloid clickbait generates anyone clicks or even revenue.

</comment></comment></comment></comment><comment><USER8> I did not know what 're-targeting is'. So found a definition

".. Unlike typical banner ads, retargeting ads are a form of online targeting advertising and are served to people who have already visited your website or are a contact in your database (like a lead or customer). .." [1]

My general feeling is that technology needed for modern advertisement industry, and for law-enforcement/government/political online surveillance -- is almost identical.

No wonder, that companies specialized in technology to enable audience- specific ads, and 're-targeting' \-- are the same companies that are looked for to supply/integrate surveillance technology.

I am even now connecting the dots with advancements of Image recognitions, deep neural nets, -- with the drive for better surveillance technology, under the cover of targeted advertisement (as face recognition benefits both).

I am also no wondering if much of much opposition/road-blocks to people using VPN (eg Google.com constantly asked me to choose bunch of pictures before I can use it, with VPN) --- is the negative commercial impact that VPN usage has, on targeted advertisement, and surveillance.

[1][https://blog.hubspot.com/marketing/retargeting-campaigns- beg...](https://blog.hubspot.com/marketing/retargeting-campaigns-beginner- guide)

<comment><USER9> Retargeting is an incredibly basic use of tech and is as old as cookies are.

<comment><USER8> seems like at least some modern 're-targeting' ads do not need cookies.

The 'fingerprinting' is used instead.

"... From Meteora's personal fingerprinting BETA we have been able to identify 97% of Internet users to date.

…"

[https://meteora.co/user-tracking-without-cookies/](https://meteora.co/user- tracking-without-cookies/)

</comment></comment></comment><comment><USER10> Asking consumers what they think is usually a pretty bad way of understanding their behaviour.

Because these things are action oriented, they are fairly measurable, and ad buyers should have a pretty good grip on this, as opposed to say brand advertising.

</comment><comment><USER11> If you want to gauge effectiveness do an incrementality test with a test and control group to see your lift.

I've found retargeting effectiveness to be highly dependent on the inventory, ad units and creative, while also requiring a robust attribution model to gauge the effect.

Without those tools, it is just throwing money at the wall without being able to see if it sticks.

</comment><comment><USER9> Retargeting ads are intensely cheap compared to acquisition ads for most growing companies.

<comment><USER11> They're cheap because the audience size is so limited, but in actuality the CPMs typically are higher while the inventory quality is lower (outside of Facebook)

At small sizes they can indeed drive some value as you have a small audience that needs to know your name, but as you scale it starts to get pretty hit or miss.

</comment></comment><comment><USER12> I run marketing campaigns and my perspective is that retargeting is effective but you can't believe the actual ROAS shown. Companies that only do retargeting will pitch guaranteed amazing results because it's the easier part of the funnel and all your efforts from all your channels feed it.

Branded SEM is another area that you can't trust the numbers. You'll have an amazing return because people were searching for your brand in the first place.

<comment><USER13> I know the paid search folk may claim otherwise, but as an organic search practitioner I agree that branded AdWords (bidding on your own brand name) is the biggest crock ever.

If you lump brand keyword and non-brand keyword bidding together, the ROAS/ROI (depending how you measure) looks good, but then when you break out just non- brand, you often see how terrible the return is. Not always, but often.

<comment><USER14> People who take excessive credit for branded KW bidding, especially agencies, are unethical. Every agency I've encountered loves to subsidize their mediocre non-branded performance with branded campaigns.

Google loves branded KW bidding, because it cannibalizes traffic that 90%+ would go to an organic result. Even with a lower CPC, the high CTR means that on a CPM basis, Google is making more per impression (nevermind the trend of the Chrome omnibox preferring branded queries than direct navigation queries-- Google can't make money if their SERPs aren't shown). Bad marketers will say "it is a low CPC and a high conversion rate", but is that better than no CPC? It is just shifting free traffic to paid. SEM has changed so much over the last 5 years. It is so much more difficult for per unit profitability on search, too many people don't understand their margins and are overpaying. It kind of feels that digital is reaching equilibrium with traditional media, but it is easier to measure that it isn't working.

</comment></comment></comment><comment><USER15> I love retargeting ads. When you see an ad with pretty colors just click it and then use the back button. As you go about your day the web just gets prettier and prettier. It's like choose your web adventure. Like blues today click all the blue ads. Maybe feeling red click the red ones.

</comment><comment><USER16> It's about time, I hate when I mistakenly press an ad, and quickly go back, just to be harassed all day by random stuff that I don't care about

<comment><USER17> I use ads as a reminder. Wanna checkout something about kubernetes? search on it, click on a few things, I'll get reminded across every device. Wanna book a vacation but not ready, do the same. :D

</comment></comment><comment><USER18> Retargeting should be renamed: targeted harassment.</comment>


Ask HN: How effective is monthly "Seeking Work" post? - <AUTHOR>

I value the monthly "Who is Hiring" and "Freelancer? Seeking Freelancer?" posts, because I am hoping to build a second career as a programmer in the next few years.
I am wondering how effective the "Seeking Work" posts are.  For example, this month's post has 79 people "Seeking Work", and only 10 "Seeking Freelancer" posts.  This makes it seem as if there are 8 times as many people looking for freelance work as there are jobs being posted, but I recognize that many people may contact these freelancers without it being visible on HN.
Can anyone comment on how effective these "Seeking Work" posts are? <comment><USER2> Last month I posted this message: <http://news.ycombinator.com/item?id=4729612> and from that I got two emails. Talked to both of the potential customers but none of them was interested in paying more than $25 an hour.

