"Journey to Justinia" – how I got my 5-year-old son to sit still for 5 hours - <AUTHOR> http://justy.me/justy/2013/8/18/journey-to-justinnia-or-how-i-got-my-5-yo-son-to-sit-still-and-concentrate-for-almost-5-hours <comment><USER2> Oh gosh, I used to do stuff like this as a kid. I only needed a piece of paper and pencil though, no other tools. I would draw an adventure puzzle like this, but the big thing was it used BOTH sides of the paper. When you went through a door, you went to the other side of the paper (you'd have to bend the paper around your finger a little bit to estimate where the door led to).

Also, there were many locks and keys and items (think Zelda). A door might have a strange symbol on it, and you needed to find the key with the corresponding symbol to advance. Or you needed to get the lava suit to get past the pit of lava.

This is what I did during class in elementary school, and challenged my friends and brother to beat them. Now that I'm 26, I still do the same thing, but with computers and in 3D.

<comment><USER3> Totally did this too, though without the innovation of using two sides of the paper. I'd draw mazes with monsters and stuff on grid paper, and use a piece of paper with hole cut in it to implement the player's vision (can only see 5 squares around etc.) Good times...

<comment><USER4> Thanks for the inspiration. My son will love the "player's vision" concept.

</comment></comment></comment><comment><USER5> This is a subtle example of the advantages of the Internet. When people made things like this in 1980, you'd never even hear about it.

<comment><USER6> Many people would argue that the flip side of this is that less people would make things like this now that the internet offers so much more, easier time- consuming.

<comment><USER5> I'm one of them. It is definitely a double-edged sword.

<comment><USER7> Worth a PG essay, for sure.

</comment></comment></comment></comment><comment><USER8> These days not being able to sit still is considered a medical problem, when the truth is that it's just boys being boys. In fact, probably those who are bored more easily are engaged at the difficult to solve problems and games. When I was a kid, I was told my attention span was short and that I had ADD, but in truth it was that I was bored. Given a difficult programming problem, for example, such as learning Win32 for example, I could spend hours working on it because it became a puzzle. Kids that think creatively are probably easily bored by conventional attention getters. They like solving problems.

<comment><USER9> Actually, girls can have ADHD too (I should know--I am one, and I've been diagnosed.) Also, as someone who's been diagnosed with ADHD, saying "boys being boys" is not only untrue, but also dismissive of what IS actually a medical problem for some of us.

I wrote a blog post about ADHD called "Why I Feel Like A Failure, Even Though On the Outside, I'm A Success..." I think it might resonate with many here: ([http://www.erica.biz/2012/failure- success/](http://www.erica.biz/2012/failure-success/))

I would ask that you please not be dismissive or stereotypical of what is a real medical issue that some of us have had to deal with our entire lives.

<comment><USER10> The point about boys isn't that girls cannot have ADHD, but that boys specifically are over-diagnosed (and medicated with powerful substances) for behavior which is merely typical of their age or gender or both. Children are supposed to explore and get excited. They are not supposed to be putting in 60 hour weeks in the coal mines just yet. They're kids. Their brains are immature. Growing up makes them more suitable for the coal mines, you don't need to medicate them into an artificially premature maturity. That's the argument, anyway.

And here's a different, more controversial point. We used to have psychiatric disorders called hysteria and homosexuality. Now those have been reclassified out of existence. No one knows which of the current disorders will meet with the same fate. It's not impossible that while the help you get from your treatment is real (and the problems you face are real), ADHD is a poorly defined disorder.

<comment><USER11> >And here's a different, more controversial point. We used to have psychiatric disorders called hysteria and homosexuality. Now those have been reclassified out of existence.

I don't think that homosexuality is a good example to illustrate your point that ADHD might not be a "real" disorder. There's no question that there are people who are homosexual, but we no longer refer to homosexuality as a disorder because we no longer believe that it requires treatment. If ADHD were to parallel homosexuality in this regard, then there would be people who actually have ADHD, but we would stop viewing this as an abnormal variation in behavior.

Your example of hysteria is a better one to illustrate your point though. We no longer believe that hysteria is a disorder because we no longer recognize it as an actual state of being.

<comment><USER12> _" If ADHD were to parallel homosexuality in this regard, then there would be people who actually have ADHD, but we would stop viewing this as an abnormal variation in behavior."_

Some people believe this will one day be the case. _(Personally, I don 't have strong opinions on the matter one way or the other. It's not something I've researched.)_

</comment></comment></comment></comment></comment><comment><USER13> Whoa, this is hell cool! It make me miss the fun I had with my uncle...

My uncle loved to spend LOTS of time drawing stuff like this and making games similar to this one (although less RPGey and more puzzley)

Sometimes he did it with whatever paint software was available on the machine.

I never understood why instead of becoming a artist (he draw really well) or a game designer (he loved to design games) he went to become a prosecutor...

Also, another fun variation my uncle taught me: make your maps with matches, and use paper balls as characters (or coins, or beans, whatever), with matches you can simulate doors, opening and closing them, and have a more freeform roleplay thing, like simulate for example a space ship, and then a accident, as a asteroid hit the ship, and you then throw a heavy coin in your matches and see as they make a hole on the thing, and then the players try to survive in the ship full of holes, broken walls and stuck doors.

By the way, my uncle is still alive, is that we don't have time anymore :/ (also living 600km apart does not help either)

<comment><USER14> Why not build him a blog for his inventions?

<comment><USER13> I am certain he would never write on it. He don't read blogs, and don't care for them, and much less would write one.

<comment><USER14> Ok, so at least photograph his inventions and share them with us :)

</comment></comment></comment></comment><comment><USER15> As a dad Of 5 years old boy all I can say is thank you. He loves playing lego with me, and video games too.

A friend of mine with two boys close to mine did this for his kids: He would go one day earlier to some close hike trail or peak, and would put some coins in the ground, different places, etc. The next day he would go with the boys with a pirate map looking for the treasure.

Boys (and could be girls too) love these things. My son for example can get completely concentrated when comes to fishing (even if it's with some made up rod, and fake stuff in there). Last time we went to lake Casitas (California). He was hooked (unlike for him) for an hour doing his fishing.

<comment><USER16> I have a 5-year old too, and he loves LEGO and Video Games too. What video games do you two like? He LOVES the LEGO Batman game, but my wife is concerned about the LEGO guns.

The other day we played Minecraft on the iPad together and he built a house, two beds, and put two signs over the beds. One for himself (he typed his name all by himself) and one for me (he needed help to find the "p" in "Papa.")

<comment><USER17> My wife and I (no kids) enjoy the LEGO Harry Potter games - wands instead of guns, and as far as I remember, when you fight enemy humans, you don't "kill" them, they just teleport away.

Most of the LEGO series of games are similar - LOTR has swords and bows & arrows; Pirates has swords and muskets (and in sword fights, IIRC, enemies fall down and break apart when they "die"); and Star Wars games have blasters and light sabers.

</comment></comment></comment><comment><USER18> Just to add, you can do this in an even simpler form and cater it toward your child's age. For example, instead of drawing a detailed maze like that, you can build a dungeon with blocks. It doesn't have to be big. Put some toys inside it to represent monsters, treasure, traps, etc. If your kids are 2-4, you can even skip the dice too. Put a puzzle of some sort before the final boss, like you have to play a series of tones on a toy flute to unlock the door, or pick a colored key, or say a magic word ("please"), etc. For child- friendly play, the monsters can be scary at first and then become your friend. Everyone can live happily ever after at the end (spiders and monsters too).

</comment><comment><USER19> Another way to do "fog of war" is to imitate Warhammer Quest / Hero Quest where floor tiles are placed on the table. Might be a bit much for a 5 y/o given the articles points about the greatness of magnets.

