A search engine built by the crowd - <AUTHOR> http://blog.archify.com/2013/07/11/a-search-engine-built-by-the-crowd-that-does-not-suck/

<comment><USER2> Great idea, but I think Google already uses this data.

Google Toolbar and now Chrome report this data back to Google, and most search pros believe "serp bounce back" and "time on site" are key signals Google uses.

PageRank and DwellRank are not either-or choices.

Here's my theory: Google uses PageRank to decide what pages to "try out" for a query (i.e. display a page in the SERP for a sampling of queries). If the page gets clicks AND has good "DwellRank" then it gets progressively better and better rankings. If a new page enters that beats it, it falls.

This approach is very Googly -- they love to test. They love to decide if product features are good or not by giving them a sampling of traffic. It would be insane of them not to extend this approach to search.

So the upshot is, use "PageRank" to decide which pages deserve an audition, and use "DwellRank" to decide the winners.

Since 40% of the clicks go to #1, 10% to #2, 8% to #3 etc,Google can audition pages using DwellRank without affecting the experience of the majority of their users.

</comment><comment><USER3> I was a little surprised that they haven't included anything about spam or gamification. One core advantage of pagerank is that it's (relatively) hard to get links from high-authority websites. I can't force whithouse.gov or cnn.com to link to me. If you rely on time-spent-on-page from millions of users and treat everyone equally, how to you stop spammers from faking millions of hours spent reading their content using spoofing or bots?

<comment><USER4> Another problem is that if you just count time browsed then sites such as Facebook, Reddit and Kongregate get super high rankings.

<comment><USER5> We are counting the per unique URL, which is currently not a big advantage for the popular sites, because they are hosting so many URLs. There no domain based factor in it right now.

-Gerald Disclosure: I am the CTO of archify/Blippex

</comment></comment></comment><comment><USER6> Hmm, this is an interesting algorithm, but I'd challenge its major assumption for a lot of searches. I don't have metrics, so of course my own assumptions can be challenged also, feel free to.

I think that a lot of search engine enquiries are essentially questions, with an answer that can be considered correct. Absolutely not all, but I think enough that they should certainly be considered. In that case, a site which immediately and clearly answers the question should be given, I want my answer within seconds, not minutes. If you give me the site that answers my question and that users spend the most time on, that's the exact opposite of what I want in this case.

Here's an example, I search "Population of America", your site's top result is sporcle.com, a quiz site. I bet people spend ages on there guessing the population of various countries etc, but I'd prefer to just get my answer.

That said, it appears such queries are handled outside the main algorithm by your competitors. Both Google and DuckDuckGo will give a card, at the top of the result, answering my query - I don't even have to visit a website.

I guess the tl;dr is that it's awesome that this is ambitious, but I challenge the assumption your algorithm is desirable for the majority of search results. Neither is Google's really though, so maybe this is an overly harsh criticism of something Google probably did very poorly early on too.

<comment><USER5> I think you guesses are absolutely right. We never intended to compete against other engines in the field of "Answers". I think you will always get a better result for ""Population of America" if you search for ai at DuckDuckGo or Google. But in the other hand if you search for example for "NSA" on Blippex ([https://www.blippex.org/?q=NSA](https://www.blippex.org/?q=NSA)), we are assuming that you will get those articles about the NSA which is currently the most interesting or the most read.

-Gerald Disclosure: I am the CTO of archify/Blippex.

<comment><USER6> That's fair enough, it seems like it would be really useful for article searching, like the NSA one you gave (great, example, blew Google out the water!). I can see it being great for research too, assuming academics spend the most time on a good source which seems reasonable. I'll definitely be giving this a go for some searches, really nice!

Oh, and a quick suggestion: Have you considered a Firefox search engine addon? I do most searches from the omnibar, and I think more people would switch search engine up there than manually go via blippex.com

<comment><USER5> Thanks. Yes we will implement a Firefox search engine addon soon.

</comment></comment></comment></comment><comment><USER7> This algorightm might highly impact discoverability. It gives mover visibility to already popular websites making them even popular, while not very well known websites will never be discovered because very few people spend time on them.

Also I don't like the idea of having to install a plugin on my browser so that the urls I visit and how much time I spent on them is tracked, even if suposedly my identity is never tracked. Once the plugin is installed how can I know if a new version of the plugin won't track more parameters?

When I read the title I though it was referring to a distributed search engine like YacY or Seeks.

<comment><USER8> Well, if anyone is able for example to implement a TOR client in javascript we would love to add it to the plugin, and the sourcecode of the plugins and Android app is on github, so no cheating there.

<comment><USER7> +1 because the source code for the plugins is on github which I didn't know

</comment></comment></comment><comment><USER9> +1 for being super ambitious.

Full disclosure: I work at Google (though not on web search).

Your search actually sucks, perhaps because your index is woefully inadequate. How many pages are in it? Maybe you should use common crawl?

<comment><USER8> Its says it a t the bottom of the page, not a lot, more stats are here: [https://www.blippex.org/status](https://www.blippex.org/status)

</comment></comment><comment><USER10> It's sad to think that, with Google Analytics, Google probably has this data point already available for a lot of pages without having to ask people to install stuff.

<comment><USER11> Sure, but last time I checked there was an opt-in for sharing the data (for industry benchmarks I think) so I assume this would require a new legal foundation.

</comment></comment><comment><USER12> 1\. PRISM? 2\. Often best sites are the ones I spend the least amount of time on—because I got an answer quickly. Would hate to not be able to find those site. Seems link the traditional form of ranking should still be an important part of your solution.

<comment><USER8> Maybe, we don't kmow yet, need more data :) we also weight the number of visits in the dwell factor, but maybe we have to adapt this in the future.

<comment><USER12> Cool. The converse of this is that perhaps I spend a lot of time on a site because it's difficult to use (and there isn't a better alternative for me). How about I instead give you access to my camera so you can measure my mood (through facial expression). If I look happy or intrigued, must be a good site!

</comment></comment></comment><comment><USER13> Google is a good name for a search engine, and easily usable as a verb.

Yahoo is pretty good, and was used as a verb for all of the 90s and early 2000s. IMO not as good as "I'm going to google that", "I'm going to yahoo that" sounds vaguely sexual.

DuckDuckGo and AskJeeves are terribad: "I'm going to duck duck go that"? No.

Blippex is better than ddg or ask jeeves, but still not too great. Coming up with a good product name is hard but is crucial for usability / spread through culture. Reminds me of blumpkin.

<comment><USER11> The verb bonus of Google is indeed killer but Google sounds primarily better because Google is Google.

</comment></comment><comment><USER14> I think this is a great idea! However, I am worried about privacy. I also feel like this algorithm may inflate the importance of certain types of content over others. For example, just because I spend more time on a news or social media website does not mean that it has higher quality content, it just means that the content takes longer to consume. Within content categories, however, I think this could do a good job of weeding out the quality content from the spam.

<comment><USER5> Thanks, that is a very interesting input. We should think about running additional semantic analysis and relate them to the time spent on sites. We are very sure that our algorithm needs a lot of fine tuning and this could be a very important part of it.

-Gerald Disclosure: I am the CTO of archify/Blippex.

</comment></comment><comment><USER15> I had a similar idea in college which was to take the actual traffic for pages into account for search ranking (this was before Google bought whatever Analytics had been called before, I can't remember.) I had thought of it as a server side app which would benefit the hosts while feeding the search engine traffic data.

After talking with friends we explored the idea of a user side traffic tracking app as a way to feed the search engine, but I couldn't get enough traction and no one wanted to challenge not only Google but also IE/Firefox/Safari etc. because we felt it would be its own browser.

Alas.

Now a days I am more concerned about possible privacy issues, I feel for them launching a search engine that actively asks you to be tracked (even if anonymously), it's a hard sell during this current resistance to that entire idea.

<comment><USER16> _> We felt it would be its own browser._

Why not a browser add-on or extension?