Since I've only posted once I don't know if it had something to do with my post or if that's the common occurrence.

<comment><AUTHOR> "Talked to both of the potential customers but none of them was interested in paying more than $25 an hour."

That's an interesting bit of feedback. I would expect people looking at freelancers on HN to be ready to pay a higher rate than that.

</comment></comment><comment><USER3> Extremely effective. A couple of people have evidently been looking for very low-paid workers, but I've made good contacts and earned very good money as a direct result of my comments on HN, whether in the "Who is Hiring" threads or elsewhere.

</comment><comment><USER4> I'm not a coder, but when I was last looking for a job (actually almost two years ago) - and I got several (3) great leads from one monthly posting.

<comment><AUTHOR> What kind of work did you post for?</comment></comment>


Keep Killer Robots Science Fiction - <AUTHOR> http://autonomousweapons.org/slaughterbots/ <comment><USER2> Technology is about reducing costs. Some costs are best not reduced.

Data, information, and control capabilities are force multipliers. If the goal is to deliver (or threaten to deliver) deadly force, the greater the acuracy with which this can be done, the more effective it is.

I was reviewing the German assault on France in World War II recently. What is interesting is that the forces were fairly evenly matched, and French armour in particular was superior to German in all but one category: German tanks had radios.

France distributed its forces against possibly military attack, Germany concentrated its forces _and dynamically adapted to changing battle conditions to seek maximum advantage_. In both specific engagements and at the scale of the entire front, German forces could adapt far faster than the French. Tactical advantage: Germany.

The rise of guerilla tactics, and their evolution over the second half of the 20th century, and into the 21st, has been telling.

Ambush attacks, soft-target attacks, suicide and car bombs, roadside "IED" explosives -- lying in wait for some target of opportunity. Over the past few years, forces in Syria and elsewhere in the Middle East have used drones to drop grenades and shells from modest heights onto targets, almost completely unobserved. The prospect of far more mobile killing (or cripling) weapons, guided to specific individual targets, or simply selecting members of a crowd arbitrarily, could prove, as they say, game-changing.

And the winning move, not playing, is striking me as increasingly unlikely.

 _Of the fundamental and deep principles of economics I find useful, few strike me as powerful as the Jevons Paradox:_ increased efficiencies at some task _do not_ reduce the total amount of resources or other factors of production utilised, or the amount of that activity conducted. _By reducing costs, increased efficiency increases activity._ Jevons saw this with coal and steam power. Electricity, railroads, lighting, telephony, printing, radio, automobiles, air travel, the Internet: these didn't simply make the previously-experienced level of corresponding activities easier, _they raised the total amount of the activity, tremendously._

Wading through the product of an 1860s - 1880s boom in publishing on petroleum and fossil fuel activity, I ran across a statement that the coal deposits of the United States would suffice for a million years' supply, _at then present rates of consumption_. I can recall a time when advertisements in _National Geographic_ , in the 1970s, claimed a thousand year supply. The current estimates in BP's annual statistical review of energy are for a century or three.

The amount of coal hasn't changed appreciably. The use of it has.

And falling costs of accessing that coal, and increased use-value from applying it, has increased rates of consumption roughly 10,000-fold.

Consider the prospects of waging war where offensive casualties, targeting power, time-to-execute, and single-shot-kill effectiveness see a similar increase.

The corrolary of the Jevons paradox is counterintuitive: _if you want to see less of a thing, make it very, very, very expensive._

How does one do that here?

</comment><comment><USER3> too late.</comment>


Show HN: 'pm' – a simple solution for people who are wary of shoulder surfing - <AUTHOR> https://github.com/swapagarwal/pm

<comment><AUTHOR> 'pm' is a password magician, useful when you just typed your password in front of someone. I'm looking for more features to add based on your reviews. Thanks! :)</comment>


Software company, with a hardware device idea, begin research on building device? - <AUTHOR>

I work for a software company, and all we have ever done is write web based software for companies. We have an idea for a hardware device that will be a companion to an internal software product one of our employees has written. The device isnt anything spectacular, and has been 3d modeled some some components sources.
My question: How do you begin research on finding companies or services which assist in bringing something like this to life? We have a good deal of capital backing us so this wouldnt be a garage type thing.
Any and all ideas would be helpful.
Thank you. <comment><AUTHOR> Sorry for the triple post... this is the first time posting on HN.</comment>


Gmail Performance Issues - <AUTHOR> http://www.avc.com/a_vc/2010/06/gmail-performance-issues.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+AVc+%28A+VC%29&utm_content=Google+Reader <comment><AUTHOR> If you're going to make blogging your only viable avenue of tech support...</comment>


Adobe is going to kill Fireworks - <AUTHOR> https://twitter.com/DeeSadler/status/331209193451315202 <comment><USER2> The perfect combination of vector and bitmap editing. I love Fireworks. My guess is that Adobe just couldn't figure out how to make it better. It was already pretty much all it needed to be by about Fireworks MX. And it remains, to this day, a very different codebase.

User-friendly but quite powerful behind the scenes. I could never get the hang of Photoshop or Illustrator. Sure, Photoshop may have features or Illustrator knows how to do text flow, but if you have creativity and you know what you want, then Fireworks does everything possible to get out of your way yet is even intuitive for beginners with the same UI. Everything is discoverable, all the features are quite orthogonal to each other and it throws open how ridiculous the need to choose between vector and bitmap everywhere else really is.

If this turns out to be true, it's a sad day.