<comment><USER20> I've recently been using white sticky notes, which are quite easy to remove and cover a 3x3 square grid almost exactly, to great effect in a pen and paper RPG I run.

</comment></comment><comment><USER21> I love the creativity in this, it's just wonderful. Any chance of slightly more detail about the rules? Are chests populated with treasure when you design the map or is it generated randomly during an encounter? Is there a 'goal' or is it a just explore-neverending story type game?

</comment><comment><USER22> As a child, I would draw similar maps with monsters and artifacts using MacDraw Pro. I'd draw black layers to simulate fog of war and delete as play progressed. My friend and I would take turns creating maps.

It was loads of fun. If something like this gets kickstarted as others have suggested, I'd recommend a kid-friendly way to build maps. Creation can be more fun than playing and also gives kids a different set of problems to explore.

</comment><comment><USER23> This is really cool! My 5yo loves to draw games on paper. I let him play on the iPad almost as much as he wants, but often he prefers to draw the games, expand on them, and create his own. We make mazes for each other, and he creates levels for me to figure out.

I go down to our local newspaper, and buy newspaper end rolls for $1 each. These are the rolls of paper left over after printing. They are about two feet wide and probably 100 feet long.

Just today, I found a game for the iPad that lets him create his own platformers. He's excited to try it out tomorrow. It's called "My Doodle Game" [https://itunes.apple.com/us/app/my-doodle- game!/id572842495?...](https://itunes.apple.com/us/app/my-doodle- game!/id572842495?mt=8)

PixelPress also looks promising: [http://pixelpressgame.com/](http://pixelpressgame.com/)

If anyone knows of other easy game dev tools for kids, I'd love to hear about them. I think it's good to keep the momentum going when he's having fun with something.

</comment><comment><USER24> This is great! A few years ago, I did something similar for my son and 3 of the neighbor kids. It was a very minimalized D&D type of game where they each picked from a stack of predefined player charts, then played a simple but thrilling campaign to rescue the kidnapped king. There were a few routes they could take, each with different hints and warnings from villagers along the way. In the end, 4 boys from ages 4-7 sat at the table, engrossed and attentive, for over 3 hours. They've since made their own maps and stories, though I think the making has been more fun for them than actually playing.

I love this approach, though, as it is almost something a kid could play by themselves or more easily create for one another and play together. It could even be played in the car on trips, reducing whining about playing with the ipad. (I didn't have ipads when I was your age!!)

</comment><comment><USER25> This game reminds me of another drawing game: "How To Host A Dungeon". More info and instructions are here:

[http://planet-thirteen.com/Dungeon.aspx](http://planet- thirteen.com/Dungeon.aspx)

"How to Host a Dungeon is a solo fantasy pen-and-paper dungeon-building game. The game follows the progress of an imaginary dungeon from the dawn of time through to an arch villain attempting to conquer the world.

The creation of the dungeon is driven by random tables and procedures as monsters, adventurers, civilizations, and arch villains interact in an underground environment. The player records these interactions, maintains the dungeon map, and makes some choices in how they play out.

The end product of the game is a complete unique dungeon map and history which stands as an interesting artifact on its own or can be used as the basis of a dungeon crawl role-playing game campaign."

</comment><comment><USER26> This looks super-cool. I kinda wish I was a dad to have a chance to play with my son (he's going to be born in October, so there's hope, and I should start preparing).

However, I must be totally stupid, but I don't get the rules, even after reading them twice, and looking through all comments on the post and on HN. I get the movements turn-by-turn. But how do you decide the outcome of encountering a ghost/spider/arrow with the dice? how do potions work? what's in the treasure chests? which other items can be collected? (in short, what am I missing?)

<comment><USER27> It may be that the little numbers represent how you have to roll. For instance, the {5/12} might mean you have to score a 5 on a roll of 2 6-sided dice (or one 12-sided die).

At the bottom of the whole map, he has a big list of these {N/M} scores along with characters.

<comment><USER26> yeah, you're right. Thanks. So I'm guessing higher than 5 wins, less loses? But what about the potions and other stuff you find throughout the game? I'm guessing something like this can give you, say a +1 dice points for 5 moves or something like that?

</comment></comment></comment><comment><USER28> This looks like so much fun. How much time does creating the maps take?

<comment><USER29> It was heaps of fun! We both got really absorbed in it. I'd made the map the day before, off and on during the day and evening. Maybe 4-5 hours work.

<comment><USER30> See my comment on your post - but this would make for a great game-kit.

If you could come up with a flexible system for the fog-of-war and organize parts of the map to work with the areas they'd cover, then let parents/kids share/collaborate online or offline to make their own adventurers.

If this were a Kickstarter project I'd back it in a heart beat

</comment></comment></comment><comment><USER29> If you want to DL the map and support the development of new ones, search Etsy for 'Justinia' :)

</comment><comment><USER31> That guy is a great father.

</comment><comment><USER32> Oh man, I did something like this years ago, but for teenagers. It's super fun to make them. Just think maze + dice and you can come up with some cool stuff.

</comment><comment><USER33> Me and my twin brother did stuff like this when we were kids! We thought of it as playing "video games" on paper.

</comment><comment><USER34> Super fun. I love little projects like this. I am sure the kid loves it, and they are making memories.

</comment><comment><USER35> All the research on the subject shows incontrovertibly that 5 is way too young for video games.

<comment><USER36> > All the research on the subject shows incontrovertibly that 5 is way too > young for video games.

First, "all the research" means "all the psychological research". Recent scandals demonstrate that psychological research has the approximate value of astrological forecasts:

[http://news.sciencemag.org/people-events/2012/11/final- repor...](http://news.sciencemag.org/people-events/2012/11/final-report- stapel-affair-points-bigger-problems-social-psychology)

Quote: "In their exhaustive final report about the fraud affair that rocked social psychology last year, three investigative panels today collectively find fault with the field itself. They paint an image of a "sloppy" research culture in which some scientists don't understand the essentials of statistics, journal-selected article reviewers encourage researchers to leave unwelcome data out of their papers, and even the most prestigious journals print results that are obviously too good to be true."

Second, one would want to compare video games with whatever a 5-year-old would be doing instead. Looked at that way, obviously a well-designed age- appropriate video game might represent an improvement over its alternatives in some cases.

Finally, let's let the parents decide -- you know, the people who ignored all conventional wisdom and decided to have the child in the first place?

<comment><USER37> Speaking of sloppy work, you link to an article on social psychology yet extrapolate the findings to the whole of psychology. You then throw the baby out with the bathwater by claiming the entire thing is useless when it's not.

The nature of psychology lends itself to more fuzzy or fraudulent work, but by saying that psychological research is itself useless, you're also throwing away things like A/B testing, UX testing (including Apple's much-vaunted usability stuff), research into grief management, team-building research, research into cognitive recovery therapy after acquired brain injury, work looking into ameliorating sexism and racism, perception research for HUDs in fighter aircraft (my honours research), some pain management research, research into dealing with PTSD, research into crowd control and management...

... all this (and more) is apparently useless, simply because you've got a chip on your shoulder. Fuck I'm tired of people just taking pot-shots at a soft target that they don't understand and never bother to.

</comment></comment></comment><comment><USER38> This looks incredibly fun to play! Great :)

</comment><comment><USER39> Best Dad ever!</comment>


Handling Leap Seconds the OpenBSD Way - <AUTHOR> http://undeadly.org/cgi?action=article&sid=20150628132834 <comment><USER2> It's not always the right approach, but it's a good reminder to consider "do nothing" as the proper response to a weird edge case that is presented as a [potential] problem.

</comment><comment><USER3> [http://cr.yp.to/proto/utctai.html](http://cr.yp.to/proto/utctai.html)

[http://cr.yp.to/proto/taiclock.txt](http://cr.yp.to/proto/taiclock.txt)

I am just a dumb user. I use clockspeed (sntpclock, clockadd and clockview) with a short list of compatible servers I consider "reliable". As far as I can tell, it works.

