DARPA Is Building a $10M, Open-Source, Secure Voting System - <AUTHOR> https://motherboard.vice.com/en_us/article/yw84q7/darpa-is-building-a-dollar10-million-open-source-secure-voting-system <comment><USER2> > Kiniy said Galois will design two basic voting machine types. The first will > be a ballot-marking device that uses a touch-screen for voters to make their > selections. That system won't tabulate votes. Instead it will print out a > paper ballot marked with the voter's choices, so voters can review them > before depositing them into an optical-scan machine that tabulates the > votes. Galois will bring this system to Def Con this year.

This sounds great: paper trail, no chance of "hanging chads" or bad handwriting, verifiable by the voter at the moment before scanning and hand- countable if necessary.

<comment><USER3> I hate being outright dismissive but it sounds like an expensive html/pdf form with a printer attached.

I do agree that the paper trail is a great thing. I'm not fundamentally against electronic voting, but I haven't heard of a system that can really compete with the simplicity and verifiability of the immutablility you get from paper ballots inside ballot boxes being watched over by interested parties on all sides.

<comment><USER4> > I hate being outright dismissive but it sounds like an expensive html/pdf > form with a printer attached.

And I like it. The simpler the design, the better. Sometimes it takes a billion dollars and a couple of smart researchers to invent the "obvious" solution to a problem.

We've got butterfly ballots, confusing electronics-only machines, and a variety of bad standards as the basis of our current voting infrastructure. Telling everybody to use a damn PDF + printer would be a gross improvement.

<comment><USER5> And suddenly I have another use case for my language for specifying scientific protocols. Counting votes in a way that is scientifically verifiable. Turns out keeping verifiable lab notebooks for legal reasons is a really similar problem to keeping verifiable vote tallies, also for legal reasons (hopefully). It is telling that we have better provenance systems for far more complex processes but we still haven't managed one for person one vote ....

<comment><USER6> I may be misunderstanding but what language "specifying scientific protocols" do you mean ? Is this published? How does it work (a generic workflow language? The t sounds interesting whatever it is)

<comment><USER7> Probably not the same thing that guy was walking about, but this is a cool project going on at University of Washington - it's made for biological science workflows but it's really quite flexible.

[https://www.aquarium.bio](https://www.aquarium.bio)

</comment></comment></comment></comment></comment></comment><comment><USER8> >The systems Galois designs won't be available for sale. But the prototypes it creates will be available for existing voting machine vendors or others to freely adopt and customize without costly licensing fees or the millions of dollars it would take to research and develop a secure system from scratch.

I guess the devil is always in the details. "freely adopt and customize" to me says that the code will not be verifiable or open source anymore? Or that the implementation could be flawed. Open sourcing the code, and then letting commercial entities change it, cut corners, make money, etc seems to be a good way to ensure that all the hard work that went into designing the system is rapidly compromised.

<comment><USER9> Isn't there a law in the US prohibiting public institutions from competing with private businesses? This may provide a cause for not rolling it out, but rather handing it over to private enterprises for implementation.

Edit: I recall the US having to withdraw from the Human Genome Project because of this as soon as a private enterprise claimed it as a field of business.

<comment><USER10> No, that's not true. I'm unaware of such a law and could point to many counter examples. The human genome project was declared "complete".

<comment><USER9> Actually, the HGP was on the verge of being scrapped, but then the U.K. came to the rescue with a major investment to make up for the US. If I recall this right, the US enterprise (Celera) wanted to take an algorithmic shortcut in mapping and verifications, by this overtaking the HGP regarding final results in order to provide the data as a paid service. This happened 7 years before the scheduled finalization of the HGP. Eventually, they finished in a tie. (However, this has been some years ago now and I'm not a US citizen.)

</comment></comment></comment></comment><comment><USER11> Galois has a reputation for being one of the most visible and well-known shops associated with Haskell. I'm curious to see what they can accomplish. A little bit of poking showed this[0] coming up -- I definitely wonder if that's around the same direction they'll be taking.

[0][https://galois.com/project/csfv-crowd-sourced-formal- verific...](https://galois.com/project/csfv-crowd-sourced-formal- verification/)

</comment><comment><USER12> Why does this keep coming up? What is the compelling argument against paper ballots? There is no need for results to be known immediately, so how does making voting an exercise done by computers make anything better, particularly when computers are much more vulnerable to remote interference?

<comment><USER13> Aren't counting ballots always wrong? Like every time there is a recount the number changes...

What's wrong with electronic ballots? If we can have a secure and audit-able banking system (and every other aspect of our lifes), surely we can have the same for voting?

<comment><USER14> > If we can have a secure and audit-able banking system (and every other > aspect of our lifes), surely we can have the same for voting?

There's one major requirement in voting systems that throws a huge wrench in everything, anonymity. In order to prevent vote buying and coercion voters can't be tied to specific votes. So any system that allows a person to check that their vote got counted for their candidate isn't workable because that violates the anonymity requirement.

There's a million reasons that votes change as they're counted and recounted. For one in some states absentee ballots can be postmarked up to the day of the election so they can trickle in for a while after the day of. Another is machine breakdowns and just mistakes as the complete numbers are gathered.

<comment><USER15> The way this (anonymity) is handled in the Estonian system is that votes can be validated out-of-band for 30 minutes after they were cast, then they're locked. Additionally, a voter can overwrite their previous vote at any time during the vote period, so they could always prove their first vote, and then overwrite it privately later.

There are several other major problems with their system [0], but I think they should at least get credit for their approach.

0: [https://www.aaspring.com/ccs2014/ivoting- paper.pdf](https://www.aaspring.com/ccs2014/ivoting-paper.pdf)

<comment><USER14> There's still the voting server where the (voter,vote) pair exists and could be exfiltrated in theory. It does solve the low level organized vote buying/coercion campaigns at least.

</comment></comment></comment></comment></comment><comment><USER16> Title is misleading. This is 3rd party contractor that won an RFP bid yo push out hard copy verification of ballot and voter's choice with some "DARPA techniques". Not quite the secure confidential system with data integrity I was hoping for.

> We will show a methodology that could be used by others to build a voting > system that is completely secure.

This really feels like a Proof-of-concept or reference architecture, at best.

<comment><USER16> That said, at least it's progress in the right direction (I Hope). We'll see how it turns out.

</comment></comment><comment><USER17> I don't believe that putting a price tag on a piece of software legitimizes it for a given use case.

I get this same feeling from posts that say "Product X written in language Y". While I agree that there exists a right programming language for a given task, it is not in itself a reason to use product X.

</comment><comment><USER18> More information about the idea: [https://en.wikipedia.org/wiki/End-to- end_auditable_voting_sy...](https://en.wikipedia.org/wiki/End-to- end_auditable_voting_systems)

</comment><comment><USER19> I use this premise as one of my architectural interview questions- design a voting system.

Having asked it dozens of times, I've come to the conclusion that I don't trust anyone to build a voting system. I like it as a question tho, since it's open ended enough to really let the candidate focus on the domains interesting to them; scalability, security, data modeling, whatever they want really.

<comment><USER20> That's a huge leap from "arbitrary candidates can't give a satisfactory answer during an interview" to "I don't trust it can be done."

Do you apply the same test to cryptographic algorithms?

</comment></comment><comment><USER21> I'm a fan of Galois, so I'll keep tabs on this project.

<comment><USER22> Agreed. I was about to write this off as a boring project that might go nowhere, but I have a huge confidence that Galois will treat this with the gravitas necessary from a computing and security theory point of view.

It might still go nowhere, but I expect there will be very interesting developments as a result of it.

</comment></comment><comment><USER9> Thought experiment: Have, like in aviation, units built of two separate, but parallel architectures designed and built by unrelated, independent manufacturers with software written by independent teams in different languages and deploy them redundantly. (E.g., Airbus does this.) Now you have cranked up the cost for any manipulations to the requirements of successfully attacking two separate architectures in the same realtime timeframe, maybe at several redundant units at once. Leaving the message path. So you're still screwed. (Simply, because the win to cost ratio may be near to infinity. If we have concerns regarding personal messages, how could we possibly guarantee for this one?) Enter the paper trail and printers. – However, does anyone remember the Xerox scanner debacle of misarranged and falsely duplicated data by the compression algorithm, or the debates about Obama's birth certificate (due to image portions duplicated by the compression algorithm)? Things like these went unnoticed for years.

What we may learn from this, a) there's no perfect system involving software, b) if we do not want to invest as much in democracy as we do in shuffling around a few people by aviation, how may we be worth it? Anyway, voting methods shouldn't be about cost reduction.