<comment><USER15> At the time FF was still behind IE and IE hadn't really adopted extensions yet, I think. It's a bit fuzzy how we got there, this wasn't like a formal business plan and analysis, this was some college guys in the dorms chewing on an idea for a few weeks.

</comment></comment></comment><comment><USER17> It needs some sort of fallback for search results or it's useless to a specialized user. My Google search history looks like random bits of consciousness spread out across months. Half of those search terms bring 0 results on Blippex, and while I understand that they're early, it's hard to beat something like PageRank when it's already got established experience.

It's a catch 22: the results won't get better unless people use the service, but people aren't going to use it if the results are bad in the first place. If I install the extension but use Google, it's a one-way relationship that only they get data out of. Not very good for me.

</comment><comment><USER18> How do you differentiate between useful dwell and useless dwell? I often need to spend some time on a page before I realize this is not what I'm looking for. How will you tell? And now that we're talking about search, I had an experience on google that I found very odd. I was looking for the Richard Marx song, "Suspicion" from the album "My Own Best Enemy". I knew the song and the album, but I couldn't remember the name Richard Marx. Problem was instead of typing "My Own Best Enemy", I was typing "My Own WORST Enemy". Google had no clue. Shouldn't a good search engine be able to tell it's just one word wrong?

<comment><USER5> Differentiating the quality of a dwell would be nice, but that would mean to track search trails of our users, which is too much of a privacy issue. But we are thinking about semantically evaluating the DwellRank. For example a useful dwell would be for tutorials. But this is just an assumption, we simply need more data about that.

Gerald (Disclosure: archify/Blippex CTO)

</comment></comment><comment><USER19> The problem with this is that it's basically asking to be manipulated.

</comment><comment><USER20> Thanks for building this. We need more stuff like this.

Out of curiousity, how do you prevent the case of some random malicious user impersonating your chrome extension and just issueing a bunch of "dwells" to your server. I.e. can I just curl what this javascript file ([https://github.com/blippex/blippex_plugin_chrome/blob/master...](https://github.com/blippex/blippex_plugin_chrome/blob/master/plugin/common/js/api/upload.js)) is requesting to boost my own pages ranking?

<comment><USER5> We have some rate limits at our API in place, but of course it not that difficult to change an IP-address. But most important we wrote some algorithms which checks submitted URLs and domains for suspicious or accelerating behaviour. If that happens we simply suspend that domain for some time. We are also planning to publish those suspensions.

-Gerald, CTO archify/Blippex

<comment><USER20> cool!

</comment></comment></comment><comment><USER21> Interesting idea, but I tried simple searches :

Facebook

gmail

news ycombinator

countries in europe wiki

Did you gather enough data already ?

All of these seraches were not successful. There was no Facebook link in the first search, no Gmail link in the second one , no news.ycombinator in the 3rd one, and the only wikipedia link I got in the last search was :

[http://en.wikipedia.org/wiki/National_champions](http://en.wikipedia.org/wiki/National_champions)

<comment><USER5> I don't think that those "generic" term are the main advantage of Blippex. But if you search for example for "NSA" on Blippex ([https://www.blippex.org/?q=NSA](https://www.blippex.org/?q=NSA)), we are assuming that you will get those articles about the NSA which is currently the most interesting or the most read. -Gerald (Disclosure: I am the CTO of archify/Blippex.)

<comment><USER21> I see, if there is enough data It would then make a lot of sense to search for :

{A language/framework/... you want to learn about} tutorial

As some comments said, the best website are not necessarily the one you spend most of your time on. But tutorials are an exception.

</comment></comment></comment><comment><USER22> I'm sorry for the offtopic, but on a page that's supposed to get people involved, shouldn't you at least mind the difference between _its_ and _it 's_? In the very first paragraph it goes wrong already. I'm not a native English speaker, but these mistakes always jump out for some reason.

<comment><USER8> Thank you for the find, we will fix it!

<comment><USER22> Well that was a quick response, at least that's a positive thing :). I installed the add-on. Testing the search engine, searches seem to take forever. It keeps displaying the spinning icon in the orange square next to my query.

Edit: Ah the niceness of asynchronous javascript. It returns an error (I can see it in the JS console) but the page never displays that to me. Good ol' page reloads wouldn't have done that </rant>. In any case, the issue is my header modifying add-on. It injects "'\ into the x-forwarded-for header, causing your application to error. You probably have an sql injection in your code somewhere.

If you want to track the issue down, my IP is 184.108.40.206 or 2001:980:1f44::/48 if you support IPv6. Timestamp around 17:51 UTC+2.

<comment><USER5> Could you please send me a link to the header modifying addon. So I can fix that.

firstname.lastname@example.com

<comment><USER22> I sent you an e-mail together with the console log, containing response codes I'm getting. Hope this helps :)

</comment></comment></comment></comment></comment><comment><USER23> Doesn't work at all without cookies. Meaning, it doesn't work, and doesn't tell you why. If you're targeting people who are looking for an alternative to the major search engines, there's a better-than-average chance that they'll have cookies disabled.

<comment><USER8> Blippex don't use any cookies, neither the API nor the website. We don't store any data from the people accessing Blippex.

<comment><USER23> I love that! All the more reason why the search should function properly with cookies disabled.

Just disable cookies in your browser, load Blippex, and search. I searched for "shakespeare" in Firefox 22 (where I have cookies turned off), and the result (below the fold, incidentally), was

> Nothing found > We're all like "What the blip, man?" too. ...

Same search in Chrome 28 works fine (and interesting, too).

This is my pet peeve on the web, and so common with HN posts that I don't usually bother to point it out. But this seems like something you'd want to know.

</comment></comment></comment><comment><USER24> It's some kind of AI or even some kind of neural network, people are involved to train the search engine, so, more data users will contribute to the search server - more proper and relevant results they will get. Good idea</comment>


Can Xcode Refactor Swift? - <AUTHOR> http://canxcoderefactorswift.com/ <comment><USER2> Somebody knows if there is a (reasonable) reason for this (compiler, versioning,..)?</comment>


Ask HN: phpBB or Discourse, which one should I implement? - <AUTHOR>

Hello all. I am finishing the system I am currently working at, and while I need an online bulletin board system, I don't know if I should use the good (?) and old phpBB or the new, fancy (but still "weird" for some users) Discourse.
Did someone set up an enviroment with Discourse and can give me some feedback? Thanks in advance.
For those who don't know Discourse: http://meta.discourse.org/ <comment><USER2> phpBB has a lot of cruft, both in terms of UI/UX and in terms of the codebase.

But I'm not really a fan of the Discourse style, where once a discussion falls off the front page it's not immediately easy to find again, esp. for novice internet users.

IMHO it's a case of Devil You Know, and Discourse's "benefits" aren't overpowering enough to motivate me to switch in my own side projects.</comment>


KiCad 4.0.0 is Out - <AUTHOR> http://kicad-pcb.org/post/release-4.0.0/ <comment><USER2> I've designed a dozen or so boards using KiCAD, some in commercial production. You definitely have to get into its way of thinking, but once you do KiCAD works very well (as long as you only need design-rule checking and not more complex simulation). Using keyboard shortcuts allows you to work quickly once you learn what they are. I haven't tried the new version, but from the previous stable release the feedback I have is that it needs better component and footprint management. As an open source project it should be easy for users to not only use components (this needs work), but also to contribute new ones. If you make a component locally there should be an automatic offer to upload it to an online component repository. The other thing is that I wish I could edit component fields in something approximating a spreadsheet view. I always maintain a separate BOM spreadsheet to track things beyond reference number. I'd like to list component IDs directly in KiCAD, but some (especially passive components) have very long names that clutter the schematic and silkscreen. I'd like the ability for component names to have "display" and "full" views, with the schematic showing the former and a generated BOM showing the latter. Ideally more fields would be built in too, so it wouldn't be necessary to add keys for extra fields. Something like: description, chemistry / type, package, mfg, part number mfg, part number mouser, value, tolerance, qty, reference, unit ($), ext ($), 1k pricing ($), ext 1k ($), datasheet, note

This flowchart captures the KiCAD experience pretty well (though the "PCB Done" step is decidedly more time consuming than its symbol suggests):[http://docs.kicad- pcb.org/en/getting_started_in_kicad.html#k...](http://docs.kicad- pcb.org/en/getting_started_in_kicad.html#kicad-work-flow-overview)

<comment><USER3> Just a heads up, at least in the latest version you can add extra fields to components in eeschema. There are a handful of scripts out there that take these extra fields and generate more useful BOMs with them.