<comment><USER3> Agreed. I can only assume that at least 50% of the people that use Photoshop only do it because they've never tried Fireworks (or have to, because everyone else does). Of course, that means Adobe is sort of competing with it's own product, so it was inevitable that Fireworks would disappear some day.

To the best of my knowledge, Fireworks has no competitor or open source equivalent. If anyone is thinking about it, you'd have a customer for life from me.

</comment></comment><comment><USER4> I've been using Fireworks for years, back to Macromedia Fireworks 4. It's much better/faster than Photoshop for web design (rounded square corners come to mind).

If you work on a Mac, consider Sketch by Bohemian Coding : <http://www.bohemiancoding.com/sketch/> It's a great app, is updated very frequently and has come a very long way and could almost be seen as already superior to Fireworks CS6 in most ways.

<comment><USER5> Sketch looks nice, but seems like more of an Illustrator competitor than a Fireworks or PS replacement. Also, how does it handle PSD import. PSD is pretty much the standard for layered image sharing and FW opens PSD's near- perfectly.

<comment><USER4> It's definitely a Fireworks replacement: slices export, CSS export, etc. It functions like Illustrator in the way that it uses a board (group of assets) rather than a limited canvas (a single asset), but it is _not_ a software for doing illustrations or whatever you call what Illustrator does (not native speaker here, obv).

Edit: it does @2x automated exports too, for instance. Quite handy for iOS coding or responsive design.

I've never had to open PSDs with Sketch, so I can't tell. If you have any question, feel free to tweet their account on twitter: I hear they are reactive and very friendly. And definitely close to developers and designers: a lot of the features added this year have come from user suggestions. Can't tell the same story with Adobe...

</comment></comment></comment><comment><USER5> Sorry to hear this news. First Google Reader and now Fireworks! The writing has been on the wall for many years, but it is still quite upsetting. I've been a heavy user of Fireworks since version 1 since it really gets the job done vs. Photoshop for layouts, slicing and exporting. The workflow for web design just feels faster when compared to Photoshop. The combined vector/bitmap flow is unparalleled and Photoshop layers feel quite slow for simple web workflows. I can go months without opening Photoshop and it feels like a beast when I do. Hopefully, Adobe can make a "Fireworks"-friendly or "Web Design" workspace in PS.

Fireworks fits an excellent niche, which is probably why Adobe likely won't sell it. I really liked some the new version 6 features, such as instantly turning designs in CSS3.

Sorry to see you go FW.

<comment><USER6> > Hopefully, Adobe can make a "Fireworks"-friendly or "Web Design" workspace > in PS.

This would make sense, but I doubt they would be able to pull it off with the UI. Maybe they have decided that they have the market and people will just have to migrate.

<comment><USER5> It's definitely wishful thinking on my part. The UI in Photoshop would make this difficult. I might just have to switch to Illustrator for more of my layout work since I dislike the bitmap-heavy workflow of PS. Everything besides editing photos or building composites in PS feels non-intuitive.

</comment></comment></comment><comment><USER7> My UI/UX design company developed our own tool to replace Photoshop for our rapid prototyping and UI design work. It is publicly available by now. <http://www.antetype.com>

We switched from Photoshop to Antetype company-wide now and we don't miss it (It's still here for Icon Design though). We also felt Antetype superior to Fireworks as it has ways do deal with dynamic layouts and prototypic interactivity.

</comment><comment><USER8> WHAT THE HELL.

It does CSS Sprites

CSS Properties

LIVE MOCKUPS

God damn adobe. I've gone so long without having to touch photoshop or illustrator for web dev because FIREWORKS IS PERFECT.

</comment><comment><USER9> Often times I feel like I'm in the minority, but I rarely use Fireworks for anything. Perhaps I'm just more comfortable in Photoshop, but I often found that Fireworks didn't fit my workflow.

I've read a ton of articles on how/why I should use Fireworks for web design. Perhaps somebody could inform me on what I'm missing.

<comment><USER3> I am the reverse of you, so I can't talk with any great authority, either. But every time I've used Photoshop I've gotten sick of having to create dozens of layers for everything i do- in Fireworks everything is it's own independent, editable vector object. I just find it far, far easier.

<comment><USER5> Not having to think about layers (until they are actually needed) is my favorite core feature of FW. Why couldn't Adobe just add this as an option to PS.

</comment></comment></comment><comment><USER10> Our new vector drawing app, WebCode, is a nice replacement for Fireworks: <http://www.webcodeapp.com/>

It generates CSS, JavaScript+Canvas and SVG code from your drawings in real time and can also import PSD documents.

The generated code works great on both Retina and non-Retina displays. You can even preview how your drawings would look on Retina displays directly in WebCode. It inherited a lot of things from PaintCode (our app for Mac and iOS developers), which makes it very nice for user interface design.

<comment><USER7> How do you provide a preview for Retina displays on non-Retina displays?

<comment><USER11> Zoom to 200%, and move the monitor twice as far away.

</comment></comment></comment><comment><USER12> Sad and a little bit worried about this. While I will still use Fireworks for years after it's death (assuming I can), I'm not so sure what the path is for designers like me who use Fireworks for complete web design.

Unlike most here in this thread, I don't use FW for wireframing, prototyping or simple UI design. It's been our primary design for complete web/ui design tool for over a decade.

Let's hope Adobe comes to their senses.

<comment><USER13> Yeah, I se/used Fireworks for almost everything. Designing in it is the easiest i've ever experienced, and I've been using it for over a decade as well.