<comment><USER23> For those who were perhaps intrigued, as I was--here is a bit more information I found through a cursory search about how Airbus's consensus system works. Interesting stuff. [0][1]

[0] [https://aviation.stackexchange.com/questions/15234/how- does-...](https://aviation.stackexchange.com/questions/15234/how-does-the- airbus-flight-computers-voting-system-work)

[1] [https://aviation.stackexchange.com/questions/21744/how-do- re...](https://aviation.stackexchange.com/questions/21744/how-do-redundancies- work-in-aircraft-systems)

<comment><USER9> Thanks for the complementary links!

Regarding Xerox scanner compression issues, compare this great CCC-talk by David Kriesel, "Traue keinem Scan, den du nicht selbst gefälscht hast" [0] – Sorry, German only.

[0] [https://www.youtube.com/watch?v=7FeqF1-Z1g0](https://www.youtube.com/watch?v=7FeqF1-Z1g0)

[1] [http://www.dkriesel.com/en/blog/2013/0802_xerox- workcentres_...](http://www.dkriesel.com/en/blog/2013/0802_xerox- workcentres_are_switching_written_numbers_when_scanning)

(Didn't MS's PDF-viewer have similar issues?)

</comment></comment></comment><comment><USER24> Sounds good. But in practice it's complicated.. In Brazil we have been using electronic voting systems for 20 years. Since then, there's been absolutely NO EVIDENCE of fraud. Specialists are regularly invited to know the code and try to find vulnerabilities (the code wasn't open-sourced, and personally I don't think it should).

And, even so, the losing parties ALWAYS claim there's been some fraud, and a significant part of their respective voters buy such discourse.

There's been turnover of power pretty regularly in most parts, and even this doesn't stop folks of accusing electoral fraud.

Last year, thanks Whatsapp, the debate's gained special contours. Lots of malicious people shared videos showing fake frauds, which were dismissed after some hours.

There's been also lots of stupid people mistyping into the ballot and screaming around with a camera accusing a fraud.

It was a bit of a mess and things tend to get serious in very tight scores, since there won't be a safe, auditable way of recounting the votes without having to fully believe in the government agency responsible for operating the system.

The system makes the process extremely efficient. We are 100 million voters, voting is mandatory, and we always know the winners within a couple of hours past the end of the voting process. But..

</comment><comment><USER25> My ideal voting system would allow me to have a real time feed of votes as they come in, so that at the end of the night I can check my records vs the "official" records. Names can be detached, all I need is a Ballot id. BallotId can be something as simple as the hash of RegisteredVoterId + password + Salt + ElectionId.

As long as the voter remembers their password, they can look up their record, and the record can be a fully public record with anominity.

<comment><USER26> Your ideal voting system is vulnerable to coercion ("log in and show me who you voted for or else") and phishing.

Voting systems should provide confidence to voters that votes are counted correctly, but not permit anyone, including the voters themselves, to learn how they voted after the ballot is cast.

<comment><USER27> I love voting by mail, but I don't understand how that's legal since you could just coerce someone that way?

Force them to vote by mail, watch them fill out the ballot (or fill it out for them), and mail it in.

<comment><USER28> Generally all mail in voting systems let you override your vote. If someone coerces you once and you send in another ballot postmarked after the first or go to your polling location in person on election day you can override that vote.

You basically need to hold someone hostage or under total surveillance from when the ballot is mailed to when the polls are closed to avoid them just sending in their actual ballot afterwards.

With an electronic voting system the window of time you have to hold someone hostage is much shorter - simply force their vote an hour before the polls close and then hold them prisoner for the hour.

<comment><USER27> This is an interesting answer and makes more sense - still possible to do, but harder.

</comment></comment></comment></comment></comment><comment><USER29> Anyone building or designing voting systems should first be familiar with the concept of _software independence_.

[https://en.wikipedia.org/wiki/Software_independence](https://en.wikipedia.org/wiki/Software_independence)

It's an extremely important and useful concept, and should form the basis of the first question (or one of the first) asked of any voting system provider.

</comment><comment><USER30> Max Kaye from the Flux party has been building a blockchain based one here [https://github.com/voteflux/THE-APP](https://github.com/voteflux/THE-APP)

It's open source and it's actually got a sound philosophy behind it. It's near completion and hopefully it'll change the way we vote globally (not just in Aus)

</comment><comment><USER31> Maybe they'll succeed were Switzerland has just recently failed: [https://www.technologyreview.com/the- download/613107/a-major...](https://www.technologyreview.com/the- download/613107/a-major-flaw-has-been-found-in-switzerlands-online-voting- system/)

</comment><comment><USER32> [https://www.youtube.com/watch?v=HVmHruNg6m0](https://www.youtube.com/watch?v=HVmHruNg6m0)

This amazing talk by Ben Adida is really relevant. He has worked on solving voting for a long time now and does a great job here of breaking down some of the salient parts of the problem.

<comment><USER33> I have the impression that Ben Adida is no longer advocating cryptographic voting technologies. Which is encouraging.

[https://www.usenix.org/conference/enigma2019/presentation/ad...](https://www.usenix.org/conference/enigma2019/presentation/adida)

</comment></comment><comment><USER34> Surely it doesn't cost $10m to build a secure ballot form. Existing solutions have had so many obvious flaws that it seemed like e-voting companies weren't actually interested in accurately counting votes. They really need 50+ people to make a checkbox form and print the result?

</comment><comment><USER35> Secure hardware sounds like the wrong idea, I think. I think the correct idea will be something more similar to block chains. A system where the security of the system lies in the ability for anyone to make a copy of the voting data at any point in time. So there will be multiple copies of the voting data, owned both by the authorities and by ordinary people.

If the authorities try to tamper with the central copy of the voting data, it will be checked by the multiple copies owned by the general public.

I think that's the general idea one should pursue. Not "secure hardware".

</comment><comment><USER36> DARPA Is Building a $10M, Open-Source, Secure Voting System

fact:

DARPA Is Building a $10M, Open-Source Voting System

ambition:

secure

</comment><comment><USER37> Have there been any competitions to make an open source, highly scalable and verifiable anti-tampering voting system? Maybe even a competition to see how few resources can be allocated to facilitate millions of simultaneous voters? i.e. "did it in 50 lines of python!" like the javascript 1k competitions. [1]

[1] - [https://js1k.com/](https://js1k.com/)

<comment><USER38> > Have there been any competitions to make an open source, highly scalable and > verifiable anti-tampering voting system

Yes, for thousands of years. The result is called the paper ballot.

You cannot have a verifiable anti-tampering voting system using computers. You need verifiability by the general public. Auditing a microchip is not something members of the general public know how to do, and in any case, it detroys the chip, so it's kinda useless anyway.

<comment><USER37> Are those tamper proof? I recall some engineers testifying before congress about specifically making paper ballot systems that were designed to allow altering results. DieBold I think? I don't have a link handy, but it seems that is just as fallible.

Or do you mean hand written ballots? Does anyone still use those?

And yeah, the digital ones have been hacked at DefCon by children. (their parents taught them how to hack the devices, so I guess that is cheating)

Maybe throw in some Blockchain or did I use a BS Bingo term?

<comment><USER38> > Or do you mean hand written ballots? Does anyone still use those?

Yes. The constitutional court of Germany ruled that electronic voting is essentially illegal in Germany due to all the inherent flaws, so all elections are done with pen and paper, ballot boxes, and manual counting.

<comment><USER37> That's very impressive.

</comment></comment></comment></comment></comment><comment><USER39> Not to sound overly cynical but open source isn't a panacea. Yes, it adds transparency. That's a positive. But that doesn't ensure it'll work.

As for secure, if it's connected to the internet, then it's always going to be a target.

It seems to me, that - if voting integrity is priority #1 - a return to traditional analogue voting should be given strong consideration.

</comment><comment><USER40> Now if only they would introduce something like Single Transferable Vote (entertaining CGPGrey video: [https://www.youtube.com/watch?v=l8XOZJkozfI](https://www.youtube.com/watch?v=l8XOZJkozfI)), or another more effective voting system.

Probably won't happen though, as it would seriously shake up politics as we know it.

</comment><comment><USER41> Could this be a useful application of blockchain?

<comment><USER42> No.

<comment><USER43> Can you elaborate? It seems each vote would be harder to tamper if blockchain is applied. (or some other techniques chaining data together to be verified)

</comment></comment></comment><comment><USER44> > Members of the public will also be able to use the cryptographic values to > independently tally the votes to verify the election results so that > tabulating the votes isn't a closed process solely in the hands of election > officials.

This sounds like they are using homomorphic encryption?

</comment><comment><USER45> Thank god. Now this is a good investment. They should be getting 10x that budget though.

</comment><comment><USER46> Finally. I've been saying this for years, as I'm sure others have.