KiCost is one and bomtool ([https://github.com/cpavlina/bomtool](https://github.com/cpavlina/bomtool)) is another.

bomtool has more of what you are looking for, where for passives you can specify a value, tolerance, package, etc it will just search digikey and pick a component that works.

The other things you mentioned I 100% agree with. more advanced DRC is something that a lot of people ask for. Not sure it will happen any time soon though.

</comment></comment><comment><USER4> Does anyone have a good resource for learning to design PCBs? I have a breadboard with some sensors that I want to make a PCB out of, just so the wires are tidy, but I watched an Eagle tutorial and it looked like there are tens of easy to make mistakes that will ruin your board. I'm not sure if that's true, but if it is, does anyone know of a resource that will at least teach me how to make this simple PCB avoiding the most common errors?

<comment><USER5> It's not really a tutorial, but there are some nice tips here: [http://www.allaboutcircuits.com/technical- articles/practical...](http://www.allaboutcircuits.com/technical- articles/practical-pcb-layout-tips/)

For a prototype PCB fab, [http://www.oshpark.com](http://www.oshpark.com) is my favorite.

<comment><USER6> This is actually a real good guide to go along with your link, which is also good -- it mentioned Kelvin sensing as the second item, haha -- for young players: [http://physics111.lib.berkeley.edu/Physics111/BSC/Readings/O...](http://physics111.lib.berkeley.edu/Physics111/BSC/Readings/OpAmps/OpAmp%20Applications/Web_Ch4_final.pdf) Don't expect to be designing 6 layer stack-ups or anything but this + Horwitz might get someone up to speed fairly quickly

</comment></comment></comment><comment><USER7> Would anyone use Kicad/Eagle these days if he/she has access to Altium Designer?

<comment><USER8> Would anyone use Altium, KiCad, or Eagle if they had access to OrCAD, Allegro, or PADS?

Having used all of those tools, I can say that KiCad and Eagle will remain relegated to the low layer count, and at most moderately populated PCBs. Altium still has issues with large designs, but it's got its advantages, it's very easy to work with industrial designers within the Altium ecosystem. Altium also supports some decent auto-routing and DFM tools but does not have a simulator of any kind.

Cadence's OrCAD and Allegro offerings, and Mentor Graphic's PADS suite have tools for everything from designing with microvia (laser etched single layer vias) to highly configurable constraint management tools that allow for configuring some very powerful auto-routers and interactive tools. The big two tools also have simulators like PSICE, and integration with RF design tools like Keysight ADS, Genesys, Momentum, Hyperlynx, and HFSS. If your design has any RF components or high speed buses like DDR, PCIe and USB, you need to run your designs through these tools to verify your design. Eagle, and KiCAD are great for breakout boards. Altium can be used for some pretty simple products. But I'd never use anything but Cadence or Mentor Graphics tools for anything that had a signal that operated at more than 50MHz.

<comment><USER9> I think your Altium experience might be a little stale. Microvias in Altium are really easy since at least three or four years ago. It also supports basic SPICE simulation, but I've never used it. I use external SPICE and RF tools for most of my simulation needs. I've had good success designing RF boards in Altium and the only reason I would want to use Mentor Graphics would be if I had some massive digital design with high speed buses everywhere. You get what you pay for, but Altium is a solid tool at a decent price.

<comment><USER3> KiCad also has support for microvias and blind/buried vias in this release. There are a few high speed design tools (trace length tuning and differential pair routing) that were added and I expect more RF support will come in the next release or two.

</comment></comment></comment></comment><comment><USER10> > New s-expression based pcb format (.kicad_pcb)

Rock on KiCad

</comment><comment><USER11> How does KiCad compare to Eagle?

<comment><USER12> Favorably.

Obviously, it's free and open source, with no board size / layer limitations. On the other hand, Eagle is still much more widely used in the DIY community, and most my-first-PCB-like tutorials are Eagle-based. Kicad has for years suffered from the binary release being really, really outdated. Kicad development feels pretty fast-paced.

It has most or all of Eagles features, and some nice advanced features Eagle doesn't have. Especially it's PCB routing support is much better. For example, it supports push shove routing[1] and automatic trace length matching. It also shows the netname on pads (in Eagle you have to use "show" all the time). On the schematic side, It has had hierarchical sheets for many years now, whereas Eagle only gained hierarchical design support earlier this year in version 7. Things like that.

There are minor workflow differences in some places. For example, it uses key combinations instead of typed commands. There's a netlist generation step between schematic editing and board editing, so going back and forth between the two isn't as straightforward as it is in Eagle.

[1] If you're used to Eagle, this may blow your mind: [https://www.youtube.com/watch?v=C02D0_kNQeM](https://www.youtube.com/watch?v=C02D0_kNQeM)

<comment><USER13> Can you comment on the situation with component libraries for kicad? How does it compare to Eagle?

I've recently tried Fritzing but keep finding that some components aren't available. Defining my own is kind of tedious.

<comment> TD-Linux I generally end up using an online tool [1] for high pin count parts. It's not the best though, someday I will write something better.

BTW, in most professional contexts, parts are all created by the engineer - vendor part libraries are pretty rare. I know Altium is trying to change that, maybe soon we will see something similar happen with KiCAD.

[1] [http://kicad.rohrbacher.net/quicklib.php](http://kicad.rohrbacher.net/quicklib.php)

<comment><USER13> Thanks for the link: very useful!</comment></comment></comment></comment></comment>


Why you should sell open source software - <AUTHOR> http://luminotes.com/blog/why-you-should-sell-open-source-software

<comment><USER2> The biggest problem with open-sourcing commercial software is the risk of a blatant ripoff.

Some entrepreneurial spirit _will_ come along, replace the application icon, repackage the whole thing and start selling it as his own. Perhaps just in his own country, perhaps you won't even notice, but it will eventually surface and you will need to deal with the situation. Now the question is if you want to spend your time and nerves on resolving the issue or would you rather continue working on the product. _Especially_ if you are a "lone programmer" and especially if opening the source doesn't give you much to begin with.

<comment><AUTHOR> Let's say this happened, and someone in a random foreign country made a clone of my software and started selling it there. Would that really cut into my sales? Or would that perhaps increase the legitimacy and recognition for the type of software I'm selling, if not for the specific brand I'm hawking?

<comment><USER2> It has less to do with cutting into your sales, and more with jeopardizing your IP and ownership rights. If this sort of theft is left unattended, the other side may start asserting its non-existing rights and escalate the situation.

It all really comes down to the risk tolerance. Opening the source establishes great deal of a goodwill towards your customers and potentially provides you with an access to free improvements and bugfixes. On other hand it opens you to the risk of needing to actively protect your IP rights, which is something that not everyone want or can do.

That's not even getting into how emotionally draining these incidents can be. It requires a really thick skin and a strong ability to ignore being taken an advantage of. Again, not everyone's traits.

<comment><AUTHOR> If the source is open, then anyone who bases a product on it has to abide by the license. Are you talking about the case of someone who downloads the source, and bases a derived product on it without abiding by the license and releasing the source code? Can't illegal distribution happen with closed source software as well? Or are you saying it's more likely to happen if the source is open, and therefore more of a potential headache?

<comment><USER3> If the software is behind the companies web server they can do what they wish (at least before gpl3).