[http://cr.yp.to/time.html](http://cr.yp.to/time.html)

<comment><USER4> Time needs vary widely for people. Some people need nanosecond precision. Probably most end-users wouldn't notice for quite a while if their system clock is off by literally years... I know I've done it before without noticing. However, the existence of the latter doesn't somehow invalidate the former... some people really do care quite deeply. If you are in the latter, it hardly much matters what you do. "Manually setting it off of my cell phone" or "ignoring it entirely" are mostly valid options.

<comment><USER5> You aint running ntp if you need nanosecond precision and accuracy.

<comment><USER4> Didn't say they did, just pointing out there's a huge range of needs.

</comment></comment></comment></comment><comment><USER6> I'm not very familiar with ntpd, but this article doesn't cover what would happen if the half hour polling just happens to poll right during the leap second. If the code receives "59 minutes and 60 seconds" but doesn't expect that to be possible, I could imagine that being a problem.

<comment><USER2> I don't think it would see this. It would see "59 minutes and 59 seconds" and either see a one-second discrepancy with the local system clock on that poll, or on the next one.

<comment><USER7> UTC inserts the leap second by extending the last minute before midnight by one second and does indeed specify that this ought to be shown as, for example, "59 minutes, 60 seconds, 123 milliseconds."

NTP doesn't seem to use the human-readable format for its timestamps though. My 30 second skim says it uses a variation on epoch time that extends from Jan 1 1900 rather than Jan 1 1970. UNIX epoch time inserts the leap second by waiting until 1 second after midnight and then jumping the counter back 1 second (which corresponds to a long 0th second rather than a long 59th second, but whatever, in spirit you are right) [1].

I see two potential sources for error: a 1s correction/drift proving to be "too much" for synchronization in a system that typically sees corrections or drifts far smaller, or 2. a well-meaning fool writes assert(s<=59) in some code that touches a correctly-handled UTC stamp during the leap-second :-)

[1] [https://en.wikipedia.org/wiki/Unix_time](https://en.wikipedia.org/wiki/Unix_time)

<comment><USER2> I read yesterday that the leap second was handled by repeating the last second of the day. So you would see 59 seconds for two seconds but never 60 seconds. I guess different systems and time standards may handle it differently.

<comment><USER7> I'm sure that's how some systems implement it and it's close enough to the truth that I'm sure it will frequently be reported that way in the news. But I'm also quite sure that the actual standards are as I said they were. See the wiki link for a detailed timeline.

</comment></comment></comment></comment></comment><comment><USER8> So basically... not handling it :)

<comment><USER9> Sometimes the only winning move is not to play

</comment></comment><comment><USER10> For anyone curious about this:

       Finally, if you are one of the exceedingly
       few people for whom the clock being off by
       a second actually matters, then I'm pretty
       sure you also know how to deal with it.

One alternative to NTP is PTP.[1] Quoting:

       IEEE 1588 is designed to fill a niche not well
       served by either of the two dominant protocols,
       NTP and GPS. IEEE 1588 is designed for local
       systems requiring accuracies beyond those
       attainable using NTP.

[1] [https://en.wikipedia.org/wiki/Precision_Time_Protocol](https://en.wikipedia.org/wiki/Precision_Time_Protocol)

</comment><comment><USER11> Ah, the arrogant and absolutely amazing way OpenBSD people write :)

<comment><USER12> Waaay more fun to read than the with-baited-breath-and-optimism we usually get from the web-dev/devops world.

<comment><USER13> Apologies for the off-topic pedantry, but _bated_ breath is probably the idiom you are looking for!

<comment><USER12> Oh, thank you!

I've apparently been doing that wrong for years. Thanks!

</comment></comment></comment></comment><comment><USER14> Out of curiosity...

What it the NTP server is running openBSD? =P

(not sure if this question makes sense... Anyway, it seems some OS has to worry about leap seconds...)

<comment><USER15> Normally you would run OpenNTPd on an OpenBSD system. It's developer and maintained by OpenBSD developers.

It's not as precise the ISC ntpd, but normally "good enough".

</comment></comment><comment><USER16> It's not a bug, it's a feature we chose not to implement.

Weird that a security-centric OS would be cavalier with time when some cryptosystems are time-sensitive.

<comment><USER15> There is a point to be made that implementing it correctly, would involve extra code, for what is essentially an edge case. That extra code could prove to be a larger security concern that being 1 second of once in a while.

Your clock is almost certain to be a little of every now and again anyway. If it wasn't there would be no point in running ntp.

</comment></comment><comment><USER17> Dont they have software with time deltas? Are all time deltas signed? Are negative deltas handled?

<comment><USER18> Yes, if they're running NTP anyway. Normal clock drift/skew correction would already cause this sort of thing.

<comment><USER7> Sure, but I bet you could find a good number of production systems that have never before had to handle a delta as large as 1s.

<comment><USER19> I'm pretty sure OpenBSD core doesn't have any of those, and that's really what the project is caring about. Problems may happen in ports, but there's a reason why they're ports.

Also, as stated in the article:

> Finally, if you are one of the exceedingly few people for whom the clock > being off by a second actually matters, then I'm pretty sure you also know > how to deal with it.

<comment><USER20> _"if you are one of the exceedingly few people for whom the clock being off by a second actually matters"_

I would be interested to hear if anyone has examples to share about those systems :)

<comment><USER21> I would think that waveform capture on the electric grid would be impacted when doing timeseries data logging and use in subsequent analysis. Frequently these will be relative time snapshots or using a different time basis so not sure if they are actually impacted.

The only time people would care that I'm aware of would be if the grid drooped at that exact time and one was trying to do analysis around that. Otherwise they are just doing things real time as they happen and time tracking is not necessarily involved except for logging.

Anyway I frequently run into timeseries trending clients that cannot handle displaying daylight saving time transitions correctly let alone hope that they handle leap seconds correctly.</comment></comment></comment></comment></comment></comment>


Show HN: Poker Simulation Using WebAssembly and Web Workers - <AUTHOR> https://github.com/ChrisZieba/holdem <comment><AUTHOR> Put this together on the weekend to learn more about WebAssembly, here is the demo: [http://chriszieba.com/2017/11/26/holdem](http://chriszieba.com/2017/11/26/holdem)

</comment><comment><USER2> Does anyone know how much this improves performance over a simple JavaScript only implementation? This looks cool, but I have no idea if it's really any better with all the extra layers</comment>


Why Gawker is moving beyond the blog - <AUTHOR> http://lifehacker.com/5701749/

<comment><USER2> Dup: <http://news.ycombinator.com/item?id=1955250>

</comment><comment><USER3> Interesting piece outlining their strategy going forward. Worth a read!</comment>


Anybody Affect by Atrium Layoffs? - <AUTHOR> I saw on twitter some founders saying their legal team had been laid off and only learned about it via twitter. I almost went with them but decided not to, has anybody here been affected by this? <comment><USER2> Not I, but saw this on Twitter: [https://twitter.com/lex_node/status/1216767357659435008](https://twitter.com/lex_node/status/1216767357659435008)</comment>


HTTP/3 will no longer use TCP - <AUTHOR> https://topworldtimes.com/the-internet-is-evolving-http-will-no-longer-use-tcp/ <comment><USER2> In other news, all network issues with packet loss are going to be fixed.

In other other news http v4 will again use TCP once v3 turns out to have bad user experience because udp packets are being dropped by poorly configured networks.</comment>


I, Interface: Asimov's Three Laws of Robotics Applied to User Interfaces - <AUTHOR> http://adactio.com/journal/4866/

<comment><USER2> This makes no sense to me. How about something like this instead:

      1. An interface must ally itself with the user not the data.

      2. How an interface works is more important than how an interface looks.

      3. An interface must be as simple as possible but no simpler.

      4. No interface is good interface, unless it breaks the other 3 rules.

</comment><comment><USER3> Only the first one seems to mean anything. (And the zeroth.) The third one he admits is a joke.