</comment><comment><USER47> Secure voting system... right... I wonder how this will unfold... =/

</comment><comment><USER48> > allow voters to verify that their votes were recorded accurately

This sounds like it means it's no longer a secret vote and voters can be bribed or blackmailed to vote a particular way.

<comment><USER49> Only if the voter is allowed to keep the receipt. The system could require voters to put the paper in a box before they leave like we do now.

</comment></comment><comment><USER50> Ironic that an Oregon-based company is fixing voting machines, when Oregon has a paper-based vote-by-mail system that has encountered few problems.

</comment><comment><USER51> Software is perfectible, skinware is not. As long as corruptible human beings are in charge, there will be room for fraud.

<comment><USER52> _Software is perfectible, skinware is not. As long as corruptible human beings are in charge, there will be room for fraud._

Skinware writes the software.

(Is "skinware" the new "wetware?")

</comment></comment><comment><USER53> Bad DARPA. Any centralized control is corrupting. You need analog and decentralized to make cheating costly to pull off.

</comment><comment><USER54> Can anyone attest to this new system's engagement or possible effects on blockchain technology?

</comment><comment><USER55> Good news. An Agora voting system's fork powered by SGX/TrustZone and verified by Cryptol?

<comment><USER55> More than it:

[https://www.darpa.mil/news-events/ssith-proposers- day](https://www.darpa.mil/news-events/ssith-proposers-day)

</comment></comment><comment><USER56> You know what has the best paper trail?

Paper ballots.

</comment><comment><USER57> Every now and again you realize that US government actually does a lot of stuff right.

</comment><comment><USER58> For a good chuckle, search Youtube for Diebold voting machines. LOL.

</comment><comment><USER59> Say goodbye to democracy wherever electronic voting is rolled out.

<comment><USER60> You still have paper ballots - with audits.

<comment><USER59> Those audits are only triggered when the vote counts are close enough, within a certain margin.

Since whoever controls or hacks the machines gets to set the vote counts, the audit only happens if they want it to.

<comment><USER60> In California[0] we audit 1% of all ballots, regardless of the outcome.

[0] - [https://www.sos.ca.gov/elections/voting- systems/oversight/co...](https://www.sos.ca.gov/elections/voting- systems/oversight/county-one-percent-manual-tally-reports/)

<comment><USER59> What does that prove?

Your electronic voting machine could completely tell you the truth about every ballot you ask it about, but lie about the total.

<comment><USER60> Because we count an entire precinct and check the totals. We don't just ask it what it got for individual ballots.

</comment></comment></comment></comment></comment></comment><comment><USER61> Allowing everyone to verify that their vote was counted as they intend is a start, but....I'm not saying it has to use block chain, but for its veracity to actually be openly verifiable, the voting ledger has to be publicly visible.

<comment><USER62> Votes can't be public. Leads to coercion.

</comment></comment><comment><USER63> Everyday someone trying to "fix democracy"

</comment><comment><USER64> $10M sounds like spare change for DARPA?

</comment><comment><USER65> Nothing beats paper.

<comment><USER66> scissors does

</comment></comment><comment><USER67> Finally

</comment><comment><USER68> so awesome

</comment><comment><USER69> Open source, open hardware? What a joke. Neither are resistant to chip/compiler level attacks such as [https://www.schneier.com/blog/archives/2018/03/adding_backdo...](https://www.schneier.com/blog/archives/2018/03/adding_backdoor.html) and [https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html](https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html)

That's all assuming the voting machine is actually running the software/hardware they tell you - how would a voter check?

The article briefly mentions "That receipt does not permit you to prove anything about how you voted, but does permit you to prove that the system accurately captured your intent and your vote is in the final tally,". But if that receipt doesn't let you prove anything about how you voted, how can you tell from it that your vote was captured 'correctly'? The machine can print _anything_ on the receipt!

Then there is the question - what problem is e-voting trying to solve? Hand- counting scales perfectly and is _extremely_ difficult to covertly tamper with. So the only 'problem' e-voting solves is that of being unable to covertly and fully subvert elections.

<comment><USER70> > That's all assuming the voting machine is actually running the > software/hardware they tell you - how would a voter check?

Have dedicated hardware compute a hash from the content of program ROM on demand with a button press and present it on an auxilliary 7-segment display. Compare against the hash of the vetted image. No software need be involved.

At some point in the process, machines will be used for tabulation. You have to trust the hardware to some extent. Just keep it as simple as possible to minimize confounding complexity that an attacker can hide in.

<comment><USER38> > Have dedicated hardware compute a hash from the content of program ROM

How do you check the circuit of that hardware?

How do you know the ROM you are reading is the ROM the CPU is executing from?

How do you know the CPU is the architecture you think it is and the program means what you think it means?

> You have to trust the hardware to some extent.

No, you don't, and you shouldn't. You can do all of that calculation by hand. And at the very least you can check a random selection by hand.

> Just keep it as simple as possible to minimize confounding complexity that > an attacker can hide in.

In other words: Don't use electronics. You can't get simpler than pen and paper.

</comment></comment></comment><comment><USER71> My design uses paper and pen.

Deployment requires mailing ballots out and having places where people can come in to fill them out.

10 million dollars please.

<comment><USER72> How well does it work for people with motor disabilities? Vision disabilities? Does an X mean a choice or they crossed out their choice? What happens when the pens run out of ink? What if they can't read English?

Helpers? What do you pay them? Can they understand that dialect of that obscure language? Do you trust them not to lie about what they're marking on the ballot for someone?

The truth is electronic voting machines have upsides. Having the system fill out the ballot which the voter then hands in seems like an almost ideal use to me. It's totally verifiable but can help many people who wouldn't be able to vote without help.

<comment><USER73> > Do you trust them not to lie about what they're marking on the ballot for > someone?

Do we really think that a large conspiracy of translators for obscure languages is a viable attack?

<comment><USER72> I was thinking more when helping the visually impaired.

</comment></comment></comment></comment><comment><USER74> I doubt it can fix [https://en.m.wikipedia.org/wiki/Electoral_fraud](https://en.m.wikipedia.org/wiki/Electoral_fraud)

</comment><comment><USER75> Relephant xkcd in the room : [https://xkcd.com/927/](https://xkcd.com/927/)

</comment><comment><USER76> What I truly don't understand is why we can't vote with our phones in this age

<comment><USER28> Because you cannot verify your phone is not compromised at either a software or hardware level.

You would need independently verifiable hardware and all software running on a closed system (ie, no third party modifications to running software which would mean at most a trusted sandbox for other applications outside the proven path) to be able to trust it to reliably take your vote.

Thats on the order of correctness provability that NASA puts into launch vehicles but NASA doesn't have to contend with hostile actors seeking to undermine their software and hardware.</comment></comment>


Data Visualization and D3.js Newsletter - Issue 62 - <AUTHOR> https://www.dashingd3js.com/data-visualization-and-d3-newsletter/data-visualization-and-d3-newsletter-issue-62

<comment><USER2> didn't know about this, kind of cool, we use some D3 at work. however, would be nice with some graphics ...

just sayin.</comment>


Taking Chrome DevTools outside the browser - <AUTHOR> https://kenneth.io/blog/2014/12/28/taking-chrome-devtools-outside-the-browser/?repost=1 <comment><USER2> I quite like the idea of separating browsers and their dev tools. Beyond the immediate benefits of familiarity for the developer, a standard discovery/communication protocol helps reinforce both standards compliance and good documentation processes.

As it stands, there is no standard for dev tool communication. V1.1 of Chrome Debug protocol, which we used to teach IE to speak to Chrome dev tools [1], is a good start though. However, with the deeper (ie profiling) features of browser dev tools, you tend to find a lot of "blit a chunk of memory to the dev tools", which would almost never end up being standards compliant. So there's still some internal work to be done before Kenneth's dream of truly interoperable dev tools can become reality.

1\. [https://github.com/Microsoft/IEDiagnosticsAdapter](https://github.com/Microsoft/IEDiagnosticsAdapter)

<comment><USER3> I started a project[1] a while back when it became clear that the underlying architecture for the new devtools in Firefox was going to be as problematic as Firebug's had been. Longtime Mozilla contributor Wladimir Palant just published a post a few days ago touching on some of the problems with devtools that he ran into when trying to work with it.[2]

The idea with sepsis-inspector is that it should be able to replace Hewitt's old DOM Inspector codebase and be stupid simple to extend with third-party viewers. (For anyone unfamiliar, DOMi has the ability to inspect not just webpages, but e.g. the Firefox UI [and Thunderbird, and SeaMonkey] and extensions as well.)