<comment><AUTHOR> That's very true, although AGPL does fix that now.

</comment></comment></comment></comment></comment></comment><comment><USER4> Witten actually gave me quite a bit of advice on open sourcing my application, and he mentioned quite a few of these points. I think there might have been some additional benefits as far as marketing/legitimacy are concerned that he might have mentioned, but he makes a good case for selling open-sourced software.

Depending on your market, only a small minority are driven to invest the energy (time is money) required to get no-cost software - paying someone to have a ready-to-go package is simply more efficient.

<comment><USER5> I believe he misses some important points:

(1) The core problem are professional "free-riders" -- Linux distributions being the main candidates. As soon as they include his software in their repositories, his sales will probably stop to increase.

(2) For Linux distributions, it's also hard to make ready-to-go packages. Looking at his download page, there's no sign whether his package installs properly. Can I even use it? Is it RPM or DEP? Or some sort of .run package that needs to be made executable, first?

(3) Expensive software is unlikely to be sold under an Open Source license: think dental office billing systems, for example. Everything more expensive than, say, $25 will make people get the software elsewhere or use the source.

Nevertheless, I agree that selling open source software may provide some benefits for the seller.

<comment><AUTHOR> 1\. I've actually considered not charging for the Linux version and only charging for the Windows and Mac versions. From a cultural perspective, Linux users simply don't buy software. No value judgment there, but simply a statement of fact. (I'm a Linux user myself.)

2\. I don't yet have official packaging yet for Linux, but I plan to start with Ubuntu and Debian debs when I do. Right now it's just a tarball.

3\. You're probably right that expensive software is going to be a harder sell when the source code is available for free. When I wrote the article, I had end-user software in mind, which generally isn't that expensive.

<comment><USER5> Sorry for the misunderstanding. I thought you meant selling open source, in general, not just to end users.

You know, I'm glad you submitted your post here. I'm currently working on an article about a similiar topic. The discussion has been very helpful.

Would you mind if I contact you directly using your support E-Mail adress? I'd be really interested in your feedback.

<comment><AUTHOR> No problem. You're welcome to email me.

</comment></comment></comment></comment></comment><comment><USER6> One interesting point to note it is certainly not an issue to sell the source to your program in a bundle with the binaries, allowing enterprising hackers to modify and update the software. You could even allow distribution of these changes.

Allowing this doesn't mean that you are forced to give up copyright on the source, or release it under an open source license. A license that says "You may have, modify, and distribute modifications to the source, but not duplicate or redistribute it" is certainly something that I would find interesting, and would love to see more software released under.

<comment><USER5> You may like to look at the license used by TheKompany [1].

[1] <http://www.thekompany.com/products/licensing.php3>

</comment></comment><comment><USER7> Doesnt Pascal's wager type of argument apply here? Opening the source has very little benefit in most cases while opening the source presents a very real danger of clones.

<comment><USER8> Pascal's wager only applies if you simultaneously discount the benefits of having contributors and play up the risks of clones. This seems backwards to me; it would take much less effort for someone to contribute to your project than to fork a new one. As such, you should get more contributors than competition.

</comment></comment><comment><USER9> I think this is a fantastic idea, but aren't you worried that someone will take your source code, launch a clone, market it well and make a billion trillion dollars?

<comment><AUTHOR> I suppose it's possible, but pretty unlikely.

But let's say it does happen. I'm still the foremost expert in the world on this particular piece of software. Chances are I can develop it faster and better than anyone else. (This isn't to say that I'm a really good coder -- I'm not. It's just that I wrote this software and understand it very well.)

Now, you brought up marketing, so I suppose in this hypothetical example, someone could clone the product, rename it, and just concentrate on marketing rather than development.

Well guess what.. Anyone can do that anyway even without the source code! Most web-based software is fairly easy to clone. Having the source code just makes that a little easier.

</comment></comment><comment><USER10> Since your product seems to be coded in python the source is kind of "open- source" already isn't it? Also its not the commercial competitors that will screw you, the real danger is if someone will find your project interesting, disagree with some small thing, fork it and release it as a new free open- source product, get a few more people interested to contribute so you as a one-man-shop can't keep up and thereby replace your product with a _real_ open-source product. Heck, I'm almost tempted to copy your repository, do some simple query-replace and put it up on google code just to make a statement and see how you turn-coat and will start complain and whine in your next blog post.

<comment><AUTHOR> I could very well strip all comments and distribute just pyc files. Those can be reversed to commentless source, but it's not exactly as useful as the original source code. And honestly, anyone could clone the product just fine even without the source code.

If you really want to fork the project, go for it. That's within your rights as per the GPL license. Just as long as you continue to abide by the license yourself. If your fork turns out to be better than my code, and more people end up using it, then you probably deserve any users you "take away" from me.

If, on the other hand, you're just forking the code to be surly, then that's within your rights too.

</comment></comment><comment><USER3> The biggest thing you are missing is that it potentially limits growth. Most entrepreneurs I know want to create wealth far and beyond what you can make with a small business. You are much less likely to do that with open source, as you either have to scale service (e.g. people, your costs increase linearly as revenue increases) or compete on price (as you get more popular, your margins decrease as the market becomes more competitive) while maintaining the product.

I'd like to hear from some people with a 10-50M sales revenue (not service) product per year who have made the switch, or considered it. Somehow I can't see it happening.

</comment><comment><USER11> A smart thief may exploit a bug (buffer overflow etc) in closed source banking software system and siphon away funds. This may continue till someone from the bank or the software company notices this bug.

</comment><comment><USER12> In most cases, the big question is...

 _Why should you buy open source software_ (assuming the source is freely available)

<comment><AUTHOR> Because for end-users, it's more convenient than building the software from source.

<comment><USER13> I'm using a lot of open source software which I didn't build myself from source. That's what distributors are doing. It seems to me you are selling the additional service of building the software. I guess it might work because you also got the name - people who know it want to get it from you.

</comment></comment></comment><comment><USER14> "In other words, if you decide to make your end-user software open source, most of your users probably won't even notice!"

So, why do it then? The two points made by this article don't really motivate me.

1) "Selling closed source software is roughly analogous to selling someone a car with the hood welded shut."

First of all, we are not selling cars. Software is sold more like an HDTV, dvd player, mp3 player, etc. How many of those products really make it easy for you to fix it yourself? The answer is: It doesn't matter. These are throw away products. If it stops working for you, buy a new piece of software or an upgrade.

Don't give away your product just to please a couple of gear-head customers that can code.

2) "Your source code,...is very likely completely uninteresting to almost everyone else."

This is such a bullshit statement. The fact is that while my source code may not be that special, it's ALREADY DONE. If I don't open source it then potential competitors have to spend the time to get to where I am at.

<comment><AUTHOR> 1\. It's a rough analogy as I said, and honestly I don't think either the car analogy or the consumer electronic analogy is a good one. Most software is not a commodity, and unlike a DVD player, if it breaks you don't just go out and get a new one. At the very least you fix it so you can figure out how to get your data out of it. And of course, software isn't exactly a physical thing, either, so both analogies break down even further.

2\. Any legal competitor who uses your source code will have to abide by the exact same open source license (unless it's BSD), meaning that you can incorporate any improvements they make directly into your original product.

<comment><USER14> 1\. I agree that both analogies break down. However, my point stands: Just because a consumer can't fix a product themselves doesn't make the product inherently evil or bad or anything like that.

2\. Okay, but that doesn't really address my point. If you don't open source the software in the first place then there are less potential competitors and therefore more potential money for your business.

Look at how well Salesforce does against SugarCRM. Which one do _you_ want to be?

<comment><AUTHOR> 1\. All morality aside, you can decide to open source or not based on simple cost-benefit analysis. Will your customers be more likely to make the purchase if the source is available? Will you get more contributions and goodwill if the source is available? If the answer to both questions is definitely no, then I think you have your answer for your particular product.