The second one can't apply to something that can't make decisions autonomously. The only orders you can give it are very specific ones it's programmed for. And if you've programmed an interface to do something and it doesn't do it, that's so obviously a problem that we don't need to discuss it.

0 and 1 mean more, though. Interfaces should protect the user from their mistakes, so long as they don't prevent the user from accomplishing their tasks by doing so. This is trickier than it sounds since that much power is hard to bubble-wrap. Protecting the entire web from bad decisions is even tougher. Designing a protocol is hard. You practically have to be clairvoyant to foresee all the possible problems.

<comment><USER4> _You practically have to be clairvoyant to foresee all the possible problems._

Which is also the point of the original laws.

<comment><USER3> Which is fine, when the device in question is programmed to evaluate them itself. Applications can't do that yet.

</comment></comment></comment><comment><USER5> Have to admit that these are cool ways of looking at the fundamental objectives of a 'good' user interface.

Honestly, looking at the laws and to interpret them literally does no justice to them.</comment>


Why do we use so many units for energy? - <AUTHOR> http://imgur.com/a/4L2d5 <comment><USER2> Short short answer: because those voltages are "nominal", not what's really observed in-circuit. The available output charge (ampere*time -> charge) is much more controllable during manufacture, as it's directly related to the quantity of available reactants within the battery.

</comment><comment><USER3> You forgot to add the heat units, like BTU and calories, and the units for food like "kalories", and the units for air conditioners, like "frigorie".

<comment><AUTHOR> You are right, it is even more complicated, than the picture says.</comment></comment>


How Silicon Valley's Tech Reign Will End - <AUTHOR> http://www.theatlantic.com/business/archive/2013/06/how-silicon-valleys-tech-reign-will-end/277352/ <comment><USER2> This fluff piece doesn't quite make sense. The tech sector is and has been for some time spread across most areas of the greater Bay Area. While nothing North of Menlo Park or in Alameda county is part of the "Silicon Valley," the latter is just a PR term. Tech companies are densest from SF down to San Jose. "Silicon Valley" is neither a distinct geographical nor an economic unit.

There are some "sociological" differences across areas in that range with respect to the types of the companies and types of employees. Ignoring those trends to cause staffing problems, e.g. building a new consumer web company in South is rather hard, while trying to start a new semiconductor company in SF would be challenging to say the least. Many people immigrate here without understanding that, and problems ensue.

The "San Francisco Bay Area" is a large and diverse region with a population of roughly 6 million. About 10% of those people are directly involved at tech companies, and about 5% are the hard-to-find developers, product managers, testers, etc. Sadly this one minority sector of the economic absolutely dominates most sub-regions here, and it's economic power is so much greater than all the other people together, that a host of problems arise.

The presence of the bay and the surrounding hills also kinds of screws things up. Space is limited, and travel between certain areas can be time-consuming. If you consider that roughly 1/3 of the people currently residing in the Bay Area currently are not from here originally, then throw in the vast economic changes tech caused over the last 30 years, you can start to appreciate that maybe long-term planning for the present state wasn't quite manageable.

In any event, the rhetoric about "sovereignty" and its similes is always self- serving and posturing. Decentralization of tech, or the decentralization of L.A.'s entertainment industry for that matter, would be a boon to everyone. Only self-important people who want to believe that their region or state or country or village is the center of the freaking universe fail to accept that. It would be better for everyone if the Bay Area were simply one of a set of 20 or so equally large and vibrant centers of tech.

<comment><USER3> Yes, it reads like it could have been a press release for Bruce Katz's new book.

</comment></comment><comment><USER4> I apologize for this low-value comment, but I got hung up on "most smartest." I suppose it won't be long before that is considered acceptable.

<comment><USER5> Yeah, I did too. I wanted to leave a comment along the lines of "Most smartest? I thought this was the Atlantic..."

</comment></comment><comment><USER6> It seems that the ever-improving remote collaboration capabilities should enable tech employees to spread out of these isolated, high-rent silos and base themselves where-ever is convenient.

If I wanted to live in Ohio on a farm and work at Google or Facebook or some startup, why should that be a problem? Assuming a fast and reliable internet link (a big assumption for some areas, I understand), combined with video chat, real-time document tools, and even those new remote-worker collaboration robots (I forget what they are called), it seems like the benefit outweighs the cost in almost every way.

I understand that founders need to network with VCs and Angels, and so that drives centralized locations, but even so, if I had a good pitch, why couldn't I just travel to meet them and then return to base my startup in Ohio (or wherever), hiring top tech workers remotely, be they in the vallery, SF, NY, or the Yukon Territory (again, that thing about the internet connection...)

<comment><USER5> 1\. The VCs don't want to drive to Ohio when something comes up 2\. It's important for teams to be physically together to facilitate better communication and forge a sense of community and solidarity. Without actually knowing their coworkers and managers, your employees may not develop loyalty to your company and are unable to benefit from workplace social life.

</comment></comment><comment><USER3> It is very misleading, if not downright dishonest, to claim that Silicon Valley cities "aren't having a construction "boom," when actual construction tells us otherwise.

[http://www.mercurynews.com/business/ci_21274644/rents- rise-s...](http://www.mercurynews.com/business/ci_21274644/rents-rise-so-does- silicon-valley-apartment-construction)

[http://sanfrancisco.cbslocal.com/video/8986205-construction-...](http://sanfrancisco.cbslocal.com/video/8986205-construction- workers-in-demand-amid-silicon-valley-building-boom/)

</comment><comment><USER5> The article title is kind of misleading. When I see "Silicon Valley" in a headline, I interpret it as metonymy. So I thought the article was predicting the doom of the internet startup industry, not the valley as a hot location for startups. Such a "so what?" article.</comment>


Ohloh shows scary decline in open-source project commits - <AUTHOR> http://www.ohloh.net/languages/compare?commit=Update&l0=c&l1=html&l2=java&l3=php&l4=ruby&l5=shell&l6=xml&l7=python&l8=-1&measure=commits

<comment><USER2> NumPy: -157,525 lines of code, mostly written in Modula-2.

<http://www.ohloh.net/p/numpy>

<comment><USER3> That's an embarrassing error in our processing. We just acquired Ohloh and are working hard to identify all such issues and fix them. Stay tuned!

</comment></comment><comment><USER3> We at Black Duck noticed it too. So far, looks like the decline is largely because, lately Ohloh - a) hasn't kept up with discovering new projects. b) hasn't paid needed attention to keeping existing projects up to date.

We'll provide more details once transition is over (we just acquired Ohloh from Geeknet).

</comment><comment><USER4> I suspect it has more to do with the mechanism by which commit volume is measured than the actual commits themselves.

It's possible people are just moving away from verbose languages like C and Java and thus just needing to write less code, but I'm not sure I have enough faith in the human race to believe it.

<comment><USER5> Another possible reason is that as systems become more mature they require less maintenance. I know the 2 or 3 projects that I am involved with are pretty mature right now and we are mostly just fixing bugs.

</comment></comment><comment><USER6> Seems to shadow the recession. I wonder how this compares to closed-source commits.

<comment><USER7> One theory: programmer utilization at companies has increased with the recession, so there is less time for open-source commits.

Another theory: a huge fraction of open-source in recent years is written by programmers paid by companies to work on it. The recession has caused these programmers to be pulled off and put on projects where their time can be billed directly.

Third theory, there is more use of distributed version control "offline", which would not be detected by Ohloh.

