Designing a RESTful API That Doesn't Suck - <AUTHOR> http://devo.ps/blog/2013/03/22/designing-a-restful-api-that-doesn-t-suck.html <comment><USER2> Time, content types and showing the developer (and user) what's possible (HATEOAS)...

 _Time_

Using UNIX time may be easier for a developer, and I do concede that point, but by using UNIX time you're doing a few things:

1) You're exposing some internal logic or data structure of the system in the resource

2) You're removing information on time zone

3) In some circumstances where greater precision is needed you're precluding the use of nanoseconds

I know that some languages don't naturally handle ISO8601 dates with nanoseconds, but I do think that's the best format.

YYYY-MM-DDTHH24:MI:SS.NNNNNNNNNZ

With that format one can keep a deeper knowledge of timezone, of precision, of human readability (and JSON.org does say that JSON is easy for humans to read).

 _Content Types_

Whilst it may be pragmatic to not plumb the depths of custom content types they should at least be mentioned and made compulsory even if they aren't typed to a detailed level of specificity. Content Type: application/json is fine, so long as it's used and paid attention to.

 _Capabilities_

HATEOAS and meta-data... I like to encourage developers to explore what's possible in the API by showing them the actions that they can do on an item, and their permissions. As in... if they can update something, show them how by telling them the URL. The API should ideally not lead a developer to an action that they couldn't perform.

 _Minor Points_

I generally prefer to restrict the possible HTTP status codes and publishing that list so that a developer implementing against the API can build a generic wrapper, know what to expect and take care of handling it. Which means, sometimes I will generalise a response rather than using a status code in one place and one place only.

I'm not so sure on using verbs for special actions like search, 'q' is a well understood part of the 'query string', and I'd make that just an optional parameter on the pluralised collection URL. But... perhaps that's just a bad example.

<comment><USER3> On your "Capabilities" point, if it's REST you don't need to tell them the URL. With REST, the URL for a resource never changes.

<comment><USER4> > With REST, the URL for a resource never changes.

I could have an endpoint example.com/users become example.com/subsite/users. It is precisely _because_ the URL might change that you want to give the client URLs to the next possible actions.

<comment><USER3> Er, but no; you're very wrong.

First, yes, you could change your "endpoint" URL, but that's not the reason for providing URLs in HATEOAS (just for the record, I hate(oas) that acronym).

You see, REST is different from most other Web services because it doesn't provide access to _actions_ , but to resources. It can be compared to the good old SQL database -- and a resource's URL is the way to uniquely identify that resource, just like in a RDB you would have a combination of a table and a unique identifier.

The reason for providing URLs is to free the consumer from having to construct it by hand each time. In fact, an URL can change -- but not an URL to a single resource (just like you wouldn't arbitrary change a RDB record's ID); rather, a completely different resource can be provided instead.

<comment><USER4> I misused "action". Replace "to give the client URLs to the next possible actions." with "to give the client URLs so they can perform their next possible actions on related resources".

My point remains: one of the main reasons of using HATEOAS is so that you can evolve your API without breaking clients. The other main benefit is so that your client can discover your protocol by simply following hypermedia controls.

</comment></comment></comment></comment></comment><comment><USER5> Encoding the version number in the URL may be convenient, but certainly does not follow REST. Consider the following pair of URLS:

        /api/v1/posts/1

        /api/v2/posts/1

This implies out-of-band information that these two resources are actually the same entity.

The version number belongs in the `Accept:` field of the HTTP request headers; for example `Accept: application/json; version=2`

<comment><USER6>
      Accept: application/json; version=2

Is that a standard-compliant media type? `version` doesn't appear to be associated with application/json in the IANA media type registry, and I couldn't find anything definitive about adding arbitrary parameters.

<comment><USER7> I'm pretty sure parameters are not limited to those provided by IANA (just as media types are not necessarily IANA-registered incidentally) e.g. RFC2616's Accept doc shows a `level` parameter to text/html which is not IANA-specified (and seems entirely unspecified)

<comment><USER6> Yea I saw the use of level in the example but didn't think to look at the text/html spec to see if it was there. That would seem to imply that you are correct (though it would be nice if there were an explicit answer on this, if only for purely OCD reasons).

> just as media types are not necessarily IANA-registered incidentally

Per RFC4288 I believe they must be if they are in the standard tree (i.e. the name does not contain a '.' or an 'x-' prefix for historical reasons).

</comment></comment></comment></comment><comment><USER8> How about the most important concept, <http://en.wikipedia.org/wiki/HATEOAS> ?

<comment><AUTHOR> I was planning on diving in deeper in my next post. This was more of a quick and practical list of things you should follow for your API not to suck too much.

But yeah, I agree.

<comment><USER9> Would love a practical HATEOAS point by point write up like the posted article. Nicely written

</comment></comment></comment><comment><USER10> agree with everything except... unix time, really? Unix time has all sorts of weird potential problems, including year 2038, historical inconsistent handling of leap seconds[1], more.

ISO8601 or bust!

Other than that, yes, I think there are things about REST and REST-like API's that are not clear and subject to debate about best way to do it -- but none of them are mentioned in this post, these are the floor, yep.

[1]<http://cr.yp.to/proto/utctai.html>

</comment><comment><USER11> What's a RESTful way of authenticating users when you will also have a web app that will use the same API? Should there be just OAuth for API users, and cookies/sessions for web users, or is there a way to make both use the same authentication method?

<comment><USER12> Why don't you use OAuth for your Web app as well?

</comment></comment><comment><USER13> I still don't get why we're using the API version _in the url_. We should use the specialized content-type instead!

<comment><USER14> Because that approach isn't recommended anymore. In short, it's much harder to for a cache to work effectively based upon Accept & Content-Type headers than it is for it to work on the URL.

For example, here's a quote from Roy Fielding: "In general, I avoid content negotiation without redirects like the plague because of its effect on caching.". In other words, content negotiation for a versioned content-type is OK... if it redirects to a URL that contains the version.

httpbis, the IETF working group in charge of maintaining and developing the core HTTP spec, has deprecated content negotiation: <http://trac.tools.ietf.org/wg/httpbis/ticket/81>; it's still part of a separate spec (RFC2295), but it's not a core component of HTTP anymore. Why? 'HTTP content negotiation was one of those "nice in theory" protocol additions that, in practice, didn't work out.'

Certainly you can still build an API that works fine using specialized content types. Versions in the URL are a pretty practical approach that work very well too.

<comment><USER15> Having admittedly not descended very deeply into the rules regarding HTTP caching, why should it be harder to cache based on the cross-section of the URL and the Accept-Header and not simply upon the URL?

I am not certain which method I prefer more honestly, and could fall either way. The comment that it was nice in theory but didn't work in practice seems to more point to not following the spec as it was written then a problem with the spec itself.

<comment><USER14> I would say it's far more difficult if you want to support the full range of capabilities that the Accept header supports. Accept can support more than a single mime-type, and can also include priorities on each mime-type accepted. If you combine that with multiple clients, I think caching based upon that header would be pretty difficult (or you'd have to make some simplifying assumptions).

Impossible? No, not really.

Worthwhile? My opinion is no. I haven't seen the practical benefits of the content-negotiation approach over the URL approach, but I have seen the practical difficulties, so I'm convinced.

</comment></comment></comment></comment><comment><USER7> Discussed:

* HTTP verbs

* status codes

* look of URLs

* error messages

Not discussed:

* content types

* hyperlinks

Conclusion: not about REST or RESTfulness, guide about RPC-over-HTTP.

<comment><USER16> Not to mention that JSON (by itself) is not sufficient for hypertext

<comment><USER7> Naturally, but that's covered in "content types". Also you could always use LINK headers with whatever @rel, depending on what you're linking or how.

</comment></comment></comment><comment> brown9-2 I've found that it is very helpful to include some sort of pseudo-unique "Incident number" in error responses which you also log in the server's log along with any exception/error details.

This makes it very easy then to correlate issues reported by users with the actual errors/requests in the log.