2\. I don't think it's as simple as saying there are fewer competitors if your product is closed source, and therefore more money for you. If all your competitors base their product off of yours, then you have a strong case to make (to your prospective customers) that you are the market leader and everyone else is just a wannabe follower.

And even with more competitors, that doesn't necessarily mean you're losing out on sales. Competitors can also expand markets, increase awareness/legitimacy for the type of product you're selling, and as I mentioned, improve the product if it's open source.

In regards to Salesforce and SugarCRM, I'm not familiar with the product space. But I assume you're suggesting that in that particular case, Salesforce is more successful, and therefore closed source is preferable. That may be the case with those particular products, however there are a lot of factors that go into running a successful company beyond whether the source code is freely available.

<comment><USER14> I agree that for a single developer, open sourcing a product can be very good. You get peer recognition and probably some job offers. But I bet those job offers come in from places that make closed source software.

For businesses, the risk associated with closed sourcing your app are finite and simple:

1) The people that want source code with their app won't buy it. As was said in the article "not that many people will even notice", so it's not a lot of people.

2) You lose out on _possibly_ getting some work done on your product for free.

It seems to me that there are more and larger risks associated with open sourcing your app:

1) Lower bar to entry for competitors. 2) Definitely losing sales to customers with IT departments that know how to compile source code. 3) Possibly losing control over your own creation. 4) Fragmentation - IMO Linux would be better and more popular if there weren't so many distributions.

<comment><AUTHOR> Just to look at one of your points..

> Definitely losing sales to customers with IT departments that know how to > compile source code.

Quite possible, but I can say that I've gotten some of my best and most valuable feedback from these sorts of "customers". They don't pay me a cent, but they provide me with really good feature requests and bug reports.

Now you might argue that if the source was closed, I could get the feedback _and_ the sale. Perhaps. But perhaps the savvy IT departments only install open source or freely available software.</comment></comment></comment></comment></comment></comment>


The Long Way Round: The Story of the California Clipper - <AUTHOR> http://lapsedhistorian.com/long-way-round-part-1/ <comment><USER2> I made a map with the route and all of the stops: [https://www.google.com/maps/d/edit?mid=z4kMRHXgBTVs.kq8lQ1TU...](https://www.google.com/maps/d/edit?mid=z4kMRHXgBTVs.kq8lQ1TUItqo&usp=sharing)

<comment><USER3> Ha, nice work. It definitely helps one appreciate how long "The Long Way" really was.

</comment></comment><comment><USER4> I have a soft spot for seaplanes. The Sunderlands flew out of Pembroke Dock in West Wales during World War II, protecting convoys and hunting German submarines in the Atlantic and Irish Sea.

They apparently had a very distinctive sound to their engines, something that my grandpa likes to reminisce about.

Although the "source" is the Daily Mail (I apologise) the content itself is quite interesting, concerning the location and partial raising of one of the Sunderlands that was ditched during the war, amazingly the location directed by a member of that very air crew: [http://www.dailymail.co.uk/news/article-2523196/WWII- Sunderl...](http://www.dailymail.co.uk/news/article-2523196/WWII-Sunderland- flying-boat-raised-seabed-65ft-waves.html)

</comment><comment><USER5> downright crazy story. But then the war was full of them.</comment>


MS Word Can't Deal with Universal Compaction - <AUTHOR> Perhaps not in a sense you expected, but in MS Word writing http://anything/Universal-Compaction and pressing enter (to convert to a link) utilises full CPU core until part of the link is deleted. Specifically MS Word can't handle "Universal-Compaction" in a link. <comment><USER2> what version. doesnt eat my cpu here.. (2016)</comment>


Rails 2.0: Release Candidate 1 - <AUTHOR> http://weblog.rubyonrails.com/2007/11/9/rails-2-0-release-candidate-1

<comment><USER2> heh. I was going to learn rails, but after reading a blog post somewhere, I figured why do something in rails that I can just do in PHP.

<comment><USER3> Because Ruby is a better language than PHP.</comment></comment>


Lazlo DB: Portable, compact and serverless nosql database - <AUTHOR> Lazlodb is a NoSQL database created using Node JS & MessagePack. It is specially created for portable devices, to maintain their database in the device storage. Repos : https://github.com/zaygozi/lazlodb | https://github.com/zaygozi/lazlo-node NPM : npm install -g lazlodb  |  npm install lazlo-node <comment><AUTHOR> [https://github.com/zaygozi/lazlodb](https://github.com/zaygozi/lazlodb)</comment>


REST – Epic Semantic Fail - <AUTHOR> http://mikehadlow.blogspot.co.uk/2012/08/rest-epic-semantic-fail.html? <comment><USER3> He's got some good points about how people talk about REST and how it's not a protocol.

But then there's this:

 _If I want to write a client to communicate with your REST API I'm in a world of pain; there's no serviceutil I can point at your API to generate me a proxy, instead I have to carefully read your documentation (if it exists) and then lovingly handcraft my client using low level HTTP API calls._

I would infinitely rather use a well-documented HTTP+XML/JSON/clojuredata protocol. The thought of code generation based on WSDLs still makes me feel a little ill even though I haven't done it in years.

<comment><USER4> Is there a consensus on why the SOAP/WSDL business sucks? Is it just a lousy bloated implementation of a potentially good idea or it's the whole idea that's misguided/unrealistic/foolish?

<comment><USER5> I'd like to know too. There are a lot of people here rubbishing SOAP without explaining why. I've consumed, simultaneously with hundreds of other developers from disparate teams, 100s of SOAP services across a number of financial institutions and any issues I ran into had nothing to do with SOAP. Generating code with SvcUtil is great and does what it's supposed to - <USER2> nothing stops you from refining it or writing your own service clients.

I don't need to run service calls from the command line - I have version controlled integration tests that I right click on and select "run", as should every major consumer of serious services.

I don't believe SOAP web services are always the way to go (I've never used any in my personal projects, preferring my own web API and/or a service bus), but that doesn't mean it's not suitable for other problems.

What's often missing from these debates is defining what environment you're operating in (legacy and dependant systems/platforms/interfaces, network architecture, how much architectural control you have, user load, number of developers, number of teams, release cycles, politics [what was the last big budget item that was purchased to solve the current problem], timelines etc.). Once you start identifying the environment details, some of the simplistic unqualified suggestions people make in these debates seem naive and ridiculous.

<comment><USER6> SOAP is fragile, bloated and slow. It goes against what the very essence of a service should be, i.e. to expose functionality in as accessible and inter- operable way as possible. The higher up the WS-* stack you go, the less supported it becomes - eventually only the Big Enterprise frameworks from MS and IBM support the complete WS-* stack.

WSDLs promote code-gen and as different SOAP frameworks have varying levels of WSDL support, you often end up with broken + ugly code-gen when trying to consume from different SOAP stacks. SOAP is also a brittle format where even a small namespace change can break the entire request, this makes versioning (a core part of evolving services) extremely difficult.

I generally prefer clean HTTP APIs with Cool URI's and JSON which is a much faster, smaller, more versionable and tolerant format that provides a better programmatic fit than SOAP/XML: <http://www.infoq.com/presentations/Heretical- Open-Source>

</comment></comment></comment></comment><comment><USER7> I think it's easier to understand his argument when you think about the problem at scale. Consuming one API is meat and potatoes to most of us; with decent documentation and the REST style largely being followed, API clients can be created rather quickly.

However, if I asked you to consume 1000 "REST" APIs, this becomes problematic. There is no agreement on representation, nor is there metadata available to infer commonalities.

So what have people done? They've tried to introduce solutions from other "protocols". As mentioned in the article, HAL attempts to introduce a predictable envelope around the data, using links and embedded resources to become so HATEOAS friendly.

However, there still are holes. How do I know what to do with links? The rel can tell you only so much - back to the documentation we go. How about we introduce a rel to a schema, like XSD, WADL or JSON Schema? Not many have done that and even fewer enjoy working with them.