<comment><USER6> Well, in contrast to the second theory, there's the possibility that open source commits and closed source commits look pretty much the same. They're mostly done by people looking to get a paycheck, and without a paycheck the quantity drops. People aren't necessarily being pulled off open source to work on closed source, they're just being laid off (which seems supported by the unemployment stats.)

</comment></comment></comment><comment><USER8> Are they tracking commits made to github?

<comment><USER9> They're tracking any open source project that's registered on their website. If you have or know about an open source project that's not on Ohloh, you'll have to register it and specify its repositories (and branches).

<comment><USER10> Ohloh shows scary decline in open-source project additions to Ohloh

<comment><USER11> That the most probable explanation, I believe. But did you find a real figure somewhere? I couldn't.

</comment></comment></comment></comment><comment><USER12> Hum. The App Store opened in mid 2008 and the Android Market in late 2008. There might be a link.

Also, there is a growing quantity of proprietary Web Apps which might have helped shift interest of many users and programmers along.

I'm not all that surprised as it has been one of my concern lately. The Open Dream might come to an end with the make-it-all-online meme.

</comment><comment><USER13> What about the possibility of the emergence of distributed version control? Perhaps this is causing less actual commits to the actual project, but not necessarily less code being written.

</comment><comment><USER14> You did the graph for C. Common!

Should add C++ and C#...ain't much of a decline.

</comment><comment><USER15> You'll get totally different picture if you remove C (even if you just replace it with C++) and Java. So, hm?

<comment><USER5> For the lazy: [http://www.ohloh.net/languages/compare?commit=Update&l0=...](http://www.ohloh.net/languages/compare?commit=Update&l0=-1&l1=html&l2=-1&l3=php&l4=python&l5=ruby&l6=shell&l7=xml&l8=-1&measure=commits&percent=true)

<comment><USER12> No. And no. The initial link was in Values, not in Percentage. When you click Update, the graph shown is switched to Percentage. Here is your link in Value:

[http://www.ohloh.net/languages/compare?commit=Update&l0=...](http://www.ohloh.net/languages/compare?commit=Update&l0=-1&l1=html&l2=-1&l3=php&l4=python&l5=ruby&l6=shell&l7=xml&l8=-1&measure=commits)

</comment></comment></comment><comment><USER16> The decline is in C, dynamic languages are on the rise. May be everything that had to be written in C has already been written?

<comment><USER7> It looks like the dynamic languages have been declining as well, though C's drop is much larger both percentage-wise and in absolute numbers.

</comment></comment><comment><USER17> HTML, JS, CSS, PHP, and Python all have steady increases, and ruby is mostly stable. It could just be that focus is more on the web (HTML in particular seems to have taken a biggish jump mid-2009 - related to HTML5?)

[http://www.ohloh.net/languages/compare?measure=commits&p...](http://www.ohloh.net/languages/compare?measure=commits&percent=&l0=html&l1=javascript&l2=php&l3=python&l4=ruby&l5=xml&l6=css&l7=-1&commit=Update)

<comment><USER12> Same link but in Values, not Percentage:

      http://www.ohloh.net/languages/compare?commit=Update&l0=html&l1=javascript&l2=php&l3=python&l4=ruby&l5=xml&l6=css&l7=-1&measure=commits</comment></comment>


Firefox 66.0.4 is out, fixes disabled add-ons - <AUTHOR> https://ftp.mozilla.org/pub/firefox/releases/66.0.4/ <comment><USER3> Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains:

\- why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)

\- what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies program?

\- why can't we see any xpi's installed by studies program unless we explicitly go to about:studies?

I don't say chromium is better, but I think we deserve an explanation regarding these points.

<comment><USER4> > why am I opted-in to a Studies program in Firefox's default state? (With no > explicit information about what it is)

I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it).

I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.

<comment><USER5> You could just turn off all studies in Firefox. It's a simple option:

[https://support.mozilla.org/en-US/kb/shield#w_to-opt-out- of-...](https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-all- studies)

<comment><USER4> I did. The problem is:

\- I had never heard of "Studies" before; which leads to

\- I never agreed to be a part of Studies in the first place _.

_ The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I _did_ opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in?

If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal.

For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.

<comment><USER6> > If this is indeed opt-in, and this unlikely scenario did happen, then I > apologize for the rant.

No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway.

I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it _had_ been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted _out_ of this studies thing at some point, meaning it had been turned on without my consent either.

</comment></comment></comment></comment></comment><comment><USER7> No release for android yet, at least not on [1], where I am getting the apk files from. As of now, latest release uploaded there is 66.0.2 from March.

[1]: [https://archive.mozilla.org/pub/mobile/releases/](https://archive.mozilla.org/pub/mobile/releases/)

EDIT it's up: [https://archive.mozilla.org/pub/mobile/releases/66.0.4/](https://archive.mozilla.org/pub/mobile/releases/66.0.4/)

<comment><USER8> xpinstall.signatures.required = false worked for me on android

<comment><USER9> Yeah, this also worked for me on Android. Not sure why the downvotes.

<comment><USER10> You're better off waiting a few more hours that disabling important security features.

<comment><USER11> The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.

<comment><USER12> Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval.

This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain.

You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.

</comment></comment></comment></comment></comment></comment><comment><USER13> I was already a bit mad at them for removing RSS support and claiming their proprietary service that's built in is an alternative, now their proprietary service keeps working (presumably, I didn't use it but it's not an addon so I doubt it's signed the same way) and I can't use the RSS addon.

I know this was a mistake, but I can't help but be mad that their proprietary built in stuff effectively gets a free pass and special treatment and meanwhile I can't use RSS and all my containers were deleted (those didn't come back after the study was pushed either).

<comment> luke-stanley I use containers too. I didn't loose any data after I enabled dev mode and added the extension back. Perhaps you removed the existing extension first and lost data that way?

<comment><USER14> It's odd - on my laptops, my multi-container settings were preserved, but I opened firefox on my desktop last night and they had vanished. I did not remove any add-ons myself.

<comment><USER15> Same here.

Only difference is that I restarted the desktop Firefox and also enabled Shield studies to get the temporary fix. On the laptop I just upgraded to 66.0.4 and only then restarted it.

</comment></comment></comment></comment><comment><USER16> About time. Embarrassing bug. The only reason i didn't permanently swap browser is because of the lack of alternatives since none has the functionality I apply through the addons.

<comment><USER17> I switched to the Dev build[1] with 'xpinstall.signatures.required = false', and now that it's fixed I don't know if I'll go back. There seems to be a bunch of new features in Dev that I assume will arrive in Firefox eventually, but everything else being equal, I think I'll stick with it.

I'll probably turn 'xpinstall.signatures.required' back to true though.

[1] [https://www.mozilla.org/en- US/firefox/developer/](https://www.mozilla.org/en-US/firefox/developer/)

<comment><USER18> Mine says Developer edition beta 16 Version 67.0b16 (64-bit) Last updated = 03May2019.

do I need to make this change? is it in the about:config ? 'xpinstall.signatures.required = false

<comment><USER17> Yeah, so if you set 'xpinstall.signatures.required = false' in the about:config it'll let you use your extensions, but this is just a workaround.

When a fix is fully rolled out (which should include Developer edition), then you won't need that (and probably should re-enable signature checking).

<comment><USER18> thanks . I have toggled that in about:config and extensions are back to working. internally, what does this toggle turn off?

</comment></comment></comment></comment></comment><comment><USER19> Did this issue cause all add-on data to be wiped? After updating to 66.0.4, all of the containers I'd created with the multi-account containers add-on were gone and replaced with what appeared to be a default set of containers. I spent a lot of time setting that up—is there no way to get it all back if I don't have some sort of manual backup? And if not, what files do I need to manually back up to make sure I don't lose my data next time?

Edit: To be clear, at no point did I delete the add-ons I had installed.

<comment><USER20> Containers are notoriously finicky datawise.