</comment><comment><USER17> Every few months people start an argument about post vs put vs patch and versioning in the url vs some header. I think a lot of developers aren't fully aware of PATCH and making put actually fully replace an object can be dangerous. This probably especially bad if you use some schemaless db. For versioning, I like to support both. Let the user do what makes them happy. Not really that hard to support URL and header...

</comment><comment><USER5> Isn't a Web site also a Web service? Following REST, should't the Web site and API be unified, with the same resources being consumed by both humans and robots (by varying the representation)?

I posted this question on Stackoverflow a few weeks ago: [http://stackoverflow.com/questions/15360415/should-a-web- sit...](http://stackoverflow.com/questions/15360415/should-a-web-site-also-be- a-web-resource)

</comment><comment><USER18> Another article where the author thinks(confuses?) REST and CRUD have a one- to-one mapping?

Ref: [https://jcalcote.wordpress.com/2008/10/16/put-or-post-the- re...](https://jcalcote.wordpress.com/2008/10/16/put-or-post-the-rest-of-the- story/)

</comment><comment><USER19> I wonder if there is some convention for automatic api exploration. Would be nice also for auto documentation.

<comment><USER20> There is -- hypermedia. That's the practice of driving your API by following hyperlinks, rather than by constructing URLs and requesting them.

There are several schemes of encoding link information in API resources. I like the Hypertext Application Language, or HAL, the best. Check it out: <http://stateless.co/hal_specification.html>

<comment><USER21> The Github API started to implement it but is now going backwards[0]:

      Standardize on existing *_url attributes for hypermedia. Remove all _links objects

If somebody knows the rational behind it I would love to hear it.

[0] <http://developer.github.com/>

</comment></comment></comment><comment><USER22> POST for update and PUT for create, not the other way around.

EDIT: Wow. A lot of people who think I'm wrong. I agree with you that its not the whole truth, but I think its more true (for most cases) than what the article say.

<comment><USER23> PUT for creating and complete updating, PATCH for partial updates.

POST has no useful semantics (more correctly, its semantics is just like those of "do"/"execute" verb) and should be used only if no other verb matches. Or for compatibility reasons ("POST /foo\nX-HTTP-Method-Override: PUT")

<comment><USER24> > POST has no useful semantics (more correctly, its semantics is just like > those of "do"/"execute" verb) and should be used only if no other verb > matches.

While POST is often used as a generic "do"/"execute", its actual defined semantics in RFC2616 are for the server to "accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line."

So, aside from fallback uses, its explicitly the correct verb to use for a request that is intended to create a resource where the client doesn't know the identifier of the resource to be created, only its parent. This is particularly likely to be the case anytime the resource to be created is of a kind that will have a server-assigned key that will be part of the URI.</comment></comment></comment>


[Show HN] Resumonk-Jekyll - A free Jekyll blog theme built using Foundation 4 - <AUTHOR> https://github.com/resumonk/resumonk-jekyll-theme

<comment><AUTHOR> At Resumonk, we have started using Jekyll as our blogging platform. We've just finished designing a Jekyll theme to match our website's design. Since there aren't many Jekyll themes out there, we thought we'd release this in the public domain. We hope you find this useful.

Demo - <http://www.resumonk.com/blog>

Download - <https://github.com/resumonk/resumonk-jekyll-theme></comment>


Show HN: Versioned structured data, with change-request mechanic, at scale - <AUTHOR> http://copernic.space/about/ <comment><USER2> What would an example implementation of this be?

<comment><AUTHOR> I think, I do not understand the question.

The implementation is mostly in [https://github.com/amirouche/copernic/blob/master/copernic/v...](https://github.com/amirouche/copernic/blob/master/copernic/vnstore.py)

It used in frontend/views.py

I can elaborate on how it works if you want.

Or do you mean "How a B2C or B2B product can take advantage of the change- request mechanic?". Or in other words, "How to implement change-request mechanic in another product?".</comment></comment>


Ask HN: Does anyone know if Apple plans to address the MacBook keyboard issue? - <AUTHOR> Does anyone have any idea if Apple is going to DO something about the MacBook keyboard issue? Or if this is simply the new normal for Apple laptop keyboards?
I know that the current butterfly mechanism is v2, it's slightly improved over the very 1st iteration (which appeared on the original 12" MacBook retina).
Will there be a v3? <comment><USER3> If anyone knows apple the way that I do. The answer is yes and no. Yes they will address it when it affects their bottom line. No, because they don't consider it an issue to begin with. I'm old enough to remember when they had the logic board issue and specifically gave us (Apple care reps) instructions to not mention it to the customer. So if you called with an unrelated issue, I wasn't allowed to tell you about the recall to replace your logicboard that had an 80% failure rate. Or that the reason the system wasn't booting up was possible the logic board issue.

I don't think a company that knowingly ships a bad product, then, either dodges responsibility. Or puts the onus on the consumer will actually do anything right by the consumer with this keyboard issue. As if it's the consumers fault for buying a shitty product.

<comment><USER4> This. My last trip with my macbook pro to the genius bar went this way. My keyboard didn't work. He looked at my screen, then whispered: "your screen is having a recall -- look at the glossy layer - it is coming off -- we replace it for free".

I mean apple sure knows how to take my payment in 15 seconds at the store with my information and email address. But somehow they can't inform me of a recall.

<comment><USER5> No joke, since reading this comment I have confirmed in person my MacBook pro is covered and lined up a screen replacement with them. I really would have kicked myself if I found out about this after the coverage period ended. I guess it pays to read HN comments!

</comment></comment></comment><comment><USER6> Even if they have, they are known for super strict security rules, so it won't be disclosed.

I saw a link to their patent application where they patented a way to protect the current keyboard design from dust and crumbs.

Personally, I got tired of their disregard for software developers issues with hardware, and now my working machine in the new XPS 13 from Dell. I am happy with it.

<comment><USER7> As an EE, I despise using laptops, rather want real engineering workstations.

So what is it with software developers and laptops? The portability? Or rather people just being used to a laptop since they are ubiquitous in college. Even plugged into monitors, laptop keyboards just plain suck.

I have an XPS-13, and it's handy for field use with GNU Radio, but can't fathom doing anything productive on it.

<comment><USER8> At my company we have laptops because the company wants people to secure them when they're not at their desk, by taking them with them. Home, meetings, you name it.

Almost nobody uses their laptop keyboard, however, unless they're using the laptop away from their desk. We all have 2-3 monitors and external keyboards & mice.

<comment><USER7> Opposite here. My employers considers them liabilities, and it's pulling teeth to get one.

</comment></comment></comment></comment><comment><USER9> I got sick of it myself and switched to a Lenovo X1 Carbon. Comparison here: [http://blog.richard.do/index.php/2018/05/2018-macbook-pro- vs...](http://blog.richard.do/index.php/2018/05/2018-macbook-pro-vs- lenovo-x1-carbon/)

<comment><USER10> Thanks for the concise review. Off-topic question, though:

> but due to the ports issue (which Apple are taking the piss with)

What does "taking the piss with" mean in this context?

<comment><USER11> In British English this would mean "playing a joke", essentially.

If I tried to convince you that London is actually located on Mars, or that Brexit is a good idea, I'd be taking the piss.

</comment></comment></comment><comment><USER12> Let'ss Hope soo becausse it's gettiing to be quitee annnnoying.

<comment><USER13> I laughed and then I cried and then I laughed tears at this commment.

</comment></comment><comment><USER14> I bought a 2015 refurb instead of a new macbook because of the keyboard issues. It'll get me over this issue and into 2020, I believe.

<comment><USER15> That is what my entire office did too, holding out hope the next generation has a reliable keyboard and no touch bar

<comment><USER16> Same at our office. mid 2015 model 15" is the standard issue for developers. A few people go the latest model and all have regretted it.

Seems like Apple can't walk and chew bubble gum at the same time. iPhone and Watches is all they care about and they don't put any thought into Macs anymore.

<comment><USER17> I didn't think it would drag out this long.

</comment></comment></comment></comment><comment><USER18> I have the 12" MacBook, so it's the v1 keyboard, and after I got used to it, I was OK with it.