How about knowing if I can PUT or POST to one of these links? Well the API could support OPTIONS request, but does this suit your data intensive mobile app consuming the API? Not too snappy. We could list them out individually in the representation (thereby replicating the HTTP design through representation) but now the size of the representation is growing dramatically just to support metadata that rarely changes.

OData, GData and even CMIS have all tried to take a stab at data communication protocols. Yes, they bring solutions to some of these issues at the cost of complexity and verbosity. Plus, they use use discovery endpoints. And they still tend to fall back on XML over JSON because of use of Atom etc. And now we are halfway back to SOAP.

How about the versioning issue? Should client be aware of representation structure changes and adapt accordingly? Well WRML (<http://www.wrml.org/>) tried to take that one on and all the best to you if you read that through once and understand it, never mind implementing the actual clients and servers.

As ori_b summarized "REST isn't a protocol, it's a protocol pattern". REST can't fit all scenarios. But I think what's becoming clear is that no-one has found anything better, just more specialized. So the days of auto-building clients to consume APIs is far away.

I guess we'll just have to embrace the chaos and keep building snowflakes.

</comment><comment><USER8> His whole argument can be distilled down to "REST isn't a protocol, it's a protocol pattern". True enough, but I'm surprised that this is news to anyone working with REST.

Edit: I said "API", should have said "Protocol"

<comment><USER9> Actually I thought his whole argument was down to "REST isn't a protocol the way HTTP is a protocol" -- look the "P" stands for "protocol" -- which (a) is true in some specific technical sense, and (b) isn't important.

I quote: "This style has no agreed protocol." and "The core missing pieces of any RESTful web service protocol are agreed standards on media type and link metadata." OK, so what?

<comment><USER10> > OK, so what?

Well, when you try to fill in the blanks you get one of these:

1) AtomPub, which is a relatively simple protcol but has very limited application

2) oData/WSDL, which are powerful but complex

</comment></comment></comment><comment><USER11> Here's what Roy Fielding himself has to say: [http://roy.gbiv.com/untangled/2008/rest-apis-must-be- hyperte...](http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext- driven)

And here's his presentation on the topic: [http://www.slideshare.net/royfielding/a-little-rest-and- rela...](http://www.slideshare.net/royfielding/a-little-rest-and-relaxation)

A common REST debate is "When to use POST?". His thoughts on that: <http://roy.gbiv.com/untangled/2009/it-is-okay-to-use-post>

</comment><comment><USER12> REST's protocol is HTTP. REST isn't an API, but you can create RESTful API's.

Yawn.

Edit: The first three sentences on the Wikipedia article are all you need to know. <http://en.wikipedia.org/wiki/Representational_state_transfer>

<comment><USER13> REST's protocol is not HTTP. Quoting the very page you linked:

> REST was initially described in the context of HTTP, but it is not limited > to that protocol.

</comment></comment><comment><USER14> This parallels the beliefs of someone I know, who's working on providing an answer to this in a true REST framework, complete with meaningful links, extra metadata, etc. It's a WIP, but I'm sure he'd enjoy the conversation if others are interested. <http://www.wrml.org>

</comment><comment><USER15> So we HAVE the Google Discovery Service [1] that would be awesome if it could be used with other than just google's APIs.

[1] <https://developers.google.com/discovery/v1/getting_started>

</comment><comment><USER16> So he wants to turn REST into SOAP? Personally, I'll pass on that. REST is agile. REST is not about a ponderous, verbose, bloated specification for 5 things I want to do an 50 other things I don't need but have to take with it.

<comment><USER17> "It seems like I've been rubbishing the whole 'REST' project. Actually I think the current situation is healthy. Monolithic 'enterprise' protocols like SOAP usually end up being a bad idea."

</comment></comment><comment><USER18> I'm not so sure the OP's argument is substantive. I don't know whether Roy intended that his architectural style, described in his thesis, to become a loosely defined web service 'protocol', but we're not really making everything up as we go along. A well-implemented REST API is far and away simpler to understand (and easier to use) than a SOAP counterpart.

<comment><USER19> That's a bit of a false dichotomy though. SOAP is a giant turd, but it's not the only alternative out there. JSON-RPC is just as easy to understand as REST, without all the pedantry.

<comment><USER20> One advantage of REST, I don't know if it's especially meaningful in this context, is that RPC mechanisms encourage people to think of remote calls as local, but remote calls have a lot more failure modes than local ones do. REST keeps you aware that you're dealing with remote resources the whole time.</comment></comment></comment>


Several Horror Stories about the Encrypted Web [video] - grey-area https://www.youtube.com/watch?v=bi3SA6jgIZ8 <comment><AUTHOR> 1\. There are too many CAs

2\. so let's create another CA!

The transition here was weird.

Also, there are now a HUGE number of certs signed by let's encrypt. Isn't that a problem? Remember Comodo now too big to get removed?

I guess let's encrypt cannot sign intermediate CA certificates and that's a good thing, and we should have more CA like that and less CA like Comodo. Also if they are free (I still find it mindblowing that you have to pay for certificates) and are quick to implement/respect new rules directed by the cabforum. Then it is an improvement of the current internet PKI.

Now what about better/other solutions to secure internet? I'm still scared of having to trust thousands of CAs that all have the same power.

<comment><USER2> > I still find it mindblowing that you have to pay for certificates

You pay for the CA to verify you are who you claim to be.

<comment><USER3> But who verifies that the CA is who they claim to be?

Or is doing what they claim to do?

Maybe they've been hacked, or infiltrated, or sold out, or ...

If I'm American, do I trust Chinese CAs? Or _vice versa_?

<comment><USER4> Presumably this is the job of browser vendors.

</comment></comment></comment></comment><comment><USER5> This is actually a great letsencrypt.org intro. Too bad it's not labeled that way here or on youtube.

<comment><USER6> Yeah, I suggest them changing the title to something that says it's letsencrypt. Had I not glanced here, I'd have totally skipped it thinking it was some scare tactics from security industry or government to push their agendas with.</comment></comment>


Ask PG: what happened with SkySheet? - <AUTHOR> They were part of the Winter 2009 group and were working on a web-based spreadsheet service.  The website (http://www.skysheet.com/) suggests they haven't launched yet, and there's very little information available regarding current progress. <comment><USER2> Good grief, I'm on HN this much and miss it when someone posts about my own startup?

Skysheet is alive. It's taking so long because it's hard, yet mysteriously doable, so (assuming sufficient stubbornness) there is reason to keep going.

There's little information because we don't want to let the 'talk' part get ahead of the 'show' part--not out of stealth, really, it just feels like the right way to be. But if anyone has questions, I'm happy to answer.

</comment><comment><USER3> Given the founders now work at different companies I'd assume it's dead.

<comment><USER4> What makes you think that? Daniel Gackle posts here all the time, and last time I talked to him he was still working on it. Some projects take a lot longer than others, and his was particularly ambitious; it wasn't Google Docs.

<comment><USER3> Vlad (the other cofounder) now appears to work for ZestFinance according to Linkedin. Daniel's profile is private on linkedin but doesn't show Skysheet in his headline (which I believe it used to).

Startups can survive once the founders have moved on to working on something else full time, but in practice the survival rate of such startups is tiny.

<comment><USER2> No, it's just that Daniel can't be bothered to deal with LinkedIn. I did just go and change the headline, though. Or tried to—they don't make it easy!

Vladimir worked with me on an early incarnation of the program but left before we incorporated the company or applied to YC. He's very good.</comment></comment></comment></comment>


Should an International Climate Crimes Tribunal Be Established? - <AUTHOR> https://www.oxfordresearchgroup.org.uk/blog/should-an-international-climate-crimes-tribunal-be-established <comment><USER2> International Scientific fraud tribunal should be established:

Anybody pretending to do science but can't provide models that make accurate predictions is jailed.