The interface between the Inspector itself and the viewers is nice and modular for the most part. It's basically Unix pipes in GUI form, with a few services for sugaring. Altogether, this makes its design a good foundation for a generalized inspector framework. (And I do mean generalized. Let's debug PNGs, PDFs, and Haxe, too, but I'm not even talking just the Web here. Want to use it to debug Gnome Shell or your Mono app? Sure. I mean, why shouldn't we be able to?)

Since DOM Inspector, Firebug, and the new Firefox devtools exist, I've focused most of my time on getting the architecture right and then teaching the Inspector how to do some things that those tools can't already do, rather than necessarily shooting for parity from the start. This means that if you download the sepsis-inspector add-on[3] right now, you'll find that it's missing some things that existing tools can do, but at this point, it's just a matter of layering those features on. There's still work to be done underneath, though.

The sepsis-inspector's dependency on XUL needs to go away, for example.

Allen Wirfs-Brock did some research on JS mirrors[4] a few years ago, although nothing seems to have come of it, AFAICS. Everyone decided to roll their own debugging/reflection APIs, I guess. But it's blindingly obvious to me that something based on mirrors is what needs to be powering our inspectors, and that your chosen inspector should be able to do a lot more tricks than what the current crop of web inspectors can do (including, as I said before, doing more than just debugging CSS, JS, and the DOM).

If anyone is interested in collaborating here, you'll find that, for the most part, the sepsis-inspector code is extremely well commented for a Mozilla add- on. Patches wanted.[5][6]

1\. [https://wiki.mozilla.org/Sepsis](https://wiki.mozilla.org/Sepsis)

2\. [https://palant.de/2015/07/17/javascript-deobfuscator- reloade...](https://palant.de/2015/07/17/javascript-deobfuscator-reloaded)

3\. [https://addons.mozilla.org/en-US/firefox/addon/sepsis- inspec...](https://addons.mozilla.org/en-US/firefox/addon/sepsis-inspector/)

4\. [http://www.wirfs-brock.com/allen/posts/228](http://www.wirfs- brock.com/allen/posts/228)

5\. [https://gitlab.com/crussell/sepsis- inspector](https://gitlab.com/crussell/sepsis-inspector)

6\. [http://www.colbyrussell.com/2013/08/06/patches- wanted.html](http://www.colbyrussell.com/2013/08/06/patches-wanted.html)

<comment><USER4> Sepsis? That's a pretty off-putting name that I can't imagine will help you. Any reason you named it after such a grim life-threatening condition?

<comment><USER3> Yes.

It's a project codename, not a serious attempt at coming up with a name fit for mass consumption. It's not supposed to help with anything but one thing: to be able to unambiguously refer to the project even in the pre-release phase.

Using "sepsis" follows the policy that project codenames shall be patterned after unappealing medical phenomena (e.g., staph, polyp, varicose, etc). There are two reasons for this:

These kinds of ugly names are unusable from a marketing standpoint, so there's a vanishingly small chance of collision with anything else.

They're also a constant reminder of the fact that the codename is just a codename; it totally eliminates the risk of anyone ever looking at it during the actual research and naming phase and lazily suggesting, "Hey, let's just go with that."

<comment><USER5> So if someone knows someone who's affected by one of your life threatening conditions, they can just stay out of the project. It's all about the macho core contributors. Who overthink things (is collision really such a problem? is "marketing" really that likely to run with some random name, and why is that a problem?) and continue to make obscure projects without diverse participants. Is that also part of the logic?

<comment><USER3> This is the most presumptuous and mean-spirited comment I've ever received not just on HN, but in my entire history of being online. No exaggeration.

But to go ahead and answer your disingenuous question anyway, no. That is not the idea.

</comment></comment></comment></comment></comment></comment><comment><USER6> I really wish the Chrome remote debugger allowed multiple websocket connections.

A while back I made chromesync [0] to automatically push changes to your local files directly in to Chrome. It means you can work in your own editor (whichever it is) as normal and have your js updated on the fly. For me, it's a great way to develop SPAs.

Unfortunately, all too often you need to inspect something in the Chrome dev tools - which causes issues because you can only have one debugger connected.

Someone created a proxy to handle multiple connections [1] but it requires running the Dev Tools in a separate tab via the proxy too. You can make it all work but it's a lot of moving pieces.

[0] [https://github.com/aidos/chromesync](https://github.com/aidos/chromesync)

[1] [https://www.npmjs.com/package/ws-multi- proxy](https://www.npmjs.com/package/ws-multi-proxy)

<comment><USER7> "I really wish the Chrome remote debugger allowed multiple websocket connections."

You, me, and a ton of other people. It's the number 1 starred Dev-Tools issue[1], and has been for years now. I'm guessing it's a political issue since there has been no indication whatsoever towards providing a solution.

It really is a big deal; there's a _ton_ of potential applications if we could plug multiple things into a single page.

I think spy.js only scratches the surface of what's possible in this space; and spy.js is pretty awesome (if only it wasn't dreadfully slow and tied to an IDE).

[1] [https://code.google.com/p/chromium/issues/detail?id=129539](https://code.google.com/p/chromium/issues/detail?id=129539)

</comment></comment><comment><USER8> I know this is not closely related to the post, but this really got me worried:

 _and I was quite surprised how little "desktop" focus there is in the spec. It's like the design team simply have forgotten that we have this thing called a "desktop" computers, where we use these oldschool interactions called mouse and keyboard._

I have similar experience, recently just starting to learn Mac development. The getting started guide for creating Mac desktop app is 3 years old and using XCode 4, whereas the iOS guide is updated and polished.

And I had a mixed experience with my Chromebook. It is great for web-browsing, but most of the apps available are designed primarily for mobile devices and feel weird to use. The "desktop" version of them usually just involves opening a tab in Chrome or in an resized individual window. I don't know if the developers are too lazy to design for desktop, or they are clueless to how they should do it.

</comment><comment><USER9> It's also work taking a look at Vorlon.js [1]; a Microsoft-backed 'open source, extensible, platform-agnostic tool for remotely debugging and testing your JavaScript. Powered by node.js and socket.io.' MIT licensed, and code available on GitHub [2].

1\. [http://vorlonjs.com](http://vorlonjs.com) 2\. [https://github.com/MicrosoftDX/Vorlonjs/](https://github.com/MicrosoftDX/Vorlonjs/)

</comment><comment><USER10> I have on occasion wanted to use browser dev tools on Android itself (not remote debugging) and additionally have wanted to run them in a command line interface (for running in ssh from a build/testing server)

It would be nice if these dev tools interfaces were better modularized to make them more flexible and adaptable different environments.

<comment><USER11> You can. Facebook has started the Stetho project, which essentially is a protocol adaptor for Android. [https://github.com/facebook/stetho](https://github.com/facebook/stetho)

<comment><USER10> No I'm not talking about debugging android apps. I'm talking about debugging websites using a android device. Again I'm not taking about remote debugging.

</comment></comment></comment><comment> nevi-me I agree on DevTools being quite close to an editor. I recently started editing my CSS files directly inside DevTools, I wish I would have started doing that months ago, it's saved me from many page refreshes. I wonder what else I can do with it?

<comment><USER12> HTML editing is pretty good but editing Javascript for anything but the simplest task is a dead end.

<comment><USER13> Especially if you're doing any kind of transpiling (es6/7 features).

</comment></comment></comment><comment><USER14> Closing the loop, with tunnelling and a mirror of the client dom.

[https://www.youtube.com/watch?v=w6AvExQtvQ0](https://www.youtube.com/watch?v=w6AvExQtvQ0)

Had wrote a tunnelling server in Go, to achieve this. Even had a client site go binary which would download the chrome binary, and open a new user profile, setup inspector and generate a tunnelling url. The parts of DOM mirroring were mostly copied from different blog posts etc, on the web.

[https://github.com/ciju/devmirror](https://github.com/ciju/devmirror)

[https://github.com/ciju/gotunnel](https://github.com/ciju/gotunnel)

</comment><comment><USER15> I wish this was possible with Opera's Dragonfly.

</comment><comment><USER16> or just click the gear and popup the devtool in its own window.

<comment><USER17> You're missing the point. This is about pulling out devtools so that it can be used with more than just chrome and provide a single way to debug everything from FF/Chrome/Safari to NodeJS apps and iPhone native apps.

<comment><USER18> Note you can already do most of that with Firefox's Devtools: [https://developer.mozilla.org/en/docs/Tools/Remote_Debugging](https://developer.mozilla.org/en/docs/Tools/Remote_Debugging)

<comment><USER19> That may be, but as you read the article, you do get re-inforced the idea that WebKit (and by proxy Chrome DevTools) are infinitely more embeddable and mallable: All examples listed of non-standard usage are WebKit and Chrome. Not a single Firefox or Mozilla component in sight.