I generally keep good backups of the non standard ~/.mozilla folder to compensate.

I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile.

[https://github.com/mozilla/multi-account- containers/issues/3...](https://github.com/mozilla/multi-account- containers/issues/339)

<comment><USER21> > I think it was issue 339 on GitHub. They basically explain they won't add it > to sync data because there is no containers on mobile.

Makes you wonder how on earth their data sync is working with regards to mobile. Surely if it doesn't have the components to leverage the data it just wouldn't read it..?

<comment><USER20> Its possible to implement the concern was that people would leak their cookies into the default container.

They should be essentially syncing but not syncing any non default container data into mobile.

Basically they had some work to do on the server end I think.

</comment></comment></comment></comment><comment><USER22> Is a more robust way around this to use a trusted timestamping service?

This is the way code-signing on Windows works, and allows you to prove that code was signed by a valid certificate while it was in its validity date - <USER2> even once the certificate expires, the code will still run as long as the cryptographic timestamping signature is valid.

</comment><comment><USER23> What about older versions? Does this mean that older versions of firefox can never be used with addons (even matching older versions) anymore?

<comment><USER24> Good question. Looks like they do have a release for 60 (the current ESR):

[https://archive.mozilla.org/pub/firefox/releases/60.6.2esr/](https://archive.mozilla.org/pub/firefox/releases/60.6.2esr/)

<comment><USER25> Just export the key from a current version and import it into the old version. Worked for me.

<comment><USER26> How do you do this?

<comment><USER27> From an updated Firefox navigate to

 _Preferences - > Privacy & Security -> Security -> Certificates -> View Certificates_

Now find:

      Mozilla Corporation
        signingca1.addons.mozilla.org

Select signingca1.addons.mozilla.org and then choose export. This is what you would import into the older version of Firefox.

<comment><USER28> BTW that certificate list if fairly long, has no scrollbar and no search box. That's a bad UI.

Is there a way to report this without spending hours to register at Bugzilla and file a proper bug report?

<comment><USER27> Not sure why you don't have a scrollbar. On my version of Firefox (Firefox Developer Edition 67-0b16) the certificate list does have a scroll bar and can be navigated using the mousewheel. Can't speak for stable Firefox since I don't use that version.

No, not that I am aware of. In my own experience it actually took me longer to find alternative ways of bringing awareness to a bug I was having than it did to signup to Bugzilla and report it there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is pretty bad for Firefox. I wonder how much people straight up & left for Chrome as a result of it.

<comment><USER30> I was on the reddit thread when it happened - was super confused as I just updated my firefox and it happened at a very similar time frame so I assumed it was from the update

I personally found the issue trivial, my main addon is ublock origin. There was a workaround using about:debugging and installing UBO on there which worked so it's not like the fix was a long process.

Being committed to a single browser, if anyone was using firefox for as long as me, I can't fathom someone leaving their main browser over something like this. I haven't been using it for THAT long but what if Chrome did something like this too? Then they'd move to another browser that's not FF/Chrome?

<comment><USER31> I too use only two extensions, uBlock Origin and HTTPS Everywhere and the hotfix pushed by Mozilla re-enabled them within half an hour of disabling. I do sympathise with those who apparently lost the settings of certain addons, notably Container based ones. Fortunately I always found the UX of Containers so clunky that I never bothered.

Sticking with Firefox as an open competition to the browser monopoly is critical now more than ever before.

<comment><USER32> > Sticking with Firefox as an open competition to the browser monopoly is > critical now more than ever before.

I think this fact cannot be emphasized enough. Or we'll have the 90s monopolized web again: "Optimized for Chrome" \- not that there'd be a lack of websites already doing that as of now.

</comment></comment></comment></comment><comment><USER33> I have to say I was very pleased that the Debian-ESR package a) disables telemetry in the build and b) ESR still allows you to override the extension signing for now...

</comment><comment><USER34> Lost my containers _yet_ again, I am now on the last straws with Firefox, this whole Normandy thing is not helping the case. Firefox never asked me to opt in!

</comment><comment><USER35> Link where the release notes will be posted:

[https://www.mozilla.org/en- US/firefox/66.0.4/releasenotes/](https://www.mozilla.org/en- US/firefox/66.0.4/releasenotes/)

<comment><USER36> They're published now.

<comment><USER37> Right now, the Firefox for Android version is still not available in the Google Play Store.

<comment><USER38> Surprising no one. The real question is whether the apk is available somewhere so people don't have to wait for our favorite walled garden to mercifully pass the update.

</comment></comment></comment></comment><comment><USER39> I'm really worried about the average users not knowing what happened here. At least an email should be sent informing about the issue. But I guess many of those average users don't have a single extension installed, no problems for them.

<comment><USER40> Why would Mozilla have my/average users email-address?

<comment><USER41> Firefox Sync?

</comment></comment></comment><comment><USER42> The fix doesn't seem to work if you've been using Firefox Beta (67.0b16), or if you then install Stable (66.0.4) and sign in to sync - all addons are still marked as "legacy" and not enabled.

However, if you find each one in the store and (re-)install them - they work again and their data is back intact as expected.

<comment><USER43> Just in case someone misread this like I did, you need to reinstall each add- on. Not FF Beta itself.

<comment><USER42> Indeed, I meant re-install the addons.

</comment></comment></comment><comment><USER44> I've always been a fan of native browsers, and have been using Chromium-based Edge[0] as my daily driver at work. While I wasn't one who was impacted by the extensions change, The removal of Live Bookmarks really stung for me, as I've used that feature since 2002.

Container support (with Containerise), a dedicated search bar to use with DDG bangs, and easy 'send tab to device' is what has me holding on today.

But I have to admit that Microsoft's eventual offering is pretty appealing, a Chromium-based browser with the advantages of Chrome's compatibility and Edge's conservative battery sipping. I'm one who has always liked and even preferred Microsoft's products and their integration on as objective of a basis as a human can muster. Even if it's in different aspects, I think they're going to probably have Edge become a package equally appealing to the things I love about Firefox. Edge/Safari are definitely where I'll go if Firefox really starts circling the drain, but having been on FF since it was Phoenix, it'll take more than this debacle.

[0][https://www.microsoftedgeinsider.com/en- us/download/](https://www.microsoftedgeinsider.com/en-us/download/)

</comment><comment><USER45> Our extension sets [https://www.givero.com](https://www.givero.com) as the default search engine. After the extension got disabled and re-enabled, searches now default to Google.

So this fix is not complete.

Our efforts in getting Firefox users to install our extension has been in vain. "Luckily" we didn't have many users yet but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.

<comment><USER46> > _but imagine the amount of money this will cost bigger search engines like > DDG, Qwant, etc._

People use _extensions_ to change the default search engine in their browsers? I honestly thought only malware does that; regular people use the Settings menu.

</comment></comment><comment><USER47> Is there a little more background to what is happening here? The link is to an ftp, so I have no idea what is broken, fixed or why it matters.

<comment><USER36> See [https://blog.mozilla.org/addons/2019/05/04/update- regarding-...](https://blog.mozilla.org/addons/2019/05/04/update-regarding- add-ons-in-firefox/)

</comment></comment><comment> V-2 I'm still on 66.0.3 and the issue resolved itself, I believe, yesterday...

<comment><USER48> Resolved as in you're opted in to studies?

<comment> V-2 I never did opt in. SO if it's not the default setting, it must have been off.

<comment><USER48> They made it default. It's called Normandy.

<comment><USER49> A place most people associate with the largest amphibious invasion in history seems a curious choice of codeword.

<comment><USER50> The name fits the feature imo.

<comment><USER51> That'd mean all Firefox users are Nazis.

Which may or may not be true.