</comment></comment><comment><USER14> Fireworks is the only Adobe product I use religiously. I never understood why it didn't take off with the web design world. I believe it to be the most intuitive of the bunch.

Simple things like copy/paste work like they should, and whereas PS might be more robust, it takes 2-3x more clicks to achieve what FW can do in just a few.

<comment><USER8> yes yes yes. I can't believe this at all...

</comment></comment><comment><USER15> I can't believe this. Photoshop is not meant for web design, we only have Fireworks for the task.

A simple task like selecting a layer in Photoshop makes me want to cry.

<comment><USER16> Right-click to get a list of layers under your pointer. Or you can set a preference that click on an element automatically selects that layer in the layer palette. This makes you cry?

<comment><USER17> Design with 300 layers. Trying to select a text layer. Gotta hit juuuust the right pixel.

Or say you have grouped layers, and there's a semitransparent layer in one group, and a background in another group, and 20 groups in between those groups.

</comment></comment></comment><comment><USER13> I switched to Sketch because of Adobe's abysmal support and direction with Fireworks. I'm not surprised this is happening, but I'm sad. I still use Fireworks, but figured I had to start getting used to something else in preparation.

They're stupid, Fireworks is awesome. Most people using Photoshop don't know about Fireworks or think they 'should' use Photoshop, so they do. Even tho it's a pain in the ass.

</comment><comment><USER18> Adobe is migrating everyone to the new cloud services, so it makes sense. Fireworks > Edge Reflow / Dreamweaver, Flash > Edge Animate. Only problem is that they're experimenting so much with new apps that I don't know what to invest my time in learning (I'm looking at you Proto).

</comment><comment><USER19> Fireworks is/was also important in the workflow for flash professional. What does this tell us about the future of that program? Personally I think it's a stupid move of Adobe. They have been cashing on it for years, with very small updates for big prices. Why stop cashing now ?

</comment><comment><USER20> Been a Fireworks user for years for UI mockups and graphic design. Would be tragic if this news is true. One alternative not mentioned here is Omnigraffle. It is actually very well suited for UI design though not as much for visual design but you can get pretty close.

</comment><comment><USER21> I knew the gig was up when the CC announcement today mentioned Photoshop had adjustable rounded corner radius (the fact that this makes a press release should make some people pause before using Photoshop for their web comps, not that it will really stop anybody) and Illustrator now supports CSS exporting for gradients and such (CSS exporting being a feature of Fireworks CS6).

I would feel less abandoned by Adobe if they could simply make a better dedicated wireframing tool that shares the best of InDesign, Illustrator and Photoshop rather than making me choose if today I want PDFs, Vector or Bitmap.

</comment><comment><USER22> Hello Everyone, I've been a fireworks user since the product's initial release. I consider it to be an essential tool for rapid prototyping, designer-developer workflow, and Web graphic asset creation. Please consider signing the following petition to either encourage Adobe to continue Fireworks development or convert Fireworks to an open source project. thanks in advance for your support!

[http://www.ipetitions.com/petition/dont-kill-adobe- fireworks...](http://www.ipetitions.com/petition/dont-kill-adobe-fireworks/)

</comment><comment><USER23> This made me realize how much I miss Freehand which was way better and easier then AI. Now Adobe kills another superior piece of software made by Macromedia. On the other hand, Flash still lives strong.

Go figure.

<comment><USER24> I used Freehand when it was made by Aldus. Back then, Deneba Canvas was pretty good too.

<comment><USER25> I remember Canvas - really enjoyed it!

</comment></comment></comment><comment><USER6> Somewhat makes sense to me. I haven't used Fireworks in a long time and I'm not a designer, but it seemed like it was a user friendly hybrid of Photoshop (for raster) and Illustrator (for vector.) It seemed that together Photoshop and Illustrator could do everything you needed for the web, but that required a lot bigger payment, a lot of controls you didn't use, another software program and there were some minor things that weren't quite as smooth for web (aside from the UI.) I'm surprised Fireworks has lasted this long.

</comment><comment><USER26> This is sad. Back when I was heaving in print-based design, I used Photoshop religiously, but when I switched to web, Fireworks was my tool of choice.

I need FW way more than I need PS these days.

How's Acorn as a replacement?

</comment><comment><USER27> I don't think this comes as a huge surprise to many. There were big hopes for Fireworks after the buyout that never materialised, and while it has seen steady — albeit minor —iteration since, it never ended up inheriting the Photoshop features that I for one hoped it would.

In stark contrast to PS, FW is one of a select few pieces of Adobe creative software that always 'just worked' as I expected. It is a remarkably intuitive tool for many tasks, and it'll be a shame to see it go.

</comment><comment><USER28> I do hope this isn't true, Fireworks certainly had its place, Photoshop was overkill for designing web pages.

I suppose it only fitted a small niche but it still did a great job!

</comment><comment><USER29> I've never really been able to solidly get into Fireworks, despite trying several times. The fans love it, but I've personally found it very clunky.

However, a colleague swears by it for designing and developing HTML email newsletters. The general state of support for HTML and CSS in email clients is extremely poor, so you have to use inline styles and table-based layouts. Fireworks is _perfect_ for this.

</comment><comment><USER30> I've been looking for a good alternative for years, but keep coming back to Fireworks. I am not surprised but still disappointed.

</comment><comment><USER31> I see more people writing about how they are using Illustrator to design sites now than Fireworks/Photoshop. Claiming that it helps design responsive sites better/more intuitively.

I haven't used Fireworks for years. Once you are proficient in Photoshop, I rarely found a reason to open Fireworks even given all of its benefits.