Are you climate "scientists" alright with this?

<comment><USER3> Who are you referring to?</comment></comment>


Proton.B: What this Mac malware does - open-source-ux https://www.cybereason.com/labs-proton-b-what-this-mac-malware-actually-does/ <comment><AUTHOR> _" Dialog boxes asking for passwords are a very popular social engineering tactic designed to trick users into giving attackers their passwords"_

Apple is extremely guilty of normalizing the frequent entry of passwords. I recently reinstalled a Mac and an iPad, and for each device I must've entered my Apple ID password seven or eight times. in the normal course of getting things done I then enter either this, or my local login password, many times a week.

When your password is twenty characters of line noise or an extended passphrase this is thoroughly irksome, especially on virtual keyboards like the iPad. It is no surprise to me that less security conscious folks, faced with this onslaught of excessive credential demand, choose shorter i.e. easily cracked passwords; and no surprise that everyone becomes less suspicious of the sham password dialog.

So when reading of yet another photographic burglary from a cracked iCloud account, we should always lay part of the blame at Apple's feet, for systematically normalizing the frequent entry of credentials.

That is not the end of Apple's social engineering enablement shame. Another glaring blunder is in Apple Mail, where the "To:" field is shown with your real name, even when the sender did not include this. The humans respond positively to the use of their given name, so this heightens the verisimilitude of scam messages.

<comment><USER2> Yup. My Apple password is one of the very few remaining ones that isn't a random string generated by 1Password because Apple makes me enter it all the time. :(

<comment><USER3> "For your protection".

I agree, the number of times per week that I somehow end up entering my Apple ID password is egregious. Couple that with the abysmal iCloud/Apple ID/iPhone number conflicts that inevitably show up when you have more than one device. I've spent more hours than I care to remember working on my parents' devices fixing glitchy synchs.

</comment></comment></comment><comment><USER4> The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is _impossible_ for nefarious apps to replicate.

<comment><USER5> On Windows NT you had to press Ctrl-Alt-Delete at the login prompt because that was a key combination that no other application could intercept. Nowadays you work as a non-privileged user but then you have to enter your admin password in various dialog boxes with no way of knowing if its legit (sometimes ubuntu shows you an ugly-looking (i.e. wrong styled) gtk input dialog during updates. But only sometimes. Thats very confusing.).

On the other hand, each desktop application should be able to request root access. And if you trust these applications (e.g. handbrake on macos) you wouldn't bother to press Ctrl-Alt-Delete or do whatever else it takes.

Any good solution for that?

<comment><USER6> "Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions.

But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the "fake" Handbrake would not have been signed, and blocked by SmartScreen. (They could get a signing cert, and use that, and aware users would have to know it differs...)

I still think the safest way is Windows XP style. Applications do not get root. You cannot give them root. Things that require an administrative password have to be done under the administrative account.

<comment><USER7> That's what I always wondered — why it's hard to fake UAC? Surely I can create a full-screen application which won't give away focus with alt-tab (that's very frequent behaviour with bad games).

<comment><USER8> One software I was/am still working on has an onscreen display(clear always top window ) so I can draw icons and text over a game, it's a pain to alt-tab out of(due to me setting it to constantly check to see if it's ontop, and if not, to set it).

So I would say that it's certainly possible, although I haven't tried specifically to do that to emulate UAC.

Edit: Infact I had a bug at one stage where if I closed the main window, the invisible window would remain running, with no entry in the start bar.

Now I'm becoming a little more concerned, as I could also listen for hotkeys, (such as Ctrl alt delete) and display my own 'secure login' page. Shit

<comment><USER9> Listening for these hotkeys is kind of pointless. The whole idea of pressing Ctrl + Alt + Del is that, while you can detect the keys being pressed, you cannot prevent Windows to display its interface _on top of yours_. See [https://en.wikipedia.org/wiki/Secure_attention_key](https://en.wikipedia.org/wiki/Secure_attention_key) That's actually a good mechanism that should be brought back to all modern OS. I wish Android had something similar (well, available physical input keys are limited, but you get the idea)

<comment><USER8> I would like to hope so, I haven't tried intercepting something like that(I just listen for certain keys), I do wonder if someone more experienced than me could listen for Ctrl and alt, then intercept the delivery, and display their own. (I would 'assume' the system gets first dibs on any keypress, but what if you listened for Ctrl and alt then used a sendkey to upkey the Ctrl and alt, and detect a del key press and then display a fake).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website:

 _HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: [https://github.com/HandBrake/HandBrake/wiki/Checksums](https://github.com/HandBrake/HandBrake/wiki/Checksums)

The Affected Download mirror (download.handbrake.fr) has been shutdown for investigation.

The Primary Download Mirror and website were unaffected.

Downloads via the applications built-in updater with 1.0 and later are unaffected. These are verified by a DSA Signature and will not install if they don't pass.

Downloads via the applications built-in updater with 0.10.5 and earlier did not have verification so you should check your system with these older releases_

<comment><USER11> It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

<comment><USER12> This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so: <a href="..." integrity="...">

<comment><USER11> How does the browser know what hash algo to use?

<comment><USER13> [https://hacks.mozilla.org/2015/09/subresource-integrity- in-f...](https://hacks.mozilla.org/2015/09/subresource-integrity-in- firefox-43/)

 _" As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."_

</comment></comment></comment></comment></comment><comment><USER14> I'm intrigued and curious about why they download your 1Password databases…

I wonder if that's speculative - or if offline bruteforcing them works often enough for it to be worthwhile for the malware authors?

<comment><USER15> They have all your saved passwords from your web browser, too, and your mac user account's password. I'd guess there's a reasonable amount of people who re-use at least one of those as their 1password master password.

</comment></comment><comment><USER16> Mobile OS security models are bound to land on the desktop soon-ish. What does any random App have to do with anything in ~/Library that is not its own Application Support or .plist preferences?

To be honest I don't mind if all Apps are sandboxed with the exception of a couple "user super-user"; I don't really care if my machine's root account is secure if all my horses sitting in $HOME are let loose on the net.

</comment><comment><USER17> This Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website.

Doesn't fix the root cause, but could have caught it much sooner.

<comment><USER18> Does anyone actually do that? And what if you have a million files? And what happens within that 30 mins? I guess you could download and check your million files once ever 30 seconds...

<comment><USER17> Well, you would just check the final download dmg/iso file, and only do it for the first n-versions or so (since those will be the most popular.) The other ones can be checked too, but at a much lower frequency.

</comment></comment></comment><comment><USER19> I have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing.

      $ brew cask install handbrake
      ==> Satisfying dependencies
      complete
      ==> Downloading
      https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg
      Already downloaded:
      /Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg
      ==> Verifying checksum for Cask handbrake
      ==> Installing Cask handbrake
      ==> Moving App 'HandBrake.app' to '/Applications/HandBrake.app'.
      handbrake was successfully installed!

<comment><USER20> Homebrew updated their hash to the infected one (differing from the Handbrake download page!), so people who installed using Homebrew got infected too. Do NOT trust homebrew.

[https://news.ycombinator.com/item?id=14282116](https://news.ycombinator.com/item?id=14282116)

</comment></comment><comment><USER21> >The malware obtains the time and date by creating a new environment variable called $hcresult that contains what's being returned by sending an HTTP request to the Google hosted link by executing this command:

>curl -sL [https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb...](https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRbyzS4qMq1VucMVgVvhul5XqS9HkAyJY/exec)

What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts on there? What happened to googleusercontent.com?

<comment><USER22> Looks like its getting the _current time_ from the json response. How _dare_ Google distribute the _current time_?

<comment><USER23> The parent comment isn't talking about the payload being returned, it's about what domain Google is hosting user content on.

<comment><USER24> The response from script.google.com is a 302 redirect to script.googleusercontent.com. IOW, google.com itself does not serve that user content.

<comment><USER25> But why does Google redirect that? Why not just return an error?