<comment><USER19> I'm not exactly sure which "issues" the OP is talking about, but one of the biggest issues isn't just "getting used to" the new keyboard, but the fact that the new keyboard breaks so easily and then costs so much to replace. At that point it doesn't matter how much you like the new style of keyboard, because if your S key is broken, the keyboard is practically unusable.

I have a v2 butterfly keyboard and I actually do prefer the tactile feel over older MacBooks, but the fact that a single piece of hair/dust has broken my keyboard is really unacceptable and something I definitely would like to see addressed.

<comment><USER18> Breakage applies to a subset of users. Everyone has to get used to typing on it. Typing on it was the issue I was referring to.

</comment></comment></comment><comment><USER20> Do you remember when Apple laptops had the best keyboards in the business? I miss those days.

</comment><comment><USER21> I wonder what it's like on Apple's campuses? I'd guess their employees all have new laptops, or at least Touch Bar equipped models. How many have the Bluetooth Magic Keyboard & Track Pad at their work station too? If they do use external keyboards how do they charge them? From a monitor's USB3 ports? wall outlet with charger nub? USB C to USB 3 dongle? You have to have one of those methods to charge by Thunderbolt on the Touch Bar laptops … Seriously, that seems like a viable metric to understand satisfaction with the onboard keyboard & trackpad. Or maybe Apple doesn't think this is as big an issue as it is because so many people are now relying on alternate input devices.

</comment><comment><USER22> The keyboard is one problem, but there are others.

My secondary machine, a 2014 13'' retina MBP, started having battery problems. Went to an official repair service (Apple does not fix stuff here in Mexico). To replace the battery I would have to replace the whole top panel of the machine (keyboard, trackpad, etc) which costs like $600 USD. Apple would in turn buy the piece removed from my computer and lower what I had to pay to $350 USD.

$350 to replace a battery is still ridiculous, specially considering that it's the first piece to degrade on a laptop.

Since I don't depend much on that laptop I will live with a bad battery as long as I can. In a year or two I will reconsider my options.

</comment><comment><USER23> I have broken v1 and v2 MacBook Pro keyboards from normal use. Confirmed defective / useless. Really disappointed.

</comment><comment><USER24> I broke my own rule and bought a first iteration of new technology from Apple.

I'm conflicted. I actually enjoy the feel of the new keys, with the notable exception of the stunningly user-hostile arrow keys.

But I'm a bit of a slob, and I've gotten key stick a couple times. I have to baby this thing and I'm used to smashing the keys clean off and having it keep working.

Literally, my 2010 era MBP was missing two keys when it retired.

Half-height left and right arrow keys, and a keyboard that can withstand the crumbs of outrageous fortune. That'd do it for me.

<comment><USER25> I'm absolutely with you on this. (Well, I haven't gotten any keys stuck, but I'm with you on the rest.)

It's a great keyboard, or it would be if it didn't have the crazy failure rate, terrible repairability, and awful arrow keys.

So it's actually, just... kinda... fine.

</comment></comment><comment><USER26> I'm not entirely sure if the problems with the keyboard are simply inherent. The gap between the keys on the new one and the frame is simply tiny, and since the key doesn't move, and because the key hits the bottom when pressed, anything that gets in there isn't going to come out or let the key work normally. With that said, I still do appreciate the thinness of the new MacBooks.

Interestingly enough it also seems to vary between units. The 2017 TBMBP is apparently V3 of Butterfly according to someone who worked at Apple on Reddit, who claims they tried to fix the issue.

The 2016 Retina MacBook (12") that I had was able to handle some serious crumbage and never had issues. I at some point had some real crumbly snacks over it and nothing got inside the keyboard.

Then I got a 2016 MacBook Pro (13", touch bar). Even with lighter use, and trying to keep anything getting into it, I had basically every problem with that keyboard. The only thing that fixed it was a silicone keyboard cover from Amazon, after taking all the keys off and cleaning under them. Then it never broke again because it was effectively sealed.

I wonder if the thinner MacBook has a different keyboard than the Pro (It does, I know that now). I think that might have made a big difference, since the thinner one was definitely less susceptible to pulling stuff into it. Might also have something to do with the airflow from the key going in and out.

On the plus side though, the keyboard covers impact typing a LOT less than they used to because of how thin the keyboard is.

</comment><comment><USER27> Seems like the post should provide some context. What exactly is the issue?

<comment><USER28> The keys on the keyboard randomly stop working. This appears to be due to a design flaw that allows even a small amount of dust to interfere with the key action mechanism. Apple posted a 'fix' involving holding the laptop at odd angles and blowing compressed air under the keys to attempt to get them working again. Anecdotally, several HN users have reported having their keyboard replaced multiple times under warranty due to this issue.

</comment></comment><comment><USER29> Actually, the current version is v3, found on 2017 MBPs. v2 appeared on 2016 MBPs, and v1 on the first 12" MacBook.

I have the v2 version, and this is my third top case, if it were not for consumer laws here, I would have moved to another laptop.

As far as I'm aware there are no plans to address them, we have to wait until the next Apple event to hear more, hopefully.

<comment><USER30> I currently have a 2017 MacBook Pro and the keyboard isn't giving me much trouble. Sometimes something will get in the key mechanism, but blowing into the gap between the key and the case fixes it. After using it, my wife's 2013 MacBook Pro feels really spongy (a keyboard I loved).

<comment><USER29> I don't even want to count how many compressed air bottles I'm through.

Most of the time it fixes the problem, but (so far) three times I had to take it to the Apple Store and claim Consumer Law because the key mechanism broke.

</comment></comment></comment><comment><USER15> Who knows? Nobody knows outside of Apple.

My best guess would be that maybe by sometime late next year at the earliest they will have redesigned the keyboard, but it could easily be 2020 or later, or maybe never. It's also possible the next version won't be an improvement, as many learned when the 2012-2015 MacBook Pro was getting long in the tooth, and the 2016-???? replacement arrived to replace it.

In the meantime, you can do what many of us did: upgrade to a three year old 2015 MacBook Pro, it has many useful ports, MagSafe, an escape key, function keys, a working keyboard, etc, it's an improvement in every possible way except that the enclosure is a little bit thicker.

Or you can do what many of my other colleagues are doing and get a Lenovo as they migrate back to Linux/Windows.

<comment><USER31> I got a macbook 2016 model with touch bar as a work laptop. I was scared of all things, the lack of esc, ports, magsafe. However after using it for X months, I am never going back.

\- The touchbar is great with sliders for brightness and volume. That's ALL I use it for though, so it is a bit under utilized.

\- The esc key might be the only minor issue, but it's mostly the lack of feedback.

\- Ports - I love having to unplug only one dongle instead of the 4-5 USD/HDMI/ETC/ETC I always have plugged in every time I need to move away. And plugging them all back in is also a single action. I'd be ok with less ports even.

\- Magsafe, I still love it but I haven't even missed it.

\- No issues with the keyboard and I haven't used function keys in years anyway.

I think it 'clicked' for me after a few weeks of usage, so I understand people judging it or even returning it after a few days.

</comment></comment><comment><USER32> I think they'll address it by eliminating the keyboard entirely à la the MacBook Wheel[0], albeit perhaps with a touch screen. From an absolute, ergonomic standpoint, it will suck. But soft keys won't fail or get crud in them like hard keys do, and Gruber will soon be writing thinkpieces about how the keyboard is the most failure-prone part of a computer, and the complaints about recent MBP keyboards are inherent failings of hardware keyboards themselves rather than Apple skimping on quality, and Apple is taking the lead in something the industry should have done a long time ago by eliminating the hardware keyboard.

[0] [https://youtu.be/9BnLbv6QYcA](https://youtu.be/9BnLbv6QYcA)

</comment><comment><USER33> When I invoke 1Password with ⌘\, I have to press the \ key reallllly hard. I have to get my hand up on one finger, and use the mass of the hand on just one finger, from a ninety-degree angle, to get that \\. That's because a little piece of dust got into my keyboard.

<comment><USER29> This is pretty much what happened to me, except after a few keypresses, the key broke and never recovered. Apple Store fixed it, though.

</comment></comment><comment><USER34> My guess is the touch bar along with haptic feedback is going to replace the whole keyboard.