<comment><USER2> I don't really like this approach. Don't do web design in Illustrator, do it in HTML5 + CSS3. Sure, it might take a little longer at first, but the time saved over a longer time frame makes it worth it in so many different ways.

Instead, graphics software should be used for elements in the layout rather than the layout itself.

It turns out that positioning is quite orthogonal to colour. Borders are orthogonal to textures. Sizes are orthogonal to form design. Not entirely, but that's, in the first instance, how they should be formalised before further dependencies.

It is in combining them that we find beauty. And CSS3 is a far more suitable way of doing just that in a considered fashion than Illustrator could ever be.

<comment><USER31> I agree, I do a lot of design in browser now as well. I was just stating you tend to see more articles about Illustrator and its benefits to a design workflow over that of Fireworks.

</comment></comment></comment><comment><USER32> The sad part of all of this is that there is still no true alternative to Fireworks... anywhere! :\

<comment><USER33> It's true, nothing that combines its simplicity, focus, and ease of use. Though fortunately there have been a number of great indie devs who've stepped in to make terrific graphics editing software: Acorn & Pixelmator are among the two best. My personal favorite (and closest true alternative) is Sketch:

<http://www.bohemiancoding.com/sketch/>

</comment></comment><comment><USER34> I really hope this isn't true, I've yet to find a replacement for fireworks either open or paid

<comment><USER4> If you work on a Mac, Sketch is a worthy replacement: <http://www.bohemiancoding.com/sketch/>

<comment><USER35> It is! But it is vector only which may or may not be a concern. And it doesn't import or export PSDs or AIs so if you live embedded in Adobe workflow it probably isn't for you.

</comment></comment></comment><comment><USER36> This doesn't mean the software cannot be used anymore, right?

<comment><USER37> Not immediately, but once a software product is killed, you won't get updates for future Operating Systems, no security updates, no support for new file formats ... eventually it just dies a death of time decay.

<comment><USER38> This would be a good time for Adobe to open source it, right? So it can be ported to Linux and live forever?

<comment><USER39> As a competitor to PS and Illustrator, that will never happen.

<comment><USER38> I thought PS and Illustrator were terrible tools in the competency domain of Fireworks?

<comment><USER39> They're less efficient and more difficult to learn, but they are serviceable for everything FW is used for.

</comment></comment></comment></comment></comment></comment><comment><USER40> Is there a real confirmation on this or is this all based on that tweet and the 7 responses below it?

"People were telling me about it," isn't a good enough source for me.

<comment><USER41> She is a senior community leader in the Adobe user group community and runs a designers conference. She is also a big Fireworks fan. If she's tweeting it, believe me it's true.

</comment></comment><comment><USER42> I think Adobe have slowly killed Fireworks for years by slowly letting it languish (as opposed to the swift axe that cut Freehand).

</comment><comment><USER43> What do people use Fireworks for?

<comment><USER44> User Interface design. I've tried pretty much every tool out there for UI design but I keep coming back to Fireworks.

<comment><USER10> Have you tried PaintCode?

</comment></comment></comment><comment><USER45> Fireworks is an atrociously buggy, poorly designed piece of shit, but it's stil been the best app for web and UI design.

However, in the past 6 months I've started using an app called Antetype instead, and can't recommend it enough for screen design. <http://antetype.com/>

<comment><USER46> scuse my french but before saying that you should fucking learn how to use it

<comment><USER45> What kind of rejoinder is that? I used it heavily for three years. It's a joke. Here's a tiny fraction of the shit I encountered every day: <http://fwsucks.tumblr.com/>

</comment></comment></comment><comment><USER5> Hopefully someone from Adobe is able to comment on this news.

</comment><comment><USER47> That's crazy. Why would Adobe want to do this?

</comment><comment><USER48> <http://www.inkscape.org/>

<comment><USER49> Nice for it being OSS and all that, but I had to edit XML just to reorder some layers.

Definitely not the same features and polish.

<comment><USER48> <http://wiki.inkscape.org/wiki/index.php/Layer_Dialog>

inkscape shares many features with fireworks. it's a great alternative for a big chunk of similar applications.

<comment><USER49> That dialog only worked _AFTER_ I edited the XML.

</comment></comment></comment></comment><comment><USER50> I've managed with Potatochop for the past decade just fine...

</comment><comment><USER51> Will it help Inkscape?

Could Inkscape advocate Adobe to let Fireworks live to help SVG grow?

<comment><USER26> Inkscape's QT-based(?) UI looks like a hot mess and feels just as bad on OS X.

It's probably fine for Windows, though.

<comment><USER51> Inkscape interface does most everything I need, except I miss Photoshop's 'Layer Effects' workflow, which makes designing and organizing filters less messy.

I use Linux.</comment></comment></comment>


A list of cool features of Git and GitHub - <AUTHOR> https://github.com/tiimgreen/github-cheat-sheet <comment><USER2> > To add more color to your Git output: git config --global color.ui 1

 _Don 't_ do this. The default (since 1.8.4) is auto, which adds colors if the output goes to a terminal, but doesn't if the output goes somewhere else (e.g., a pipe). That is probably what you want (and already have).

I fell for this myself at some point. Somehow expecting there to be more colors, or full color support, or something like that — Nope.

<comment><USER3> The book has a nice discussion: [http://git-scm.com/book/en/v2/Customizing- Git-Git-Configurat...](http://git-scm.com/book/en/v2/Customizing-Git-Git- Configuration)

> The default setting is auto, which colors output when it's going straight to > a terminal, but omits the color-control codes when the output is redirected > to a pipe or a file.