Is there a (still) technical reason for this, or is it just that WebKit & Chrome won the developer mindshare to the point where there's point in investing elsewhere if you want to get picked up?

If so, that would have me worried. You may argue it's "only" on the developer- side, but that's always where things start out before they spread out.

We are already very close to a Chrome monoculture taking hold, and I find websites and services on a daily basis which doesn't work in Firefox (or Firefox mobile) which I have to open in Chrome in order to have loading correctly.

I think we're already at the point Microsoft was with IE, if not well beyond.

As someone who cares about the open web, open data and a proper standards- based internet, I think pretty much everything is heading in the wrong direction these days.</comment></comment></comment></comment>


Ask HN Foodies: Our first iPhone App - hungry - <AUTHOR>

Hello,
We just launched the app, which is one slide way to eat out with foodie friends; http://hungry.am Actually, the idea was rejected by YC for S12, but we are building it anyway.
(The product is still buggy. It can't do push notifications and users have to refresh the chat manually to read new messages...oh god Urbanairship!)
Please check the web site at http://hungry.am
We really really love to hear your feedbacks! Even if you just poked around for a few minutes, I'd love any opinions about what you think, what you think could be improved, etc.. It's a very very new product, so there is a lot to improve, but it is important to me to get your feedback as early as possible.
Bon Appetit :P <comment><USER2> If its buggy, how did it get approved for the app store? Not sure what difficulties you guys had with providing push notifications via Urban Airship, but I've had it up and running in about 30 minutes in the past (including the time it took to generate the certs)

<comment><AUTHOR> Well, it was our fault (not Urban Airship's). We didn't notice step #3 on [https://support.urbanairship.com/customer/portal/articles/16...](https://support.urbanairship.com/customer/portal/articles/161982-production- launch-checklist)

<comment><USER3> I also shipped an app that didn't have push notifications working, but no crashes, so it was a minor bug.

<comment><AUTHOR> I feel like it's a torture to wait apple finishes reviewing a bug-fixed version...

</comment></comment></comment></comment><comment><AUTHOR> A clickable link: <http://hungry.am></comment>


Implementing REST APIs with Embedded Privacy - <AUTHOR> http://blog.doordash.com/post/63387494835/implementing-rest-apis-with-embedded-privacy

<comment><USER2> I think, the approach is right but the implementation can be more elegant. Keeping scalability and readability in mind, I would use more declarative/DSL syntax to fine control your resources. Django uses the metaclass to achieve something similar.

</comment><comment><USER3> In software development we call it abstraction. Privacy is for real people.

<comment><USER4> You can also say privacy is about protecting people's information, which is what abstraction allows us to do. It's also a matter of where to make the permissions decisions, at the view level or at the API resource level? At DoorDash, we've found that making that choice at the API resource level was the right decision.

<comment><USER5> In software there are usually multiple places to accomplish the same thing. I usually ask, "where do I put the work?" I'm usually thinking of the database vs. the framework on the server vs. the client.

The post is a great explanation of the choices and why the API resource was the way to go. Inspired us to take a look at how we put our API together.

</comment></comment></comment><comment><USER6> Why not use one resource and return different fields depending on the type of the requesting user ? I have the same problem to solve right now and not sure yet which way to go.

<comment><USER4> We thought about this approach. This would mean that we'd have to have fine- grain permissions logic every time we used that resource. An analogy to this is like having to sanitize literal strings for every user input from a web form; if you forget to sanitize (or in the API case forget to filter the fields) at any point, you have a security bug in your code.

<comment><USER6> You're still doing filtering. The difference I see is your database request code is duplicated. Conceptually the condition is moved but it is bound to exist somewhere. This is IMO a semantics question. Thanks for your input anyway, you gave me a new perspective to wonder.</comment></comment></comment>


NASA Laser Communication System Sets Record with Transmissions to and from Moon - <AUTHOR> http://www.nasa.gov/press/2013/october/nasa-laser-communication-system-sets-record-with-data-transmissions-to-and-from/#.Ume155Q4W5s <comment><USER2> How huge is a 1mm beam when it hits the moon (and visa-versa) ?

I wonder if wolframalpha can tell me...

Actually, I don't even know how to ask it the proper question.

Can anyone make this formula work in wolfram?

[http://laserpointerforums.com/attachments/f51/17952-calculat...](http://laserpointerforums.com/attachments/f51/17952-calculate- expansion-laser-beam-schematic_laser_beam.jpg)

update:

I think I figured this out as

          ((λ * L) / d)* 2

          (((630nm in meters)*(380000km in meters)) / (1mm in meters)) * 2

Which would be a nearly 500km wide for a 1mm beam on earth from a red laser at 630nm

The shortest wavelength laser I can find online is experimental violet at 400nm which would make a 300km beam on the moon.

<comment><USER3> Have you seen this "What If?" post by xkcd?

[http://what-if.xkcd.com/13/](http://what-if.xkcd.com/13/)

It doesn't talk about the size of the beam as it hits the moon, but it's interesting noodling none-the-less.

<comment><USER2> The end of that had me in tears. I think I like the "what-if" section more than the comics!

Gems like

 _Unfortunately, the laser energy flow would turn the atmosphere to plasma, instantly igniting the Earth's surface and killing us all._

and another article

 _It 's a shame humans wouldn't live this long, because at this point, something really neat would happen._

<comment><USER4> That one links to this: [http://what-if.xkcd.com/8/](http://what- if.xkcd.com/8/) which devolves into a hilarious analysis of 'how to get 7 billion people out of Rhode Island'.

<comment><USER2> I remember reading that one and the hilarious part is, it is not how it is supposed to start off.

He seems at first disappointed other sites have attempted to answer the original question, so in his own wonderful style he tries to solve the other weird engineering aspects of it.

He seems cut from some of the same cloth as Douglas Adams but with advanced math knowledge.

<comment><USER4> Agreed, he must be one of the 10 most creative people on earth.

</comment></comment></comment></comment></comment></comment><comment><USER5> The article cites 622 Mbps down, 20 Mbps error-free up. Is the implication that the 622 Mbps down is before error correction?

Either way, it's pretty incredible. Even if the 622 Mbps down isn't completely error free, but maybe 99%, you just need to use a video compression algorithm that is error tolerant.

<comment><USER6> Why is it easier to transmit from the moon to earth? Here we have more power and larger/better/faster/more tuned lasers than the space vehicle does. Seems like getting earth's transmit rate way up would be relatively easy while getting the vehicle's transmit rate up would be really really hard.

<comment><USER7> I don't work in this field, but here's an educated guess (or two).

Lasers are not perfectly coherent, parallel beams. They're close but, over the distance between the Earth and the moon, even the most powerful, carefully adjusted and perfectly focused laser will expand much like a flashlight beam. Take the laser pointer you use for presentations and shine it across the room and you'll see a substantially larger spot size than if you shine it on your hand. You get the idea. Getting a strong signal means you need a lot of area in your receiver. A big dish will help at either end, but it's harder to send a big dish to the moon.

Another huge factor is going to be atmospheric distortion. The atmosphere is full of eddies and currents of air at different temperatures and relative motions. Light going through it gets refracted somewhat chaotically. If you try to lock a free-space laser signal in over a distance of even just a few tens of kilometers through air, it's actually a bit of a challenge because that (rather large) spot will jump all over the place. Light traveling from the Earth to the moon goes through atmosphere at the source and gets bent and, by the time it reaches the moon, will be all over the place. Light traveling the other way travels through vacuum until it's very close to its destination. Consider trying to shine a laser pointer up out of a pool of choppy water and hit a distant target vs trying to hit a specific spot in the pool from that target. It's a lot easier if the random bending happens nearer to the destination! There are a lot of things you can do to overcome this, but they probably all reduce the speed at which you can transmit.

Edit: I just read this: [http://www.spaceflight101.com/ladee-lunar-laser- communicatio...](http://www.spaceflight101.com/ladee-lunar-laser- communication-demonstration.html)

The sending and receiving modes are completely different. The moon craft sends polarization encoded data using a continuous beam. This is received on the ground by highly sensitive single-photon-detectors hooked up to multiple large scopes. Sensitive, but bulky and components have to be cryo-cooled. However, this allows for the use of a relatively weak laser at the moon and polarization modulation means you can probably get pretty good bandwidth, provided the atmosphere isn't so turbulent that it requires you to check your states too often. (Polarization will be randomly transformed by the atmosphere, so you'd determine which polarization is which periodically as a part of communications. This is presumably why they have multiple receivers that are probably measuring in different bases so each bit from the moon can be tomographically reconstructed.)