<comment><USER35> My guess is that your joking, if not then you must be one of the few touchbar fans ("there are dozen's of us...dozens!").

<comment><USER36> I hate the touchbar, but love touchid on my laptop

<comment><USER35> I'm in the same boat, I really like touchid. I have CAPS LOCK mapped to ESC and have rarely if ever use anything but the function keys on the touchbar. I wanted to like it and use it, but it just doesn't work well for me.

</comment></comment></comment></comment><comment><USER37> let me piggy-back, is Apple going to have proper HDMI ports in future? Im going surface book the moment my current macbook stops working.

<comment><USER38> apple's mo has always been "why go with standardized ports when we can make our own, nearly identical ports and sell you the adapters?"

i think usb is one of the only cases where they haven't. and thunderbolt, sort of. apple loves their proprietary stuff though.

<comment><USER8> That doesn't seem fair. The MBP sitting in front of me has mini DisplayPort, USB, HDMI ... all are standards. The newest MBP has USB-C, which is a standard. My last MBP also had FireWire, which was also standardized.

There are dongles to buy, but that seems to mostly have to do with such things as Thunderbolt and the ability to piggyback older legacy technologies on newer connectors.

Now if you were talking about the phone, I agree. But I also see the point -- micro USB is a terrible, terrible thing. As long as it's robust I would like to see the next phone ditch Lightning for USB-C, but I am otherwise much happier with Lightning connectors than I have ever been with micro USB.

</comment></comment></comment><comment><USER39> Yes, someone knows. (Seriously though, I hate it when people online will ask "does anyone know....?" )

But to answer the question, apple say their plans ahead of time. I'm sure that when they release their next model of laptop it will have a revised keyboard.

</comment><comment><USER40> They will fix it eventually in their own way, as almost always after losing class action lawsuit they release info saying 'some keyboards' and 'in specific conditions', for 'some users' and so on. Then replacement will be $175. But who else to say it better as my favourite Apple basher Louis Rossman: [https://www.youtube.com/watch?v=AUaJ8pDlxi8](https://www.youtube.com/watch?v=AUaJ8pDlxi8) (see description below video if you want tl;dr)

Many people report X1 to be great MBP replacement (I have mid 2014 MBP 13" retina - couldn't be happier and 2017 MBP 15" with s*it strip - well keyboard is awful as well as this touch strip) and from using X1 for a week and from input from people @ work those are not that great either. First of all fan noise and it's rpms it's very annoying, screen quality and resolution (after using MBP with retina) is just horrible, touchpad is just rudimentary - <USER2> but can be better.

</comment><comment><USER41> Wouldn't there have to be an acknowledgement of the "issue" to address the "issue"?

<comment><USER22> Well, there are a couple of class action lawsuits going on.

</comment></comment><comment><USER42> If they do, I'll buy one

</comment><comment><USER43> Well when the internals don't provide meaningful productivity differentiation for 90% of users for the last about 6-8 years now, and the MacBook Air design circa 2012 is virtually indestructible, how else are they going to get their users to upgrade machines every 2-3 years if not for shitty keyboard redesigns?

<comment><USER44> The glued-in battery (not endemic to Apple) genuinely wears down and forces people to upgrade. Not in 2-3 years, though.

<comment><USER43> Takes about 10 minutes to replace. I've done it and it was surprisingly easy.

There is no glue on my 2012 model.

[https://youtu.be/uOJKy7xVpIY?t=105](https://youtu.be/uOJKy7xVpIY?t=105)</comment></comment></comment>


Homebrew 2.0.0 released - <AUTHOR> https://brew.sh/2019/02/02/homebrew-2.0.0/ <comment><USER2> Know what annoys me about Brew? This just happened last night. I had some package that required readline 7.x; Brew uses readline 8 now. It's not possible to simply command `brew install readline@7`. It took me 30 minutes to figure out that I had to cd into the homebrew-core directory, search through github commit history to find an old commit that used readline 7, checkout that specific commit, brew install readline, checkout master again, and then pin readline.

A package manager should not make it that difficult to downgrade a package.

Otherwise -- homebrew's great.

<comment><USER3> Possibly my ignorance talking in terms of what you're trying to achieve, but can't you just do this?

      brew remove packagename

      brew install packagename@versionnumber --force --overwrite

I've done this with Node so I'm using 10 rather than 11.

Edit: my pet gripe with brew is the services syntax. I want to use this:

      brew services httpd restart

Not the existing syntax:

      brew services restart httpd

But in general I'm really thankful that brew exists and it's in active development.

<comment><USER4> This only works when the maintainers have decided to keep around the old version of the software, which is only done for certain popular formulae. Otherwise they get removed quite quickly from the main tap.

<comment><USER3> Ah, I see. Thanks for the clarification.

</comment></comment></comment></comment><comment><USER5> I love Homebrew, especially since I (recently) realized I could use _brew cask_ to install all my desktop applications. I liked the analytics feature in this release. Just the other day, I was looking at alternatives to _official_ Chromium builds that would auto-update. I stumbled upon _freesmug-chromium_ but didn't know how actively it is used by the community. Now I know.

<comment><USER6> I tried to do that for smtg I can't remember. Turns out that it added a lot of deps and compiled the app. I didn't liked it and uninstalled it and brew kept all the deps installed.

It seems it misses an "automatically" installed flag in order to remove the deps I didn't have specifically installed myself in the first place. Would be very great for brew to have that.

Now I avoid trying new apps through brew.

An indication of the formula downloading a pre-built binary or compiling it would be nice too, btw.

<comment><AUTHOR> > It seems it misses an "automatically" installed flag in order to remove the > deps I didn't have specifically installed myself in the first place. Would > be very great for brew to have that.

You can use `brew bundle dump` and `brew bundle cleanup` to achieve this (I often do the same).

</comment></comment></comment><comment><USER7> The argument over the removal of options in this thread [0] is brutal. Very intentionally user-hostile move, repeatedly disguised as being in their overall interest. It left me not feeling very good about the direction the project is taking.

[0]: [https://github.com/Homebrew/homebrew- core/issues/31510](https://github.com/Homebrew/homebrew-core/issues/31510)

<comment><USER8> Just don't say how it's a user-hostile move and that you don't feel confident about how Homebrew development is handled, since you will be blocked from accessing the Github repositories.

</comment></comment><comment><USER9> Is there a more verbose explanation about why they're moving away from compiling packages from source? All the explanations I've seen make it sound like that's the obvious direction it should go, but it's not obvious to me.

<comment><USER10> Maybe ask the question the other way around. Why should they keep compiling everything from source? What are the benefits?

<comment> black-tea You get native binaries, can choose optional features and dependencies and you can easily apply your own choice of patches. That's my view as a gentoo user anyway; I don't know how much of that homebrew actually supports.

<comment><USER11> What does "native binary" mean?

<comment> black-tea Compilers like GCC can produce code specifically for your CPU such that it uses all of the special features you might have like SSE, AVX etc. When binaries are made for general use they have to be compiled with a generic feature set so might not make best use of your CPU.

<comment><USER11> So can a cross compiler, no?

<comment> black-tea If you know the exact flags for your CPU then you can compile for it on any other CPU using a cross compiler line GCC, yes. But that doesn't help because in practice you'll just find one binary per architecture, not per CPU.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Wow, Linux support. I guess that's useful for those times when the OS package manager is out of date? Or is it in order to not run as root?

<comment><USER13> It's very useful when on a remote login where you don't have root but want more modern software e.g. academic HPC clusters with shared filesystems, which tend to have extremely "conservative" OS versions (we are stuck on RHEL6 for the forseeable future).

I'm not aware of much else that fulfills this niche well - conda seems very very tied to precisely tested version combinations, and (from what I remember - tried and had problems) nix seems to want root/system level daemons.

<comment><USER14> pkgsrc[1] is portable to most Unix(-like) systems, and can run as a non- privileged user, so that would likely work as well. I'd trust it more than homebrew anyway.

[1]: [http://pkgsrc.org/](http://pkgsrc.org/)

<comment><USER15> > I'd trust it more than homebrew anyway.

I'm curious why you feel this way.

</comment></comment></comment></comment><comment><USER16> Remember that Homebrew uses Google Analytics by default unless you explicitly disable it.