> You can also set it to always to ignore the difference between terminals and > pipes. You'll rarely want this; in most scenarios, if you want color codes > in your redirected output, you can instead pass a --color flag to the Git > command to force it to use color codes. The default setting is almost always > what you'll want.

</comment></comment><comment><USER4> File Explorer by pressing "t" is my favorite shortcut on Github since nested file structure gets annoying after a while of looking around.

</comment><comment><USER5> This has been posted a few times before and is an excellent resource.

It links to a GitHub repo [1] I made a while ago with every type of emoji as a separate file and commit as a fun and somewhat pointless demo.

However, for whatever reason the emojis on the repo stopped working (after a GitHub update?). Each emoji, regardless of commit message, is defaulting to the last one that was created (:zzz:). I reached out to GitHub a few times about it, but I never got a response. It's probably super low priority for them, but I thought I would share since, although minor, I technically broke GitHub.

[1] [https://github.com/scotch-io/All-Github-Emoji- Icons](https://github.com/scotch-io/All-Github-Emoji-Icons)

<comment><USER6> Previous fruitful HN conversation: [https://news.ycombinator.com/item?id=7580465](https://news.ycombinator.com/item?id=7580465)

</comment></comment><comment><USER7> So you can have a web interface to browse your Git repo with just one command

      $ git instaweb

Wow! Git never ceases to amaze! [http://git-scm.com/docs/git- instaweb](http://git-scm.com/docs/git-instaweb)

</comment><comment><USER8> > The first commit of a repo, as the first commit cannot be rebased later

Hey, can't I git rebase --root?

<comment><USER9> You can, but it's still a good idea to avoid as it tends to confuse some tools (and some people).

<comment><USER8> Ya, I agree. But if you are rebasing I assume you know what you are doing.

More like a _shouldn 't_ (or _really shouldn 't_ if you will) than _cannot_.

</comment></comment></comment><comment><USER10> One cool feature that isn't listed here is that you can use emacs org-mode files instead of markdown to document your project.

<comment><USER11> There are many different formats you can use: [https://github.com/github/markup](https://github.com/github/markup)

</comment></comment><comment><USER12> Any way how to automatically mirror an external Git repo to GitHub? Any webhooks for that?

<comment><USER13> The point of git is, that you do not need to do this. Just push.

<comment><USER9> There's a slight difference between a git push and a full mirror operation. A git push only synchronises the current branch. Even git push --all doesn't necessarily push all reachable commits - tags, other named refs (eg. stash), the state of the reflog...

</comment></comment></comment><comment><USER14> > Adding ?w=1 to any diff URL will remove any changes only in whitespace, > enabling you to see only that code that has changed.

Annoyingly, this doesn't work for pull requests.

<comment><USER15> weirdly, an empty line is included in the example output. Does that not count as whitespace?</comment></comment>


Taxation Without Representation for Business Owners - <AUTHOR> http://www.blog.joelx.com/taxation-without-representation/9986/

<comment><USER2> What the hell is this kind of bullshit doing here.

Fuck you.</comment>


This could be the Apple iCloud flaw that led to celebrity photos being leaked - <AUTHOR> http://thenextweb.com/apple/2014/09/01/this-could-be-the-apple-icloud-flaw-that-led-to-celebrity-photos-being-leaked

<comment><USER2> I'm amazed that so many non-tech people hold out hopes for 100% security. They are shocked when these sorts of things happen and think that software people are incompetent.

Yes, there are some things that are reek of incompetence, but it doesn't take much work to find out how many homes in your neighborhood have been burglarized in the past year despite thousands of years of experience building houses and developing locks - more than most people realize.

Why are people's expectations different for tech?

</comment><comment><USER3> [https://news.ycombinator.com/item?id=8251945](https://news.ycombinator.com/item?id=8251945)</comment>


Airtel is sniffing and censoring CloudFlare's traffic in India - <AUTHOR> https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.df27ssdof <comment><USER2> Here is what is happening:

Cloudflare Indian datacentres are hosted on Airtel's networks.

Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders.

Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers.

Cloudflare servers display the malformed page they received from Airtel to all clients(all ISP's) asking for piratebay in India.

<comment><USER3> >Airtel blocks the http traffic to piratebay

No, Airtel substitutes Piratebay's response to CloudFlare.

<comment><USER4> And this is why we want HTTPS everywhere. Yes. It would probably mean that the site is completely not reachable, but I prefer that to an altered response.

<comment><USER5> Unless I'm mistaken, the site could be made reachable if only TPB would enable SSL between Cloudflare and their origin.

Currently, Airtel is blocking based on the Host header. If they can't see the Host header, they'd have to instead know TPB's origin IP, which they wouldn't.

<comment><USER6> TLS transmits the host in cleartext.

<comment><USER7> Completely beside the point. Airtel is obviously looking at the HTTP host header.

<comment><USER6> Parent suggested deploying TLS from origin to Cloudflare would resolve this. Simply pointing out that it will not.

<comment><USER8> The post said that Cloudfare communicates with TPB via its IP address, not its host name, and that Airtel must be sniffing the hostname out of the header. So if they went full TLS Airtel would have to block the relevant IPs, which can be a little harder to find out, instead of the host.

<comment><USER9> Cloudflare does use SNI to talk to origin servers.

<comment><USER10> only if the origin server uses HTTPS and SNI.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> All I'm hearing is that Cloudflare allows their customers to configure client facing TLS without enforcing it upstream over the internet, providing a false sense of security. Thanks Cloudflare!