The ground-station sends pulse-position modulated (aka time-bin) encoded data with a fairly powerful laser. Say you wanted to signal a friend yes or no without talking. You could synchronize a pair of stop-watches and, at an agreed time, you throw a ping-pong ball at his head. If you want to say yes, you throw it right on time. If you wan to say no, you throw it a bit late. Obviously, your ability to distinguish early from late limits how fast you can send data this way. If it was a windy day with random gusts, the ping-pong ball would arrive a bit randomly, so you'd need to make the delay required to declare a ball "late" somewhat longer. Atmospheric distortion probably limits bandwidth to the moon for this reason.

Both polarization and time-bin encoding can be made to work both ways I suspect, but there might be reasons to choose one over the other for sending vs receiving. It does seem like the receiving station for a polarization encoded signal might be more bulky due to requiring multiple detectors operating on different polarization bases. I'd love to ask the folks at NASA about this! It might also be they just wanted to test both methods, since this really is an experiment more than anything.

<comment><USER8> And fortunately in most use-cases, we'd prefer a spacecraft to have more upload bandwidth to Earth than download bandwidth from Earth. The largest data NASA would send to the craft would probably be software updates, megabytes or a few gigabytes at most, while the craft might want to send thousands of images and even videos, gigabytes or terabytes of data, limited only by its energy budget and length of transmission window. (Note: I don't work in this field either).

</comment></comment></comment></comment><comment><USER9> There is an xkcd that seems awfully appropriate here - [http://what- if.xkcd.com/13/](http://what-if.xkcd.com/13/) \- shooting lasers at the moon.

</comment><comment><USER10> The latency must be huge though.

<comment><USER11> I'd imagine TCP, as a protocol starts to fall over with moon-to-earth latencies.

Or would it? Perhaps simply increasing the retransmission timer would give us interplanetary internet. I wonder.

<comment><USER12> [http://en.wikipedia.org/wiki/Interplanetary_Internet](http://en.wikipedia.org/wiki/Interplanetary_Internet)

<comment><USER13> Code from NASA here, [http://sourceforge.net/projects/ion- dtn/](http://sourceforge.net/projects/ion-dtn/)

</comment></comment></comment></comment><comment><USER14> Background information: [http://www.spaceflight101.com/ladee-lunar-laser- communicatio...](http://www.spaceflight101.com/ladee-lunar-laser- communication-demonstration.html)

</comment><comment><USER15> Should be "laser" with the quotes. Also, LLCD isn't catchy - the project should be renamed to "The Allan Parsons Project".

</comment><comment><USER16> So fine for torrenting crappy for gaming?

<comment><USER17> I'm annoyed that gaming is defined solely as multi-player FPS twitch games. Astronauts / colonists into chess, go, poker, real role playing games, pretty much anything that happens in a casino, single player of any sort, wouldn't really notice.

<comment><USER18> Besides, the speeds mentioned here would be more than enough for multi-player twitch FPS too.

<comment><USER19> A game like an FPS doesn't need much speed (they can work with modem-level bitrate). They instead depend on having low latency, or ping time. Since the moon is so far away, it takes a signal 1.3 seconds to travel to or from it.

</comment></comment></comment></comment><comment><USER20> That is better than the connect at my house. I am moving there!

<comment><USER21> The latency would probably kill you though.

<comment><USER22> Or the cold.

<comment><USER20> Or lack of atmosphere...but I digress. Plus I am sure that latency would be better than earth based sat transmissions

</comment></comment></comment></comment><comment><USER23> Would it help at all to signal over RF to a low-orbit relay, and then go optical just between two points in space? Much less atmosphere to contend with...

</comment><comment><USER24> 622mbps is interesting. Same as OC-12c... Something COTS?

<comment><USER25> > _Something COTS?_

Probably outside of the transmission/receiver. Choosing a conventional speed allows them to use plenty of off-the-shelf electronics (FEC chips, etc) and then focus on the transmission.

</comment></comment><comment><USER26> I remember reading on reddit or maybe it was here on HN that a laser is not a thing it's a method i.e. LASER, we use LASER not a laser.

<comment><USER27> Language evolves. Unless you're writing a technical document it's usually best to go with what is commonly used and understood.

</comment></comment><comment><USER28> Couldn't we set-up a laser system to detect asteroids from farther away? Or would that be pretty inefficient?

</comment><comment><USER29> That's some lag!</comment>


Enabling the NLP Conversational Economy - <AUTHOR> http://blog.converse.ai/introduction/an-introduction-to-converse/ <comment><AUTHOR> Tony Lucas, of converse.ai, just sent me an email alerting me to the existence of his company, so I went to take a look. I am surprised to see that this startup so completely overlaps with what I wrote about here:

[http://www.smashcompany.com/business/what-happens-when- the-b...](http://www.smashcompany.com/business/what-happens-when-the-board-of- directors-begins-to-panic)

Not many people realize the difference between simple NLP and the kind of NLP that is supported by a Conversation Finite State Machine.

And I am about to start a totally new startup that is focused in the same space.

So it seems likely that we are about to see a whole wave of conversation-via- nlp startups, a bit like the Social Media wave that we saw 5 years ago.

</comment><comment><USER2> Thanks for posting, if I can answer any questions, happy to :)</comment>


Police may be accessing cell phone data during routine traffic stops - <AUTHOR> http://www.popularmechanics.com/technology/gadgets/news/should-cops-be-alowed-to-scan-your-phone-during-a-traffic-stop-5587825

<comment><USER2> > According to the ACLU's letter, the organization requested usage logs from > the Michigan troopers' devices, but the state police requested more than > half a million dollars to pay for retrieval of the documents and records

Either the Michigan State Police's IT department is laughably incompetent or inefficient, or the police department as a whole is corrupt and self-serving. Both of these are reprehensible and have no place in a representative government.

</comment><comment><USER3> Is this even technically feasible?</comment>


SourceMaps in Chrome allow debug of any source language compiled to JS - <AUTHOR> https://plus.google.com/u/1/110412141990454266397/posts/Nvr6Se6eAPh A small demo of the SourceMaps support in Chrome Dev Tools which allows languages which are cross compiled to Javascript (Java, CoffeeScript, Objective-J, ClotureScript, even minified-JS) to be source level debugged in the browser.<p>Firefox will also be sporting support for SourceMaps. <comment><USER2> If you'd like to help with the Firefox implementation, there's code and specs here <https://wiki.mozilla.org/DevTools/Features/SourceMap>

</comment><comment><USER2> This is coming to Firefox as well. I remember watching an intern present some early prototypes a year or so ago.

<comment><AUTHOR> Do you know if Firefox is making progress, or is it stalled?

<comment><USER3> <https://wiki.mozilla.org/DevTools/Features/SourceMap>

It's reached a demoable state, but is not complete and can't be landed: it was worked on by an intern and the intern has now gone back to life.

<comment><AUTHOR> :( That happens at Google often too. We are always happy when Summer-of-Code rolls around and we get interns again. :)

<comment><USER4> That old 'unpaid labor' thing working out well for you then!

<comment><USER5> Successful Google Summer of Code students get paid for their projects.

<comment><USER6> _That old 'unpaid labor' thing working out well for you then!_

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Demo of another SourceMap effort used to debug Coffeescript: <http://www.youtube.com/watch?v=UAGAB-yT0lQ>

</comment><comment><USER8> Do SourceMaps allow you to debug CoffeeScript in Chrome and if so what exactly do you do?

<comment><USER9> It allows you to debug _any_ language that compiles to JavaScript, with the caveat that the language's compiler must output source-map compatible code (or the source must be run through some other program that somehow does it).

It's a pretty simple but extremely useful idea. To use your example, the CoffeeScript compiler knows exactly which bits of generated JavaScript correspond to exactly what bits of CoffeeScript code, so the compiler can output a mapping that says "these lines of JavaScript are the result of this line of CoffeeScript...so when you step through this CoffeeScript line, execute these X lines of JavaScript, if an error occurs in these X lines of JavaScript show there error as occurring on line Y of the CoffeeScript code.

I haven't done much front-end lately so I'm not sure what if any the CoffeeScript compiler has in terms of generating source maps, but if browsers are supporting it I imagine it won't be long if it's not here already.

<comment><AUTHOR> AFAIK, the CoffeeScript guys are working intensely on it. To some extent, any language which has accurate source position information in its parser/AST, and uses Closure Compiler on the backend can get source map output almost for free.

<comment><USER9> Yea I would imagine they are. I haven't been following the development like I used to, so thanks.

How accurate does the source position information have to be? I don't think the CoffeeScript lexer can output column numbers (at least it didn't last time I checked) and the re-writing stage might give them a little trouble. Should be doable though.

Guess I should head over to github and see how they're doing and start reading the SourceMap spec.