<comment><USER17> Isn't this punishable by GDPR?

<comment><USER18> IANAL but I believe no personal information is involved.

</comment></comment></comment><comment><USER19> I love brew. But I have heard a lot of complaints against it, and arguments that Nix (and probably Guix) is better. I tried it once, and had a tough time getting my old scripts to find the exact versions. I gave up on Nix. Can someone eli5 why Nix-like approaches are far superior to systems like brew?

<comment><USER20> Nix is just way more reliable than Homebrew, because it does not use system tools, but rather builds the dependencies by itself (including, for example, a C compiler). Furthermore, dependencies will not be overwritten if a different package requires the same dependency, but another version of it, so packages don't break each other.

</comment></comment><comment><USER21> You should not use Homebrew. The maintainers are not trustworthy.

[https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all- to...](https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to-google/)

<comment><USER22> TLDR: they turned on Google Analytics.

<comment><USER23> ...without consent or opt-in.

<comment><USER24> Because most other websites/services ask for consent for their analytics?

<comment><USER23> Important consideration: homebrew is neither a website nor a service. It is a local software, a package manager, and quietly enabling phone-home analytics in an update after previously not doing such has a different threshold for "informed consent".

<comment><USER18> How exactly is Homebrew not a service? We donate hours of work each week in an honest effort to make the best package manager we can for our users. Analytics help us decide how to prioritize our work.

It's also literally the opposite of quietly enabled [1] [2].

[1] [https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef...](https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef1d8c4b4408991873df/Library/Homebrew/cmd/update- report.rb#L53-L62)

[2] [https://docs.brew.sh/Analytics](https://docs.brew.sh/Analytics)

<comment><USER21> > How exactly is Homebrew not a service?

Is youtube-dl a service because it needs to be constantly updated, at great effort, to deal with new countermeasures and the like? Still looks like software to me.

If you were running the software for me (e.g. Gmail), then maybe Homebrew would qualify as a service.

> It's also literally the opposite of quietly enabled

I discovered it when my firewall showed me an outbound connection to Google analytics. Homebrew spews so much stuff to the console, it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure.

You guys could have prompted for consent. You didn't. You still refuse to. And you won't entertain any suggestions that you do so unless it comes from a contributor. As I said in my original comment, your collective lack of judgement and refusal to consider the opinions of users is why I don't find you guys to be trustworthy anymore. I encourage everyone to find alternatives.

<comment><USER18> > If you were running the software for me

I'm not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles.

> it's not something a regular user would read unless they looked for it. That > was hardly sufficient disclosure.

That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. Blaming Homebrew for the fact that you missed that message says more about you than about Homebrew.

<comment><USER21> > I'm not sure on whose systems you believe packages are built and tested, and > from whose systems you feel Homebrew downloads bottles.

Is Ubuntu a service because Canonical builds and tests packages and hosts package repositories? I don't think many people would make that claim.

> That notice was colored, it was typeset in bold, it was surrounded by > newlines, and it sounded an audible bell.

That's not the notice I got.

"Anonymous aggregate user behaviour analytics documentation: [https://git.io/brew-analytics"](https://git.io/brew-analytics"). No bold. No bell.

The notice you linked to was added in reaction to the outcry. The bold and bell were added at a later date.

The Homebrew maintainers continue to refuse to do the only ethical thing and PROMPT THE USER instead of making assumptions one way or another.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Terminology is still confusing (for no apparent reason), Homebrew is still extremely slow compared to Linux package managers.

Otherwise, I love it and it's basically the one reason development on macOS is not a major PITA. So thank you to everyone making that possible!

</comment><comment><USER26> I didn't know Windows support was on the roadmap. Homebrew has been a critical piece of my macOS toolkit for nearly a decade but I've been working cross- platform more lately so this could be great for me. But what about Chocolatey?

<comment><USER27> The Windows version only supports Linux apps, not native Windows apps. So it doesn't really replace Chocolatey.

</comment></comment><comment><USER28> Perfect timing, as I'm setting up a new box today. Homebrew is great. Also really appreciate the inclusion of reasoning behind changes in the release notes.

</comment><comment><USER29> So far the Homebrew experience has been better for me than any other Linux distribution's package manager, except for Arch, which is still unparalleled. The biggest problem of Homebrew is how incredibly slow it is, though I guess this will stay for a long time unless a fundamental overhaul takes place.

</comment><comment><USER30> It's a shame it still doesn't play well with more than one user on a system trying to install packages.

I have a work user and a personal user on my laptop. Brew won't let me use both at the same time without getting my hands dirty with creating groups, and even then it's not supported behaviour.

<comment><USER31> I ended up creating a homebrew user and giving my personal user sudo access to the homebrew user, which has seemed to work well so far (I may have had to give group read/execute access to all of /usr/local though)

<comment><USER18> Thanks for the tip, I didn't think of that! I need to use Homebrew from two different users, too. Definitely going to try this.

</comment></comment></comment><comment><USER32> Love this for WSL. Makes Microsoft Windows 10 even more cool!

<comment><USER33> May I ask why? Is apt not sufficient?

<comment><USER32> Think of it like a virtual env in python. You're installing within your own virtual env rather than system wide like apt.

</comment></comment></comment><comment><USER34> OSX app bundle is to OSX as ____ is to Linux.

Can the blank be filled in?

If so I'd love to use Homebrew to manage dependencies on both Linux and OSX. (msys2 has my Windows build covered.)

<comment><USER35> Flatpak?

</comment></comment><comment><USER36> Happy about support for Linux!

</comment><comment><USER37> I spent a year with Ubuntu MATE after over a decade of macOS use. The thing I missed the most was the hassle free installation of packages via brew. This made me very happy. I hope it will work as friction free as brew on macOS.

<comment><USER38> I don't know Ubuntu MATE specifically, and it's been a long time since I used Linux on the desktop, but I'm surprised that "apt install foo" has more friction than "brew install foo". Both work very nicely in my experience.

What is the hassle you saw with Ubuntu MATE?

<comment><USER37> Every app I use is available via brew.

A lot of software that I use weren't available via APT so I had to go hunting via snap, flatpak and pip. Suddenly I had four different package managers to maintain and update. Every time I updated Ubuntu it was a mess to update where what repositories to update to. I was never successful in keeping my software up to date without a lot of googling and problem solving and it sucked.

</comment></comment></comment><comment><USER39> Someone is about to post how the original author was not hired by Google...

<comment><USER40> Original source: [https://twitter.com/mxcl/status/608682016205344768](https://twitter.com/mxcl/status/608682016205344768)</comment></comment>


Five Reasons Why Windows Phone Will Make A Big Splash In 2012 - <AUTHOR> http://www.forbes.com/sites/erikkain/2012/01/08/five-reasons-why-microsofts-windows-phone-will-make-a-big-splash-in-the-smartphone-market/ <comment><USER2> "Windows Phone Has A Totally Unique UI" - I don't think this is a valid point. Unique does not automatically win anything. Better might be a winner, but the article does not say that.

"Originality Means Fewer Forays Into The Patent Wars" - Why? Just about everything is already patented ("An object oriented interface to the operating system" by Apple), so I don't think this is a valid claim.

"Uniformity Across All Devices and Carriers" - Apple has that too. Also, the non-uniformity is one of the selling points of android.

"Zune Is Baked Right Into the Operating System" - Remember Zune? No? It was the next iPod killer. By the way, the iPod is baked into iOS.

"Xbox Live Gaming Support" - IMHO this is the only valid point. Still it's not a unique point, with play station integration into Sony's androids...

<comment> captain-asshat "Windows Phone Has A Totally Unique UI" - I don't think this is a valid point. Unique does not automatically win anything. Better might be a winner, but the article does not say that.

It matters in that it's something that people can't complain about. If it had a non-unique UI, then it would be dismissed almost immediately.

"Originality Means Fewer Forays Into The Patent Wars" - Why? Just about everything is already patented ("An object oriented interface to the operating system" by Apple), so I don't think this is a valid claim.

They got this wrong; in actual fact the reason they don't need to worry about patents as much with WP7 is because they have the patents from windows mobile to attack pretty much anyone who tries to sue them.