... and I'm pretty sure that their response will be "We are just a proxy, we are not responsible for anything".

<comment><USER12> We give all our customers free certificates for their origin servers.

[http://blog.cloudflare.com/cloudflare-ca-encryption- origin/](http://blog.cloudflare.com/cloudflare-ca-encryption-origin/)

<comment><USER13> Why provide the option to use unencrypted origin connections then? If a customer wants SSL, make them do it right.

<comment><USER14> Presumably because some people have backends that don't support SSL (e.g. anything hosted on S3) and CloudFlare thought "eh, some encryption is better than nothing, and they're going to let us MITM their encrypted connection anyway so they're obviously not a bank or something really important"

<comment><USER15> Good example where "false sense of security" can trump "something is better than nothing".

<comment><USER16> it still is providing more security. yes it has a security hole, but for example if i'm in starbucks - you can't sniff out my cookies over the ssl encrypted traffic. Sure a backend provider can, but it's a layer of protection... I suppose an interesting question here is there away for the browser client to detect this type of hole and alert end users to the risk...

<comment><USER17> No, it's fundamentally impossible - as far as the browser is concerned it's talking to a server that's speaking HTTPS (CloudFlare's server) and it can't possibly know what that server's doing behind the scenes.

If I see HTTPS in the title bar I expect the owner of that certificate to be responsible for the content I'm seeing. It's utterly irresponsible of CloudFlare to enable this kind of configuration.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I see a lot of people bashing CloudFlare, but to be fair:

1\. Thanks to them many sites got SSL and sniffing your local network/ISP is source of majority of the problems.

2\. Some SSL is better than no SSL, though it can also create illusion of full security.

3\. You can configure encryption between CloudFlare and your origin. You probably should do that.

4\. CloudFlare this year (May 2016) announce better tooling to encrypt between origin and their own CDN servers: [https://blog.cloudflare.com/cloudflare-ca- encryption-origin/](https://blog.cloudflare.com/cloudflare-ca-encryption- origin/)

<comment><USER17> > 2\. Some SSL is better than no SSL, though it can also create illusion of > full security.

In this scenario the illusion is a much bigger problem than the benefits. If I make a request over https I do not expect my traffic to be sent unencrypted over the open internet.

</comment></comment><comment><USER19> Not just "an Indian ISP". It's the largest ISP in the country, and one with an increasingly larger footprint in Africa. It had revenues of close to $15B last year

</comment><comment><USER20> Hi, OP here.

There are basically two important points from this story.

> CF can't tell if it's the actual website or the notice from Airtel, and > neither can the user.

> Airtel is implementing this block by looking at the Host: headers of ALL > HTTP requests going out of CF, and since everyone in India will hit CF, they > are now looking at the headers of all users in India, across ISPs.

</comment><comment><USER21> In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ?

>curl -H "Host: thepiratebay.org" [http://188.8.131.52/](http://22.214.171.124/)

May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to follow this because all ISPS are asked to block a list of such sites by the Supreme Court .

[]1 [https://en.wikipedia.org/wiki/Server_Name_Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)

<comment><USER22> I wonder if there's any proposals/extensions for moving SNI into the encrypted part of the communication. The initial certificate would have to be keyed to the IP address of the server, or maybe something from DNS, and probably there are other complications too, but it'd at least reduce the amount of plaintext information transmitted with each connection.

<comment><USER23> > moving SNI into the encrypted part of the communication.

That's called host header :-)

<comment><USER24> For HTTP, yes. There are thousands of other protocols that rely on TLS though.

<comment><USER10> Are there any other protocols that rely on SNI? Genuinely curious.

</comment></comment></comment></comment></comment><comment><USER25> So is it reasonable to say?: piratebays fault for not enforcing SSL between their origin servers and cloud flare?

<comment><USER26> Sort of, but the real fault lies with people actively censoring free speech.

TPB could and should mitigate this attack with Origin TLS, yes.

</comment></comment><comment><USER27> I know I'm being a bit cynical here but do we know that Cloudflare doesn't know about it?

It's entirely possible that they know about it. Considering their recent datacenter opening in India (again, not clear on laws but maybe they need to follow the blocking as ordered by DoT/courts?)

They just started operations in China and partnered with an ISP there, so unless they say that they are not involved, I'm sceptical about this.

</comment><comment><USER28> Airtel is known for doing notorious things in the past. From injecting iframes to serving compressed images via their own cdn.

</comment><comment><USER29> Is there any way for cloudflare to detect wether or not their connection has been modified by a third party besides certificates? I could only think of loading the site from more than one location and comparing the responses. However that might not be a trivial task, as most websites will not be static enough.

</comment><comment><USER30> In cases like this, where the upstream of some of Cloudflare's servers is known to be non-transparent (dropping or modifying data going through it), couldn't they tunnel everything to Cloudflare servers with a working upstream, and connect to the origin servers from there? They would still benefit from caching near the users, while avoiding the broken upstream.

<comment><USER31> The lesson learnt from this fiasco is that CF can't trust its upstream ISPs, so tunneling traffic over to another ISP in a different geo adds additional overhead without actually solving the problem.

The right approach to fix upstream MITM is to drop http+https mix and match mode.