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> New version doesn't show up while following the instructions on: <[https://support.mozilla.org/en-US/kb/update-firefox- latest-r...](https://support.mozilla.org/en-US/kb/update-firefox-latest- release?redirectlocale=en-US&redirectslug=update-firefox-latest-version>)

</comment><comment><USER53> I don't understand why renewing the certificate wouldn't fix the issue ?

How does the 66.0.4 fix the problem exactly ?

<comment><USER54> It's a signing certificate that is built into the browser to verify add-ons, not a normal TLS certificate that they can just update on a web server.

The change basically just imports the new certificate into the database: [https://hg.mozilla.org/releases/mozilla- release/rev/848b1502...](https://hg.mozilla.org/releases/mozilla- release/rev/848b15028562c6757748070f637e0e4f0bbb5f65)

<comment><USER53> > It's a signing certificate that is built into the browser to verify add-ons, > not a normal TLS certificate that they can just update on a web server.

Ah, so that's why. Thanks.

What was the signing certificate validity period ?

<comment><USER55> Don't know about the old one, but the new one from the patch is:

        Not Before: Apr  4 00:00:00 2015 GMT
        Not After : Apr  4 00:00:00 2025 GMT

</comment></comment></comment></comment><comment><USER56> Not seeing any updates in `apt`.

<comment><USER57> This is the Mozilla release. It will take a bit for the Linux distros to get it packaged and into the repos. Even the Firefox install on my windows machine here doesn't see it as an automatic update yet.

</comment></comment><comment><USER58> Yet the official download on download.mozilla.org is still the old, broken version.

<comment><USER59> AFAICT still no update out for the android version either

<comment><USER60> Installing the hotfix package directly worked on Firefox for Android for me.

[https://storage.googleapis.com/moz-fx-normandy-prod- addons/e...](https://storage.googleapis.com/moz-fx-normandy-prod- firstname.lastname@example.com)

<comment><USER61> This is how I fixed it too

</comment></comment></comment></comment><comment><USER62> We need a new Phoenix, I feel.

From Wikipedia:

>They [the original Phoenix devs] believed the commercial requirements of Netscape's sponsorship and developer-driven feature creep compromised the utility of the Mozilla browser.

</comment><comment><USER63> Probably less important given the type (and number) of users who are on Firefox Nightly, but it's still at "68.0a1 (2019-05-03)" without an update available yet.

<comment><USER36> Nightly updates are currently frozen until we have a fix for [https://bugzilla.mozilla.org/1549075](https://bugzilla.mozilla.org/1549075)

[https://t.co/etOWyG4aqh](https://t.co/etOWyG4aqh)

</comment></comment><comment><USER64> Is the TOR browser update out soon?

</comment><comment><USER65> I've been waiting to see this. Just updated from 65.0 to 66.0.3. My addons are still disabled. Tried to install ublock origin, and it's not letting me. I'm getting a "Download failed. Please check your connection."

This is crazy, and I'm really disappointed with Mozilla. I'd leave firefox right now, but I don't want to contribute to the destruction of one of the last good pieces of software not owned by Google.

<comment><USER66> I installed Opera yesterday. So far so good. Hope others will chime in with more alternatives

<comment><USER67> opera is now just the chrome engine. I don't think there's any alternative to chrome but firefox now-a-days, as even microsoft gave in and started using chrome's blink engine.

<comment><USER68> Safari or any Webkit browser maybe? I don't know how far Blink has diverged from Webkit.

</comment></comment></comment></comment><comment><USER69> GNU icecat is a very nicely modified firefox that respects the users. I highly suggest giving it a try if firefox has been bothering you lately.

</comment><comment><USER70> studies, normandy, looking glass, forced signing of addons... Mozilla is giving away a lot of good-will lately. Still my favorite browser, but I don't like the general direction. Privacy should always default to true.

I hope for Mozilla to find a source of income that isn't Google, because they did a lot for the web. Let us just hope they don't need to make too many compromises.

</comment><comment><USER71> Why I still can not install addons after upgrading? On the addon page it shows "only with firefox - get firefox now".

</comment><comment><USER72> So nothing for those of us still running 56 beause Quantum trashed our extensions (and there are still not equivalent availale)?

<comment><USER73> Why on earth are you running such a massively outdated browser? You should at least switch to pale moon, basilisk, or another maintained browser. God knows how many vulnerabilities in the wild there are in 56.

<comment><USER74> Is security the new motor powering the upgrade treadmill?

God knows how many vulnerabilities there are in the massively outdated Windows 7, why don't you upgrade to Windows 10...

<comment><USER73> Win7 gets security updates until somewhere in 2020. After that point, anyone still using 7 will be better off upgrading to 8/8.1/10.

Firefox 56 is not an ESR. It does not get security patches. From a quick look, there are public CVEs[0] that allow for ROP code execution almost effortlessly.

Security was always one of the big reasons behind keeping browsers up to date (the other reason being propagating new standard faster).

Besides, I wasn't suggesting updating to latest firefox. I specifically mentioned pale moon and basilisk because they support old style extensions, while hopefully keeping up with the security fixes and other improvements to the engine going in mainline.

[0] [https://www.cvedetails.com/vulnerability- list/vendor_id-452/...](https://www.cvedetails.com/vulnerability- list/vendor_id-452/product_id-3264/year-2019/opov-1/Mozilla-Firefox.html)

</comment></comment></comment></comment><comment><USER75> What about ESR?

<comment><USER76> ESR has been updated to fix this [1]

[1] [https://ftp.mozilla.org/pub/firefox/releases/60.6.2esr/](https://ftp.mozilla.org/pub/firefox/releases/60.6.2esr/)

</comment></comment><comment><USER77> What about updating also the beta channel, I am using 67.0b16 and I still think I am affected because, not updates since and all the addons are shown as "ALLOWED IN PRIVATE WINDOWS"

</comment><comment><USER78> installing and running this version did not resolve the issue for me

is there something else I need to do?

</comment><comment> jags-v Mine says : Firefox Developer Edition 67.0b16 (64-bit). No fix yet there...

</comment><comment><USER79> thanks for the heads up, now alive!

</comment><comment><USER80> how about windows xp. still don't work. you going fix it for us please?

<comment><USER81> I'm very curious - why are you still on XP?

<comment><USER82> Why would anyone want to upgrade from XP? New versions of Windows have no improvements (the only improvement is search in Start Menu), but they cost money, they work slower and require new expensive hardware. They have spyware and updates that cannot be disabled. You pay for the product and then you are used as a free tester of new versions of Windows. Microsoft wants everyone to upgrade to earn more money and to upsell to users new "cloud" features they don't really need. But for me it would be better if MS would drop newer Windows versions and returned to improving XP without increasing resources comsumption, without HTML apps, telemetry and "cloud" features.

This is an example when the interests of users and the manufacturer are opposite. If the user uses an OS for many years and everything works, why upgrade? Looks like a waste of time and money.

Imagine if you bought a car and several years later you are told that you need to upgrade it, because, you know, car factory workers need higher salaries and if you don't buy the new one, then there is no way to pay them.

This explains why MS and independent developers (that drop XP support to help MS) forces users to upgrade. Because it is MS who wants an upgrade, not the user.

<comment><USER83> > Why would anyone want to upgrade from XP?

Is that a serious question?

Security?

Compatibility with Modern hardware?

If you want to use a car analogy, what you're asking is 'why would anyone want to upgrade from a Model T?

<comment><USER82> Microsoft could drop newer Windows versions and instead focus on improving Windows XP.

<comment><USER81> That ship has sailed many years ago.

</comment></comment></comment></comment></comment></comment><comment><USER84> Switched to Chrome and Brave.