"Uniformity Across All Devices and Carriers" - Apple has that too. Also, the non-uniformity is one of the selling points of android.

It's also one of the major annoyances of android, as we've seen updates go completely ignored by OEM's and carriers. From a developer point of view it's also a more challenging experience due to fragmentation.

"Zune Is Baked Right Into the Operating System" - Remember Zune? No? It was the next iPod killer. By the way, the iPod is baked into iOS.

Not every music service/player is born equal, and far too many people gloss over its excellence. Zune has the Zune pass, which is unique to it and allows it to have a far richer music discovery experience, which is unrivalled in the marketplace. Speaking of which, also has as much content as iTunes these days (same # of songs etc.)

"Xbox Live Gaming Support" - IMHO this is the only valid point. Still it's not a unique point, with play station integration into Sony's androids... This is actually one of the lesser interesting parts of WP7, as there aren't many multi-player games.

Someone else mentioned press releases - this article is far too error-prone to have come from Microsoft. It's more likely just someone with a passing interest who's been asked to write something on it.

</comment></comment><comment><USER3> Apparently Forbes is printing press releases now.

<comment><USER4> Yeah, I think something fishy is going on here I've seen quite a few articles in the last few days saying Microsoft has been getting rave reviews for its phones without seeing any of them.

<comment><USER5> I've actually seen a few favorable (albeit not "rave") reviews[1].

Current consensus seems to be that WinMo is a promising foundation that lacks apps, customizability and polish (the browser is slow).

[1] [http://www.theverge.com/2011/11/3/2534861/nokia- lumia-800-re...](http://www.theverge.com/2011/11/3/2534861/nokia- lumia-800-review)

</comment></comment></comment><comment><USER6> 4 Issues with windows phone:

1> It doesn't capture the "I WANT CONTROL" people or "I WANT SEXY ALUMINUM" people. These are significant, and vocal minorities on the two platforms. So all that is left is the not so particular middle.

2> It limits developers to Sandboxed C#. This means software written in C which is portable to pretty much every other device (Android included) isn't portable to here without a rewrite.

3> The simulators don't run in VM's on Macs. Why does this matter you ask? Because people putting out things for the other platforms OVERWHELMINGLY use Macs, due to the "Must have mac to make an iPhone app" requirement. So yes, you can dual boot to make this, but that costs an additional $150 for the OS as well. You might try to argue "why doesn't apple have to put out windows compatable SDKs", but you'd be ignoring the fact they're currently the dev environment which is the revenue leader, so aren't playing catchup, while MS _is_ playing catchup.

4> It doesn't have any penetration to the crossplatform tools. It doesn't work in Adobe Flash Builder, it doesn't work in Titanium, it doesn't work in PhoneGap, it doesn't really work then for the people who publish on multiple platforms.

I think it's a beautiful project. I just think the guys running the developer relations programmers spend too much time buying iOS developer groups beer and not enough time making the toolchain usable by iOS and Android devs without hardware outlays and hard disk reformats.

</comment><comment><USER7> This may be a good phone. I don't know. The problem is the network effect they relied on for years now beats them. The people who still don't have a smartPhone is large, but those late adopters will follow their friends to android and iOS devices. It simply lacks the mind share of apple and the bombardment if devices that android has.

Honestly. If you aren't number 1 or 2 in a market. Get out.

<comment><USER8> As a very happy xbox 360 owner, I'm glad Microsoft doesn't subscribe to this mindset.

</comment></comment><comment><USER9> How many non-geek users actually care about most of these points?

Users want gadgets that they can wrap their head around, they won't care about "Uniformity Across All Devices and Carriers" also carriers and device makers will certainly not appreciate this move.

Apps matter the most, but I think Microsoft will be stuck in catch 21 on this one, the fact that they want tighter control over the phone only makes things horribly worse: for apps, you need critical mass, for critical mass you need devices, but that will only happen if carriers and device makers embrace WP7, but they will probably ignore it, because they can't differentiate themselves because MS wants control.

So unless Microsoft makes something that is leagues better than the iPhone, they have zero chance to compete. Why the iPhone and not Android? Because both of MS and Apple want to have full control, which most device makers reject.

<comment><USER10> This is a common pitfall of marketing (and spec) for phones I think. Tech driven customers are the loudest on the internet but that doesn't have to mean they are your key demographic. Look at the iPhone.

Beautiful design + great apps + crappy camera + small screen = slightly increased OPEX + greatly increased margin = happy times

<comment><USER11> crappy camera? Have you used an iphone?

<comment><USER10> Should've mentioned I was referring too earlier models (not 4 and 4S). And maybe "crappy" was a bit too emotive. Just referring to Apple's wise choice of cost saving with 3mp when many used 5 and some overspeced to 8 or 13.

</comment></comment></comment></comment><comment><USER12> A splash like a rock into the ocean where it will sink to the bottom and stay out of sight forever.

Microsoft has no follow-through lately.

</comment><comment><USER13> "Windows Phone Has A Totally Unique UI"

Pedantry alert, but ugh. Uniqueness is binary: either something is unique or it isn't.

</comment><comment><USER14> Reason 4 Why Windows Phone Will Make A Big Splash In 2012: "Zune Is Baked Right Into the Operating System"

hahahaha

</comment><comment><USER15> I'm gonna buy a Nokia Lumia 800. Jesus, WP7 + 8Mp Carl Zeiss lens.</comment>


MortgageHippo Quizzes You, Shows You If You're Ready to Buy a Home - <AUTHOR> http://lifehacker.com/mortgage-hippo-quizzes-you-shows-you-if-youre-ready-to-1614137302

<comment><AUTHOR> Hey guys, a Lifehacker post was written about our company today that came from a Show HN thread that was on the front page last week. Super happy it emerged from the HN community. Thanks!</comment>


Ask HN: Are there any independent or adversarial journalists in India? - <AUTHOR> DemocracyNow and The Intercept are doing great for global issues, but are there similar news media outlets that cover India only? Blogs, news websites, print magazines, etc. are all okay. <comment><USER2> Why do you ask? Some people you should consider reaching out:

@Nixxin, founder and editor of Medianama. He is an activist, too, and played an instrumental role in getting Facebook's Free Basics shut down in India.

@PranavDixit writes for BuzzFeed News. He is sharp and focuses on internet culture. He has written about Facebook's fake news issue in India.

@refsrc writes for CNBC and The Outline. He wrote about fake news issue on YouTube in India and Facebook quietly shutting down Free Basics in a number of countries.

@rahulabhatia writes for The New Yorker and The Guardian. He recently wrote about the issues with Aadhaar, India's biometric system.

@neeleshmisra is the founder of GaonConnection, an outlet that covers the issue people in small towns and villages are facing.

@therealjpk writes for FactorDaily news outlet. He recently wrote about Chinese entrepreneurs making aggressive push in India.

</comment><comment><USER3> I think the Caravan[1] is perceived as being independent.

[1] [http://www.caravanmagazine.in/](http://www.caravanmagazine.in/)</comment>


Everything You Need to Know About Coronavirus Vaccines - <AUTHOR> https://www.wired.com/story/everything-you-need-to-know-about-coronavirus-vaccines/ <comment><USER2> 1\. A vaccine against COVID-19 is only possible if the virus doesn't mutate.

2\. COVID-19 is being treated with anti HIV medication. If its similar enough to HIV to be treated with the same medication. A vaccine against it could be impossible for the same reasons we have no current vaccine for HIV.</comment>


Save Net Neutrality in Europe - <AUTHOR> http://savenetneutrality.eu <comment><USER2> Except Britain.

<comment><USER3> They're still EU members for a while...

<comment><USER4> Yap. Once they invoke article 50 of the Lisbon treaty they're still a member of the EU for at least another year or two, bound by the same rules and legislation but without any say in it.

So no, not "except Britain".</comment></comment></comment>


Security flaws caused by compiler optimizations - <AUTHOR> https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations <comment><USER2> > However, the programmer failed to inform the compiler that the call to > ereport(ERROR,...) does not return. This implies that the division will > always execute.