<comment><AUTHOR> IIRC, you only need line number and filename. The map is JS <startline/startcol> -> Source <line,filename>

<comment><USER10> However, you can embed extra metadata for your specific source language if you wish, via the extension mechanism. Debug tools can then read the metadata in to do extra neat kinds of mapping (such as collapsing "native" stack frames).

</comment></comment></comment></comment></comment></comment><comment><USER11> Very interesting. The reason we didn't want to use GWT was precisely because of the difficulty of debugging. This is a big step in the right direction.

The talk emphasizes debugging js as output of another language. But did I understand correctly that it can be used to debug js programs directly? Makes sense and would be awesome.

Great job - again.

<comment><AUTHOR> Yes, if you have regular hand-written JS, and let's say you run UglifyJS, YUI Minifier, or Closure Compiler, to generate compact, optimized JS, with source maps, the debugger will show the _original_ JS source.

The demo I showed also is using SuperDevMode for GWT, which dramatically speeds up the compile. Notice, I compile a project (the Mail sample) of several hundred Java source files in less than 2 seconds.

<comment><USER11> Thanks Ray. Nice tool for reverse engineering then. :)

<comment><USER12> This is not reverse engineering. The compiler generates the compact javascript along the SourceMap.

<comment><USER9> I think what they mean is say you have a bit of obsfucated, minified, and or complex JavaScript code you want to reverse engineer. You can start writing a an "unobsfucated" version in JS, pseudocode, whatever you wanted....and use source-mapping to switch between looking/working on that and the original in the debugger all while the browser is actually executing the original code (negating worries that your translation is incomplete or behaves differently, these are concerns _during_ certain steps of the process...obviously you want to end up with a perfect translation in the end)

That would be a useful tool in reverse engineering.

</comment></comment></comment></comment></comment><comment><USER13> Is this in Canary? I know you said "soon" but I'm always unsure if soon means soon in stable/dev or soon in canary.

<comment><USER5> In Canary 19.0.1074.0 for me

</comment></comment><comment><AUTHOR> BTW, thanks for all the positive feedback. If you are working on a language translator to JS and end up including sourcemap support, just ping me on G+ and I'll put it into a directory of source-map enabled tools.

</comment><comment><USER14> hope js_of_ocaml implements this.

</comment><comment><USER15> Link to documentation? If I wanted to build my own little JavaScript preprocessor and make it use SourceMaps in Chrome, how would I know the file format(s)?

<comment><USER15> Oh hey -- here's Google's current draft, linked from the FireFox bugs about it: [https://docs.google.com/a/ooyala.com/document/d/1U1RGAehQwRy...](https://docs.google.com/a/ooyala.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k/edit)

</comment></comment><comment><USER12> Debugging GWT through the dev mode used to be slow and painful. The SourceMap will definitely make GWT development more cool.

Great move guys!

</comment><comment><USER7> I would love to debug coffescript with this.

</comment><comment><USER16> Isn't source mapping part of ES6?

<comment><USER5> SourceMap is a tool feature - no need to modify a language (except if you count making the compiler output SourceMaps).

Maybe you're thinking about how the Traceur ES6 to JavaScript compiler outputs SourceMap information?</comment></comment>


The MIT license (with personal exceptions) - <AUTHOR> https://github.com/jamiebuilds/license <comment><USER2> For context, jamebuilds is the maintainer or contributor of many javascript libraries like Lerna, Babel, and Yarn. He recently tweeted [1] that he would go to war with Palantir for collaboration with ICE. He opened several issues with Palantir's blueprint which uses Lerna [2]. He then opened a PR to change Lerna's license with the MIT license (with persional exceptions) [3] where it was merged after the original author agreed since jamebuilds is one of the primary maintainers now. Palantir did respond in one of the issues [4] where they clarified they work with HSI and would be open to meeting in person but it did not seem to change jamebuild's opinion.

[1]: [https://twitter.com/jamiebuilds/status/1034517589001613312](https://twitter.com/jamiebuilds/status/1034517589001613312)

[2]: [https://github.com/palantir/blueprint/issues/2870](https://github.com/palantir/blueprint/issues/2870),

[https://github.com/palantir/blueprint/issues/2875](https://github.com/palantir/blueprint/issues/2875),

[https://github.com/palantir/blueprint/issues/2876](https://github.com/palantir/blueprint/issues/2876)

[3]: [https://github.com/lerna/lerna/pull/1616](https://github.com/lerna/lerna/pull/1616)

[4]: [https://github.com/palantir/blueprint/issues/2870#issuecomme...](https://github.com/palantir/blueprint/issues/2870#issuecomment-416676079)

<comment><USER3> Useful background, thank you. Am I alone in thinking the response from Palantir looks like more feedback than one would have expected from the average corp? It makes jamiebuilds' reply seem more provocative than it otherwise would have, but I praise their conviction to their morals.

Edit for vague closing sentence: I'm praising jamiebuilds' moral conviction.

</comment></comment><comment><USER4> I don't get what this is supposed to accomplish. The license doesn't specify that Walmart can't use the software. It grants everyone except Walmart, Microsoft, etc, the following rights:

> to deal in the Software without restriction, including without limitation > the rights to use, copy, modify, merge, publish, distribute, sublicense, > and/or sell copies of the Software, and to permit persons to whom the > Software is furnished to do so, subject to the following conditions:

> The above copyright notice and this permission notice shall be included in > all copies or substantial portions of the Software.

Those are the entire conditions to which a grant of rights is subject.

So, while Walmart doesn't get to use this license directly, anyone who isn't on the list is free to copy the software, redistribute it to Walmart for any or no charge, and to themselves permit Walmart to deal in the software without restriction, including by using it, copying it, selling it, or anything else.

What rights exactly has Walmart lost here? Does this differ in any tangible way from the standard MIT license?

Jamie's put up a disclaimer saying "I don't care if this is not 'open source', it's the right thing for me to do." But this is just as open as it was before. I'll grant permission right here for Microsoft, Palantir, Amazon, Northeastern University, Ernst & Young, Thomson Reuters, Motorola, Deloitte, Johns Hopkins, Dell, Xerox, Canon, Vermont State College, Charter Communications, Spectrum, Time Warner Cable, LinkedIn, UPS, Walmart, Sears, Apple, Tyson Foods, Target, Tesla, and the H&M group to use the software without restriction.

<comment><USER5> You can't remove the permission notice, though. So maybe legally they can keep using the software, but they have to also keep the bit that says they can't use it.

<comment><USER4> The list of companies isn't part of the permission notice. The permission notice is the text saying "Permission is hereby granted...". That's why the terms say you have to include the permission notice _and_ the copyright statement. Neither includes the list of disfavored companies.

</comment></comment></comment><comment><USER6> Don't sponge off the MIT license's goodwill. Make up your own name.

<comment><USER4> As I point out sidethread, he hasn't actually modified the license, so it seems fine for him to use the "MIT license" name.

He's published a list of companies, such as Amazon, to which he isn't directly granting permission to use the software. But anyone who isn't on the list, such as Jeff Bezos in his personal capacity, is free to both provide the software to the companies on the list and to grant them permission without restriction to use, copy, modify, distribute, sublicense, or otherwise benefit from the software.

<comment><USER7> Couldn't MIT complain that he is using the "MIT" trademark for something that they don't sanction?

</comment></comment></comment><comment><USER8> Please don't let this be a thing, sigh. I don't want to be further entrenched in identity politics.

<comment><USER9> You're just throwing words around. There's nothing about this that has anything to do with identity politics.

<comment><USER10> Do you really expect anybody to believe that?

</comment></comment></comment><comment><USER9> I personally like the idea of these kinds of licenses, however I prefer the idea of licenses which do not grant such rights to certain types of entities without a written exception. Much more future proof. I remember somebody posted here a license that required Government institutions to get explicit permissions. That was quite a good way of doing things.

While I'm very strong on Libre software, for me I personally have a distaste for blind ideological adherence to the idea, at the expense of actual outcomes for human wellbeing.

</comment><comment><USER11> Seems like this would be fine if software is created by contractors or third party vendors for these companies? If that's the case, then the impact would be lesser.

The "abusive treatment of workers" clause, if applied thoroughly, _should cover every single large electronic device /appliance manufacturing company in the world that gets things made in China_ (using China here as an example, not that worker abuse doesn't happen elsewhere) — like Samsung, LG, HP, Lenovo, Sony, and many, many more.

Also, this license could have a larger impact if it's adopted by many other prominent and popular pieces of open source software.