</comment></comment><comment><USER32> I've never understood CloudFlare's position on this issue/feature. They generally do a great job at improving, caring and fighting for internet security, yet continue to offer a product (Flexible SSL) that they know is insecure:

 _This option is not recommended if you have any sensitive information on your website. It should only be used as a last resort if you are not able to setup SSL on your own web server, but it is less secure than any other option (even "Off")_ [1]

So by CF's own admission this is less secure than having SSL disabled. That's of course technically incorrect assuming the visitor is aware that SSL is terminated at CloudFlare, and insecure from there to the origin server. If the visitor is aware of this distinction (and know what it means, which includes knowing where the CF edge and origins are located) then it does add some security (the coffeeshop's Wi-Fi etc).

However it's probably fair to assume that most visitors of CloudFlare- protected sites are not aware of this distinction. They're probably just aware that Green Lock + HTTPS = secure. So instead this product primarily gives a visitor a false sense of security, which in my opinion is much worse and potentially dangerous. I guess CloudFlare agrees with that; why else would they say it's less secure than no SSL?

In the end, CloudFlare should clarify why they continue to offer a seemingly secure encryption product that they themselves consider less secure than no encryption. They say it should only be used "as a last resort", but when is choosing "Flexible SSL" really the last resort? I mean, you can just disable SSL entirely or do it properly (and even get a free certificate from CF), both of which are more secure.

I don't know, but here's an idea: It might be a good product for CloudFlare customers, such as TBP, who don't care enough to actually secure their visitors' traffic, but still want to give the appearance thereof. Which is exactly what the more prominent product page lists as the advantages of "Flexible SSL"[2]:

\- _You do not need an SSL certificate on your server._

\- _Visitors will see the SSL lock icon in their browser._

I might be missing something and I'd honestly appreciate if someone can shed some light on this. I respect CloudFlare a lot and appreciate their efforts to improve internet security. It's just difficult to maintain a brand as a company on the forefront of the internet security battle, while also enabling customers to somewhat deceitfully give the appearance of security at the expense of their visitors' security and safety. It seems pretty clear that CF needs to discontinue this product before it hurt their brand as well as unassuming visitors.

[1] [https://support.cloudflare.com/hc/en- us/articles/200170416-W...](https://support.cloudflare.com/hc/en- us/articles/200170416-What-do-the-SSL-options-mean-)

[2] [https://www.cloudflare.com/ssl/](https://www.cloudflare.com/ssl/)

<comment><USER33> Suppose Flexible SSL were disabled and HTTP was used instead; then a malicious actor can redirect the page "[http://thepiratebay.com"](http://thepiratebay.com") to "[https://thepiratebay1.com"](https://thepiratebay1.com"). Thus HTTPS (encryption) is there, but it isn't The Pirate Bay (authentication is not there). So, Flexible SSL is still better than HTTP, at least you're protected from your coffee shop.

<comment><USER32> I agree that it's somewhat technically more secure in that it prevents a wide array of attack vectors.

Despite of that my point is that, for the vast majority of _visitors_ , the solution ends up being less secure due to imperfect information; If you access a service over HTTP you can accurately asses the (lack of) security and, based on an informed assessment of the risks, decide wether you want to proceed.

If you access a site over a seemingly secure connection that is terminated prior to reaching the origin, then you most likely don't have the necessary information to assess the security and associated risks relative to what you're doing: Your browser is telling you that you're at the right domain and that the connection is secure with modern cryptography (if the site is using CloudFlare). However that's not the entire story.

The browser is not telling you that the secure connection is terminated at the CloudFlare edge. This leaves it to the CloudFlare-protected site to inform the visitor that the connection is only secure some of the way in order for the visitor to make an accurate assessment of the connection's security.

I don't think most CF customers who pick "Flexible SSL" are thoroughly and accurately informing visitors of these nuances (and even if they are an MITM can modify it). That's why I absolutely do not think it's better than HTTP -- exactly because of the problems outlined in this article.

In this case I'd argue that, from the perspective of _a TBP visitor_ , "Flexible SSL" improves security on less relevant vectors while significantly decreasing security on the vectors that matter. The coffee shop owner probably doesn't care that much about the IP rights of H/Bollywood, but this is the attack vector that Flexible SSL helps mitigate. The government does however care about such rights and CloudFlare's ISP was forced/willing to help them. CFs solution did nothing to mitigate this vector.

Now I'm not saying this is all CloudFlare fault, but I do think they share a part of the responsibility. TBP's recklessness has allowed millions of people around the world to access and use their site under the false assumption that they were protected. What I don't get is why CloudFlare has any interest in enabling such behavior. They know full well the risks associated with this solution and even admit it's inferiority compared to commando-style unencrypted HTTP. It also decreases my trust in other CloudFlare-protected sites - for all I know, as a visitor, the site may or may not be using Flexible (or perhaps just "Broken") SSL.

My suggestion is simply that they use their knowledge to provide a better service to their customers and their visitors. That probably means discontinuing this product - or clarify why the don't think that's necessary.

</comment></comment></comment><comment><USER34> Dear Airtel, sniff this...

[https://pbs.twimg.com/media/CnUlDy0UEAAvTz4.png](https://pbs.twimg.com/media/CnUlDy0UEAAvTz4.png)

</comment><comment><USER35> Seems like it's not just airtel:

[https://medium.com/@sushubh/when-you-said-they-do-not- even-k...](https://medium.com/@sushubh/when-you-said-they-do-not-even-know-it- i-thought-you-meant-airtel-was-quite-confusing-9954b7afc8ac)

<comment><USER36> Yes, the OP mentions in his post itself that all ISP customers get the same message from Airtel.

<comment><USER35> Ah so the traffic between piratebay and CloudFlare gets routed through Airtel. Thanks for pointing that out.</comment></comment></comment>