I don't think that's correct. The compiler is allowed to assume that functions marked noreturn do not return, but it's not allowed to assume that functions _not_ marked noreturn _do_ return. In other words, it's not undefined behavior for a function to call abort(), enter an infinite loop, etc. instead of returning. It would be very strange if it were!

There's a somewhat related spec clause that lets the compiler assume that certain types of loops will eventually terminate [1], but that doesn't apply here. Therefore I think the mentioned compiler optimization is illegal. The issue was reported back in 2011; it would be interesting to see whether newer versions of GCC, or Clang, behave the same way.

[1] [https://stackoverflow.com/questions/16436237/is- while1-undef...](https://stackoverflow.com/questions/16436237/is- while1-undefined-behavior-in-c)

<comment><USER3> An infinite loop with no side effects is undefined behavior.

<comment><USER2> I didn't say no side effects. But even an infinite loop with no side effects is well-defined if the controlling expression is a constant expression; see the link in my previous post.

</comment></comment></comment><comment><USER4> I remember when CVE-2009-1897 was current, because it is an obvious example where no one would expect the null check to work:

        struct sock *sk = tun->sk;
        unsigned int mask = 0;
        if (!tun)

Obviously "sk" is not used until after the null check, but if we read it line by line as we would expect a naive compiler with no optimization to act, the pointer is followed before the null check, and null should produce a crashing program. It would seem that anyone expecting it to work would _assume the evaluation of the initial assignment of sk to be lazy at first use_ , which is a very strange assumption.

Still, I remember in 2009 people writing about that snippet as if it is a surprising result and the compiler did something wrong.

<comment><USER5> When NULL corresponds to a valid address, you don't want the check stripped out of this sort of code.

<comment><USER6> Out of curiosity, what are the expected contents of the zero page area? Is access allowed to it just because it's coming from the kernel instead of a userland process?

<comment><USER7> On my ARM Cortex processor it's __StackTop

On a read it's a completely valid address. Write generates a bus fault.

Atmel ATMega parts it's the reset vector. A write does nothing.

<comment><USER7> Braino. ATMega parts address 0 is the R0 register.

</comment></comment></comment></comment></comment><comment><USER8> My take, after 12 years of industry C++ experience, working on code that needs to be fast: Too much emphasis is placed on gaining another 0.5% performance improvement, instead of slightly slower code that does what was intended. At least offer some safe defaults and make the bleeding edge optional.

While we are debugging things like this, people are writing servers in JavaScript and web services in Python :O No need to optimize so heavily, they will waste it anyway :)

<comment><USER9> That 0.5% improvement can help a lot when it's inside the Javascript engine or the Python interpreter.

<comment><USER7> It's usually a 0.5% improvement on a micro benchmark.

One of my suspicions is that at the low end where I operate the marginal cost of higher speed is essentially zero. My firmware spends more than 9.99% of the time sleeping. Micro optimizations of a few percent is meaningless. At the other end superscalar processors are a moving target for micro optimizations. And further a lot of tasks look like init -> process data -> clean up. Over time the process data part has gotten very large. Making the init and clean up parts of the code a smaller and smaller percentage of the execution time. Micro optimizations in those parts of the code provide no value. Next is the constant movement to push the data processing into either specialized CPU instructions or GPU's.

<comment><USER9> A single optimization pass might only improve a microbenchmark a bit, but all passes taken together significantly speed up most programs. In the embedded software that I have experience with we eventually had to turn on optimizations because otherwise we would have had to switch to a new hardware platform to run continuously more demanding workloads.

</comment></comment></comment></comment><comment><USER10> The leaking of sensitive data due to DCE'd memset is an interesting one. Generally, compilers are free to temporarily move data around to a lot of places, such as on the stack for register spilling. Is there any programming language at all which allows sensitive data to be annotated in such a way that the compiler will promise not to leak it to memory indefinitely in some sense? (E.g. all places that the data may be written to are cleaned up before reaching some sort of security boundary)

<comment><USER11> >Is there any programming language at all which allows sensitive data to be annotated in such a way that the compiler will promise not to leak it to memory indefinitely in some sense?

Somewhat related: there's a recent paper that develops a language with syntax for marking data as secret; the compiler then goes even further and avoids timing side-channel leaks:

Cauligi, Sunjay, et al. "FaCT: A flexible, constant-time programming language." 2017 IEEE Cybersecurity Development (SecDev). IEEE, 2017. [http://www.sysnet.ucsd.edu/~bjohanne/assets/papers/2017secde...](http://www.sysnet.ucsd.edu/~bjohanne/assets/papers/2017secdev.pdf)

</comment></comment><comment><USER12> A better title would be security flaws caused by relying on undefined behavior.

<comment><USER13> Given that practically anything under the sun is undefined behavior for C and C++, that isn't saying much.

<comment><USER14> What gives you this imimpression?

<comment><USER15> The C standard includes an appendix that lists ~200 examples of undefined behavior. This list does not claim to be exhaustive.

Often, what constitutes undefined behavior is non-obvious (and not well justified). For example, when adding two signed integers results in an overflow, it is undefined behavior _even if your program never uses the result_.

Due to C's definition of "undefined" behavior, it means that all of the guarantees we rely on to ensure security go out the window whenever the programmer steps on one of these land mines.

<comment><USER16> Not all UB falls into this category. A lot of UB, such as your signed integer addition example, is dependent upon the behavior of the underlying hardware. Certain archs may throw an exception on signed integer overflow, or exhibit otherwise inconsistent behavior, for example. The standard is the standard, of course, but not all implementations inherit the UB of the standard.

<comment><USER7> > A lot of UB, such as your signed integer addition example, is dependent upon > the behavior of the underlying hardware.

That problem is you can no longer depend on that because the compiler writers have decided they can do anything during AST optimization when there is undefined behavior.

<comment><USER12> That's because...they can. Because the behavior of the statement is undefined.

<comment><USER17> "Those who can make you believe absurdities, can make you commit atrocities." -Voltaire

Who knew he was talking about C compilers??

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Basically, every kernel needs an explicit_bzero() system call because it's very difficult to assure data flow properties of de/initialization without something the compiler cannot optimize away.

<comment><USER19> memset_s() was added to C11 for this.

<comment><USER20> memset_s was added to C11 in an optional annex, and my understanding is that there are zero platforms that actually implement it. (Microsoft implemented an early draft of Annex K that doesn't actually include memset_s.)

<comment><USER21> Most libc's added an insecure version of memset_s, doing only the above discussed compiler-barrier, but not a memory-barrier, which is needed for Spectre, broken HW. The default memset should do the compiler-barrier. But unfortunately you cannot talk with libc maintainers about security. Too much arrogance. Thanks to this Redhat article for supporting the user-base on this.

You can use my safeclib, which implements the Annex K extensions.</comment></comment></comment></comment>


Only Edward Snowden Can Save James Bond - <AUTHOR> https://theintercept.com/2015/11/09/only-edward-snowden-can-save-james-bond/ <comment><USER2> > Knowing everything about everyone is actually of limited use to the good > guys. But it's hugely useful to the bad guys — be they extortionists, > terrorists, or power-mad bureaucrats. And if it's collected, somewhere, be > assured the bad guys can get their hands on it.

I love that argument. We should use that more. The "a backdoor for the good guys is a backdoor for the bad guys" argument seems to have (mostly) worked in the US at least, and this is just an extension of that but for the broader mass surveillance argument.

And another great one:

> What if mass surveillance by an ostensibly beneficent national government > really means that whatever the government collects is de facto transparent > to SPECTRE, SMERSH, Kaos, the mob, the cartels, Carlos the Jackal, ISIS, and > Vladimir Putin?

It reminds me of this post that was on HN earlier this year, too, about how the Nazi used the Dutch registry to find where the Jews were and exterminate them:

> Once the civil registry was in the hands of the enemy the extermination > program for Amsterdam based Jews (those that had not fled) moved into high > gear and street after street was raided. Entire neighbourhoods stood empty. > The importance of the registry was not lost on the resistance who planned > and executed a brave attack (Dutch) to destroy as much of the registry as > they could by firebombing it after subduing the guards.