<comment><USER85> I wish I could switch to something else, but I still trust Mozilla the most.</comment></comment>


Mozilla re-enables TLS 1.0 and 1.1 because of Coronavirus (and Google) - <AUTHOR> https://www.ghacks.net/2020/03/21/mozilla-re-enables-tls-1-0-and-1-1-because-of-coronavirus-and-google/ <comment><USER2> I was in charge of ensuring the TLS 1.2 compliance of hundreds of old sites in my organization. 2 weeks ago I was well on track to have it finished in time. Now I'm tasked to just keep up essential systems that are straining under the work from home onslaught, with two suddenly homeschooled kids needing my support

I'm also so overstressed and worried that can only sleep on Xanax and have an asthma flare-up that looks like covid19 symptoms at times, adding to the anxiety.

This will be a good and needed change, but it can wait.

<comment><USER3> Why do you have to do it alone? Cant you ask for another colleague to help you out on this?

<comment><USER4> If you were to ask a room full of developers what are TLS versions or TLS ciphers and which ones should be disabled? You'd be luckly if any of them raise their hands.

Consider an old organization with hundreds of old systems, that can be fairly critical. Nobody understand or is willing to do the work. To their credit, TLS and cryptography is really difficult.

So don't be surprised that things will be fixed... after they're noticeably broken.

</comment></comment></comment><comment><USER5> _" We reverted the change for an undetermined amount of time to better enable access to critical government sites sharing COVID19 information."_

This makes a lot of sense. Normally, browsers moving together to turn down an old and insecure protocol would push the last few sites to update, but with everything being a mess because of the coronavirus this isn't a good time.

(Disclosure: I work for Google)

</comment><comment><USER6> >"The preference change will be remotely applied to Firefox 74"

No thanks. How do they do this, and how do I stop people from being able to remotely "manage" my Firefox install?

<comment><USER7> While I agree with the pragmatic choice of keeping older TLS enabled a while longer, I am very much at unease of Firefox remote updates and management (pushing code fixes as studies etc), disrespecting preferences in local configs and proliferation of services and multitude of background service connections.

Mozilla, please, I want a browser that _I_ , as a "power user" can manage. Not an idiot-proof remotely managed on-prem SaaS.

Note: I and I'm sure many others would donate meaningful amount of money, if it could be restricted to categories of use, such as Firefox development or Rust development. You don't have to become a service vendor to wean off Google.

<comment><USER8> > Mozilla, please, I want a browser that I, as a "power user" can manage. Not > an idiot-proof remotely managed on-prem SaaS.

Then you need to accept that Firefox will linger at a very low number of users and many of those users will be left with insecure browsers because they fail to update them properly. Maybe that's a fine thing, but that's the world you need to accept if Firefox is explicitly targeting power users.

<comment><USER7> It's not either or. They could make it easy do disable all various background activity, document users prefs and respect provided settings (perhaps with different branding), accept targeted donations etc.

Firefox is already providing automatic updates. Would it be so bad to release a point version (do they even to that anymore) instead of a remote preference change?

Still, it's not exclusive - they could do both, while providing a clear power user mode, where you may need to update, because they don't do such shenanigans.

It's not an idle offer - I'm offering 1k€ to properly document user prefs and not second guess their setting (could be a compile time switch, possibly with altered branding, but on a supported/LTS versions). Anyone want to set up a gofund me or something?

</comment></comment></comment></comment><comment><USER9> I have Firefox 74.0 with studies disabled and yet TLS 1.0 and 1.1 are enabled. I don't understand how Mozilla turned them on if I had studied disabled since the Mr. Robot incident.

<comment><USER10> I was also curious. It appears they used Normandy. From the Mozilla website: "Normandy Pref Rollout is a feature that allows Mozilla to change the default value of a preference for a targeted set of users, without deploying an update to Firefox. This document focuses on the use of Pref Rollout as a mechanism to enable feature flagging in Firefox."

And I see a new Firefox about:config preference: app.normandy.startupRolloutPrefs.security.tls.version.min

<comment><USER9> Thanks for the pointer. I've set 'app.normandy.enabled' to false, hopefully that is the last way someone can change something on my computer without my knowledge.

</comment></comment></comment><comment><USER11> And this highlights how Google and the Chrome ecosystem is strangling web tech. The fact they were afraid of making a move that isn't in lockstep with Chrome means Chrome has too damn much influence.

<comment><USER12> Decade-old versions of TLS are flat-out bad for users. TLS 1.0 is from 1999!

The points of standards are to get the entire industry to adopt them. When the browser vendors come together and agree to all do the same thing, that's not one vendor flexing its muscles, that's standards working as intended.

<comment><USER13> > Decade-old versions of TLS are flat-out bad for users. TLS 1.0 is from 1999!

no, _bad standards_ are flat-out bad for users.

lots of text files being written in ascii, for example, and 'ASCII is from 1963!'

<comment><USER14> Time to get on the ball and upgrade to Latin-1.

<comment><USER4> You mean latin-9 hopefully. The one with the euro sign.

<comment><USER14> That may be too difficult. These things take time.

</comment></comment></comment></comment></comment></comment><comment><USER15> Alternative title ... Mozilla re-enables state-sponsored hacking groups

</comment><comment><USER16> Seems to indicate it wasn't as urgent to disable these as professed. I think browser vendors are sometimes a little too quick to break things, glad to see this pragmatism.

<comment><USER4> I assure you the browsers were not quick to disable TLS 1.0. They've dragged down their feet as long as they could and beyond.

TLS 1.0 and previous protocols have been prohibited from usage since around 2017 by PCI DSS and most regulations. Any company that gets a basic security audit or self-submit their website to [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/) would have been red flagged for using TLS 1.0 for years.

I've worked on the TLS upgrade in some financial institutions that notoriously always lag behind and even them have been ready for a while.

At this stage websites stuck on TLS 1.0 are either unmaintained for years or purposefully trying to support a Windows XP and Java 7 audience.

<comment><USER17> > At this stage websites stuck on TLS 1.0 are either unmaintained for years or > purposefully trying to support a Windows XP and Java 7 audience.

Or are using Heroku Automated Certificate Management [https://help.heroku.com/G0YVUNPG/how-do-i-disable-support- fo...](https://help.heroku.com/G0YVUNPG/how-do-i-disable-support-for- tls-1-0-or-1-1-on-a-heroku-app)

<comment><USER18> As long as you support 1.2 as well (which Heroku does), you're fine; this is about sites that _only_ support 1.0 or 1.1.</comment></comment></comment></comment>


Show HN: Stormly – Build and share custom ML/AI-based analytics solutions - <AUTHOR> https://www.stormly.com <comment><AUTHOR> Hi HN!

While I worked on consumer products in the past and used tools for analytics like Mixpanel, GA, or Amplitude, I often hit their limitations in terms of flexibility.

That meant eventually resorting to exporting data and doing the manual analysis while juggling between multiple products, and needing a paid subscription for each of them.

So I've decided to build Stormly to overcome these limitations.

Stormy is a platform that allows you to use existing ML/AI-based components to quickly put together solutions adjusted to your needs using a developer friendly JS/JSX api. This makes it not only extremely powerful but also flexible and shareable.

With Stormly, you can also dig into your data without any limitations, specify custom user properties, use custom SQL, and use/create custom plugins like forecasting, prediction models, and much more.

We hope you like what we've done here and are excited to hear your feedback!

</comment><comment><USER2> Congratulations on launching! I tried some of the sample projects, and it seems interesting. I got kind of confused about the navigation at first.

Is the api/vm for running your own calculations only available as JS, or also other languages like ruby, python or java?

<comment><AUTHOR> Thanks! Will do some more user testing with the navigation to see if some things can be ironed out.

The main API runs fully in the browser and is JS based with JSX for visualization and displaying components like charts, lists, tables, etc. By using JS it also keeps it accessible for a wide audience to quickly put something together.

The ML/AI plugins are called from the JS api and run on a VM that currently only supports Python, with the usual libraries such as scikit-learn, etc. In the near future we'll add more languages and libraries.</comment></comment>