<comment><USER12> > Seems like this would be fine if software is created by contractors or third > party vendors

I had the same thought. Seems like it would be trivial to create a "license condom"[1] in the form of a contractor who exercises the rights granted under the license as a proxy for the real user. I'd add "...or any entity acting on behalf of same" to the end of the first paragraph. Or even better, I'd get a real copyright lawyer's opinion about what phrasing to use.

[1] Don't blame me for the term. It has been around for a while, and the subterfuge to which it refers is a large part of the reason GPLv3 exists.

</comment></comment><comment><USER13> An interesting idea. Part of me thinks this may be potentially useful in causing change, depending on the projects that adapted it.

Another part of me dislikes bringing politics directly into software. What offends people varies from person to person and imagining every FOSS project having a different, and constantly changing exception list gives me a headache. This seems somewhat antithetical to at least certain aspects of open source

</comment><comment><USER14> If you're going to go down this road, shouldn't the list also include ICE itself and contractors hired by ICE?</comment>


Off the 3-D Printer, Practice Parts for the Surgeon - <AUTHOR> http://www.nytimes.com/2015/01/27/science/off-the-3-d-printer-practice-parts-for-the-surgeon.html?_r=0 <comment><USER2> Practice parts for the surgeon off the 3-D printer.</comment>


6502cloud – Bringing the 80's to the cloud - <AUTHOR> http://www.6502cloud.com/ <comment><USER2> I keep forgetting that the Atari 2600, the NES, the Apple II and the C64 had the same processor. But... didn't the C64 have a modem? So it should be able to connect to the Internet, even if very slowly?

<comment><USER3> Probably everyone reading this (including you) already know that, but my OC forces me to specify, that C64 had MOS 6510, which was an improved version of 6502.

<comment><USER4> Yes the 6510 had an on-chip cassette interface. State-of-the-art. Ran at 1Mhz tho', the Beeb ran at 2Mhz making it the beast in the 8-bit stable.

<comment><USER5> The 6510 ran at 2 MHz on the C= 128 if the VIC was turned off.

[https://wphosting.tv/how-to-use-the- commodore-c128-in-2mhz-f...](https://wphosting.tv/how-to-use-the- commodore-c128-in-2mhz-fast-mode/)

</comment></comment></comment></comment><comment><USER6> Can we get a cloud SID chip to go with it? I need to play some classic C64 Labyrinth.

<comment><USER7> It would be considerable work. I would need to rip the SID emulator code from somewhere. Then i could have it generate a WAV file or something to return.

<comment><USER8> Were you inspired by David Beazley's talks? [https://www.youtube.com/watch?v=1VRM_PebPeE](https://www.youtube.com/watch?v=1VRM_PebPeE)

I'm not sure if it is in the linked one, but he loaded MS BASIC successfully off of an audio cassette. Don't believe his machine had sound output but incredibly relied on audio input for reading from "disk" (tape).

</comment></comment></comment><comment><USER9> This is all very hilarious, but I'm actually quite serious about the effort to get my favourite 8-bit machine from the 80's - the Oric-1/Atmos/Telestrat machines (which also use 6502-based CPU's) - onto the Internet.

So, actually this could be quite useful - especially if we treat the machine state of the local system as transmutable, to be transferred up to "6502Cloud" for execution later. This could indeed be the beginning of an Oric-1/Atmos revolution in Internet communications!

(Disclaimer: TODO: Give the Oric-1/Atmos a Modem/Wifi device ..)

<comment><USER10> Get a Wifi232 card when there's another run. They're wifi modems that connect via RS232 and provide a hayes command set interface.

<comment><USER9> Yeah, thanks for the advice - I'm considering a lower-tech solution though, using just a plain ol' ESP32 board, wired up to the ol' Oric. Actually thats not the hard part - once this is working, we'll still have to write a TERM app for the Oric, which is all the fun I suppose ..

</comment></comment></comment><comment><USER11> This is excellent.

I've been learning 65c816 assembly for SNES programming and I've wanted a tool much like this.

The 65c816 is based on the 6502, I wonder how much work it would be to extend this.

<comment><USER7> Probably not to bad, if you have a decent emulator to hack on. Its a matter of making it cloud worthy (AWS Lambda, Gateway, setting up DNS, and all the other parts that are a pain in the ass.)

</comment></comment><comment><USER12> They should have put a macroassembler in front - you upload the LDAs and STAs and get the execution back :) Rodnay Zacks would be proud!

<comment><USER13> I made a thing to play around with it online (it uses dasm) [http://requirebin.com/?gist=348a0d28a6ee1c2907106b40f7d19d99](http://requirebin.com/?gist=348a0d28a6ee1c2907106b40f7d19d99)

Or you can just view the output directly: [http://requirebin.com/embed?gist=348a0d28a6ee1c2907106b40f7d...](http://requirebin.com/embed?gist=348a0d28a6ee1c2907106b40f7d19d99)

</comment></comment><comment><USER7> Thanks for the comments everyone.

If there's a feature you're interested in, let me know on reddit u/6502cloud..

</comment><comment><USER14> Looks like fun, but you'll have to have a VIC-II in the cloud or something like that if you want to do anything graphical with it. So much of the way those machines worked depends on the NTSC/PAL video timings -- raster interrupts and so forth.

<comment><USER15> and a SID chip for audio synthesis. :)

SID chip emulation just isn't the same, since the chip has both analog and digital components in the same die.

</comment></comment><comment><USER16> It's projects like this that make me love hackers. Perfect combo of silly and awesome.

<comment><USER17> _Synthwave intensifies_

</comment></comment><comment><USER18> bit OT: How about the other way around, a 8/16 bit computer that can connect to the internet, not to run a browser, but some sort of BBS like system, to interact with other owners. Throw in a SD card as storage medium to make it a bit more practical.

<comment><USER19> There have been a few articles on here recently about people doing just that via a serial-to-wifi "modem" dongle.

<comment><USER18> Yea, the actual process of connecting is solved, however, it would be cool if there was actually a service, sort of the old BBS, for these old machines, something scaled to their cpu and memory requirements, you will never be able to load even a stripped down web page

<comment><USER20> There are telnet accessible BBS services still around: [http://telnetbbsguide.com/bbs/list/brief/](http://telnetbbsguide.com/bbs/list/brief/)

</comment></comment></comment></comment><comment><USER21>
        LDA #$21
        JSR $FDED

<comment><USER22> I don't think the Apple ][ monitor ROM is included in this project, but I hear ya... =)

<comment><USER23> You could JSR $FDD2 instead and it would work on any Commodore computer.

[https://en.wikipedia.org/wiki/KERNAL](https://en.wikipedia.org/wiki/KERNAL)

Most Commodore computer models shared a common jump table at the top of ROM for basic input and output.

</comment></comment></comment><comment><USER24> Umm... why this remember me to 0x10c , Trillek, Techcompilant ...

<comment><USER24> apart of the game, was the idea of having a cluster or a cloud of servers to run the virtual computers inside of the game. Remember that the original 0x10c initially was to have a 6502 CPU but Notch change his mind and make his own 16bit CPU.

</comment></comment><comment><USER25> I got super excited at first, thought this was an 80's music startup. Then the pump fake to assembly.

</comment><comment><USER26> I need mapper support first</comment>


Ask HN: When do you call it a startup? - <AUTHOR>

I realize this is more of a question on semantics, but it usually leads to some interesting discussion.
At what point does 'it' become a startup? Is it when you incorporate, get funding, or some other milestone? When you drop everything else and work on it exclusively? When you get your first users?
There are so many goals and tasks of a startup that I've always wondered what others define as the 'beginning' of a startup. What're your thoughts? <comment><USER2> I don't think there is really an objective answer for this, but here's my take: I basically started thinking of Fogbeam Labs as a startup when I did all the legal blah, blah to create the legal entity.

When to drop everything and work on it exclusively is a different question. I still haven't done that, and me and my co-founder both still work dayjobs and hack on this by night and weekend and other "miscellaneous" time (lunch breaks, plane flights, etc.) For us, I think I'll quit my dayjob and focus on this when A. we have a paying customer definitely on the hook, ready to sign a PO, and/or B. I have enough cash reserve to give me a minimum of 6 months of runway (assuming my current $DAYJOB employer says they would want me back if it doesn't fly, which I think they would) and/or C. crowd-funding becomes a reality and we raise a reasonable but small amount of money that way.

Less likely options for us are: D. raising money from more traditional angels or VCs, or E. winning the lottery.

<comment><AUTHOR> The 'when we become a legal entity' seems to be a pretty common answer.

What I've been thinking about lately is how passion plays into it - like you said, while you have a day job, your startup is what you're dedicated to hacking on whenever you can. Good luck with Fogbeam Labs, and I think we'd all love option E ;)

</comment></comment><comment><USER3> Before you're making money it's just a startup. When you're making money it's a business.</comment>