[http://jacquesmattheij.com/if-you-have-nothing-to- hide](http://jacquesmattheij.com/if-you-have-nothing-to-hide)

In other words, this isn't just a theory that the bad guys have more use for this centralized "everything about everyone" information, but it has _actually happened_. Of course all of the data breaches we see these days serve to show that point as well.

Maybe we need to ramp up our own campaign that tries to demolish the "mass surveillance keeps you safe" message with the "mass surveillance puts you in danger" message.

<comment><AUTHOR> That's the scary bit, and it seems nobody actually groks that. Asks people, they are happy for their supermarket to track them, the utility companies to track them and as for the state, the argument 'but, I have nothing to hide' is typical...

And they don't realize that it's when that data will go astray that Bad Things happends... and data WILL escape, either by bad guys getting their hands on them, or these companies selling it on.</comment></comment>


HackerNews Front-Page Funnel Analysis - <AUTHOR> http://blog.effectcheck.com/2011/04/11/hackernews-front-page-funnel-analysis/

<comment><USER2> When the "Dry erase HOPA" slideshow was revealed as a myth, the subsequent interviews with the Resig brothers revealed how they always got two waves of traffic from such hoaxes. The first is the hoax traffic, the second wave is the wave of traffic about the hoax story.

I'm interested to see the increasing frequency of the "HN stats followup article" describing the numbers from the traffic to the first article.

Despite the frequency this may still be an under-utilised property of HN. Why not follow the recursion down the rabbit hole - and tell us how many signups come from the followup article too? Perhaps bonus points for publishing a chart of signups v. derivative index of article? I jest but honestly only slightly.

<comment><AUTHOR> > Why not follow the recursion down the rabbit hole

The thought did cross my mind. ;)

Seriously though, we plan on focusing the blog on analyzing press releases, political speeches, and other text currently making headlines. We just were so excited by the HN response that we thought this would make a great "Hello World" post. I also think it's the only funnel analysis follow-up for a HN submission; most usually focus just on page views and unique visitors.

</comment></comment><comment><USER3> > In descending order, the top browsers used by readers were:

        Chrome (52.97%)
        Firefox or Mozilla Compatible Agent (25.18%)
        Safari (23.71%)
        Internet Explorer (3.89%)
        Opera (2.79%)

Wow, that's pretty crazy - I didn't know Chrome had such a high market share. Is this an accurate reflection of the browser market share on HN in general?

<comment><AUTHOR> I just realized looking at these numbers that I used the # pageviews per browser / total UVs to calculate those percentages. So if you're wondering why they add up to > 100%, that's why. Just understand that the actual numbers are roughly proportional to those I provided in the article.

</comment></comment><comment><USER4> This is fascinating to me, thanks for the data, and congrats!

One interesting comparison I have is the day I got my first web company's first slashdot post, roughly 2000, maybe late 1999. I don't still have the logs, but we had significantly more clickthroughs, on the order of 50 to 100k if I recall correctly.

Given the HN 'pageview per day' numbers I've been reading, I find the clickthrough rate surprisingly low; especially because the way I read HN is to click through to almost everything on the homepage.

Other thoughts on this? It seems like a techcrunch or (even? slashdot) article would be worth more, which surprises me. Well, techcrunch doesn't surprise me. I guess I'm wondering what size / demographic community we're all in here.

<comment><USER5> A lot of people come to HN for the commentary, not so much for the post. What I've noticed is that I will usually read only the comments and only click through to the page if it seems exceptionally interesting.

That is to say, the opinion of the HN crowd on a topic, matters more (and/or is more useful) than the topic itself.

<comment><USER4> Yes, I agree with this use case for HN completely, and it ties to my experience.

Compared with say slashdot in 2000, interactivity is easier and generally more interesting here. At the time, there were very few social aggregators, so the use cases were different.

</comment></comment></comment><comment><USER6> Nice analysis... sidenote: If you're measuring the emotional influence of content on people, shouldn't it be "affectcheck"?

</comment><comment><USER7> Nice write-up!

+1 for Monty Python reference. :)

</comment><comment><USER8> Good write-up.

 _The unaccounted percentage can be chalked up to simply "other."_

What does minus 8.54% other web browsers mean?

<comment><AUTHOR> Sorry about that, as I noted in another comment, I used page views in the numerator and unique visitors in the denominator. I've updated the article with the appropriate percentages.</comment></comment>


Under $500, unlocked 3G and custom chip - iPad will be a smash hit - <AUTHOR> http://blog.jedwhite.com/2010/01/apples-ipad-tablet-is-something-special.html

<comment><USER2> The information on the contract options seems a bit unclear - do you have to sign up for a contract to get 3G?

</comment><comment><AUTHOR> I meant to add too that the price point of under $500 is really key. It keeps it competitive with netbooks.

<comment><USER3> but at just 499$ you get no 3g and not sim slot. check, <http://www.apple.com/ipad/specs/>.

<comment><AUTHOR> Yep, the 3G support is only higher up the price chain. I really thought they'd have high speed wireless broadband option on contract with the upfront under $500. That would have been pretty appealing.</comment></comment></comment>


Ask HN: Is there a browser extension for opening all links on HN in new tabs? - <AUTHOR> By this I mean: add an option to the context menu of the browser that says "open all links on this HN page".
And as a result of that, 25 tabs get opened, that being all the links on the page.
That's my use case: I want to open up all the links, at the same time, each in their own tab, and I can just CTRL+TAB through them as I please.
I'm just asking here on the off-chance that it exists but I somehow could not find it. If it doesn't exist yet, I may well have to write it myself, which I frankly hope doesn't take too much effort. Let's hope there's some decent boilerplate for this, that can be easily found.
Thanks in advance for any help. <comment><USER2> I hacked together a quick bookmarklet, here's how to get it working in firefox:

1\. Create a new bookmark to any page, name it whatever.

2\. Right click the bookmark -> Properties

3\. Replace the "Location" field with:

      javascript:stories=document.getElementsByClassName("storylink");for(idx=0;idx<stories.length;idx++){ window.open(stories[idx].href)}

While on HN if you click the bookmarklet, it will open all of the links in a new tab.

<comment><USER3> That's great! Thanks for sharing.

</comment></comment><comment><USER4> I once wrote a greasemonkey script to do exactly that. The tricky bit was the rate limit of HN requests required adding an empirically determined delay inside the loop iterating through the links (there are thirty on the main page not 25).

Even with the delay one or two of the thirty requests would usually hit the rate limit, but this was faster than slowing the loop down with a larger delay in terms of how I used the script. It was kludge coded but good enough for my needs.

Note that "all the links" is not all the links. There are flag and vote and user account and site history and two discussion links for the typical front page story. Plus the header and footer links and the login or logged in links.

</comment><comment><USER3> I took @neckardt's bookmarklet and wrote a slightly shorter/different version:

      javascript:document.querySelectorAll('.storylink').forEach(s=>open(s.href)) //Open All HN

To install, select all the text (including the "//Open All HN" comment) and drag it to your bookmarks toolbar. The comment becomes the bookmark name in Chrome and it kinda works in Safari, but not in Firefox.

Is anyone worried about opening 30 random-ish links? I wouldn't do it...

</comment><comment><USER5> [https://github.com/clarete/hackernews.el](https://github.com/clarete/hackernews.el) This should do what you are asking

</comment><comment><USER6> There are also some alternative HN web clients and I believe some have Previous/Next thread buttons, but I can't remember now.

</comment><comment><USER7> Not an extension, but this is a common thing that could be done with a bookmarklet - open all links on the current page in a new tab.

Perhaps this is a good starting point:

[https://gist.github.com/toastal/01c2387456ad2e6385f4](https://gist.github.com/toastal/01c2387456ad2e6385f4)

</comment><comment><USER8> It would be easier to write greasemonkey script. I use it to read manga, just loop through title links and open with _blank target with time delay of 1s as setTimeOut delay

</comment><comment><USER9> ISTR there was a gesture to do this in Galeon, but tabbed browsing has gone downhill since then.

</comment><comment><AUTHOR> Sweet, thanks for the replies. I hadn't considered simply using a bookmarklet, even.</comment>