It's not like users will accidentally type in script.google.com and get mad if it fails. Those script URLs are being used only by app developers, who will test their apps and fix script source URLs that are broken. Calling a googleusercontent script at google.com should return a 4xx status code telling them to use the googleusercontent domain.

Google.com is a trusted domain. I don't think it should be 302'ing to untrusted domains for arbitrary URLs.

<comment><USER22> >Google.com is a trusted domain. I don't think it should be 302'ing to untrusted domains for arbitrary URLs.

I think you should read this again and then take a moment to think about the services people primarily visit google.com for.

Also, what exactly are "trusted domains"? Why do they matter to users clicking links?

On a website there's no way for an user to verify where a link is going to take them without actually clicking the link. The tooltip for example tends to be relatively easy to spoof.

</comment></comment></comment></comment></comment></comment><comment><USER26> Ive got handbrake saved in my users application folder

So i ran the following in terminal

COMMAND : `cd /Applications shasum -a 1 HandBrake-* && shasum -a 256 HandBrake- _`

and got this response which seems to be blank.. any ideas wether this is saying that i have an infected file or if ive just run the initial terminal command wrong ?

RESPONSE : `shasum: HandBrake-_: Sams-MacBook-Pro:Applications Sam$ `

<comment><USER27> You run it against the DMG not the app.

</comment></comment><comment><USER28> > _Note: The domains in red were not registered at the time of my research, > although they were registered last night by an unknown entity. They seem to > be back up domains in case one of the first two stops working._

Or they could be domains for checking if you're in a sandbox like WanaCrypt. Why wouldn't you just use 20 well known domains otherwise?

</comment><comment><USER29> Why were they going after 1password filevaults? I assume 1password is like keypass, where all your passwords are in an encrypted file? How could they decrypt all those files? Or do they assume people use weak passwords?

<comment><USER30> According to the article this malware also does keylogging. So, presumably, they'll have the vault password as well.

<comment><USER29> Derp

</comment></comment></comment><comment><USER31> Is there a good virus scanner for OSX?

<comment><USER32> There are no good virus scanners – that is a general issue, not a Mac OS- related one.

</comment></comment><comment><USER33> Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.

<comment><USER34> "scan everything before opening" is not always desirable as it exposes a large attack surface:

[https://bugs.chromium.org/p/project- zero/issues/detail?id=12...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1252&desc=5)

<comment><USER35> "Avoid running your scan with elevated privileges" could have greatly mitigated this failure.

> NScript is the component of mpengine that evaluates any filesystem or > network activity that looks like JavaScript. To be clear, this is an > unsandboxed and highly privileged JavaScript interpreter that is used to > evaluate untrusted code, by default on all modern Windows systems. This is > as surprising as it sounds.</comment></comment></comment>


Is there any value in just writing HTML and CSS? - <AUTHOR> https://firstname.lastname@example.com/is-there-any-value-in-people-who-cannot-write-javascript-d0a66b16de06 <comment><USER2> I don't understand why the author is so surprised about the reaction of her audience, who would not hire someone who just does HTML + CSS. In particular, I totally disagree with this paragraph:

> I understand the desire to have people who can do a lot of things. What I > don't understand is why it's okay if you can "just write JS", but somehow > you're not good enough if you "just write HTML and CSS".

_Writing_ JavaScript is programming. Writing HTML and CSS is not. Programming is several orders of magnitude harder than writing markup languages. Most of the time HTML and CSS are just tools to show the results of something else, they're auxiliary technologies, just like XML. You wouldn't hire a _XML & DTD writer_, you expect a programmer to know (or have heard of) XML.

Anyone who blindly and directly compares "Just writing JS" with "just writing HTML and CSS" is short-sighted.

<comment><USER3> > _Writing_ JavaScript is programming. Writing HTML and CSS is not. > Programming is several orders of magnitude harder than writing markup > languages.

Hey, let's be fair here. I'm a great programmer, but I can't design worth beans. They're totally different skills.

<comment><USER4> But I bet you can render data out using html snd given a design you can get that html reasonably close with just some sweat and little stackoverflow trips.

<comment><USER3> I'm not a code monkey, and neither is a designer. "Given a design" is the begging the question part. Who's design? Probably someone who only knows HTML and CSS.

<comment><USER5> Or probably Adobe or Corel suites (or open source equivalents) and the limitations of website design. Not even the languages themselves.

You still need someone to translate it into a website. Whether they can handle JS is secondary.

</comment></comment></comment></comment></comment><comment><USER6> Our company hired a guy who literally just wrote CSS, and it was an awesome hire.

He had instinct for how the layout engine will do best, how to make really clean and reusable structures, how to get smooth animations running. This instinct was totally infectious. It had an impact on our culture around CSS (taking it seriously and doing it right the first time) in the same way that having someone who really knows logging, or concurrency, or db transactions, can really make an impact if they're there near the start.

Along the way lots of people assumed he knew JS, which if anything probably enforces the article's point. But before us he was just a smart guy whose side projects involved reskinning CMS sites and making cool CSS animations.

After a year of avoiding it he did start writing JS, and being honest, our app is pretty unique for needing that much love at that level — A year of time just doing structural, design, and layout changes is totally not warranted, almost anywhere.

However, I think there _is_, often, a false hierarchy that tends to build up among developers, where somehow, all server work >>> all JS programming >>> all design thought. This cultural "legitimacy" ranking, at best, leads to people letting horribly incoherent styling pass code review without a second thought. At worst it means high turnover in the people at the "bottom" of that totem pole who feel disrespected. As someone who spends 80% of his time on the server side I think this is an important bias to be aware of.

</comment><comment><USER7> I've worked with a number of brilliant UI/UX designers who use CSS+HTML as tools. But I don't think you can expect proficiency in a few tools alone to make you valuable.

It's kind of like saying, "I'm skilled with calculators." Vs. "I'm a mathematician."

The full-time UI/UX designers I've worked with in my last few jobs have never meaningfully wielded JavaScript to do their jobs. In some cases there's a little hacking for prototypes, but never any production coding.

<comment><USER8> Do you think it's a bottleneck for them to not understand JS? What they design and produce using JS (mockups and prototypes for testing) won't be passed on to production anyway. Or do you have a different experience?

<comment><USER7> The bottleneck we experience is that we lack design capacity to keep up with our engineering capacity. Thus is the plight of a startup I suppose, maybe? Obviously I'm a very limited sample of experience but I've yet to think that we could be doing better if my designers knew JS.

</comment></comment></comment><comment><USER9> Here's the thing: despite what JS fans will tell you, you _can_ make visually appealing, quick-loading, useful page/site with just HTML+CSS(+images/svgs etc) client side.

You don't _need_ JavaScript.

The reverse isn't true. You can't make a page out of just JavaScript. Even if JS builds your DOM _and_ builds the styles for it (because hey, crazy people have crazy ideas) the DOM and styles are still HTML + CSS. You still need to know what the JS should build.

<comment><USER10> What do you call a Javascript programmer who doesn't know HTML and CSS?

A backend programmer.

<comment><USER5> Only for tiny backs or huge rears. ;)

(Doing big things in JS right now is still asking for trouble.)

</comment></comment></comment><comment><USER11> For those of us who remember the Web of the 1990's, HTML was supposed to be a simple markup language to allow ordinary folks to design websites.

I guess it turned out that non-professional website authors went with WYSIWYG editors (anybody remember Netscape Composer and Dreamweaver?) -- and today they've given up on entirely on creating their own site and just use hosted solutions like Facebook or Medium.

On the other hand, professional websites and their customers ended up deciding to create increasingly bulky, JS dependent monstrosities.

How can we get back to simple HTML websites without alienating users who've grown used to modern design, developers who insist on using Javascript even when it's unnecessary, and businesspeople who can't live without bars, videos, and ads?

<comment><USER12> Look into the JAMstack. This is precisely what they are doing. In essence, it's having a static front-end markup, leveraging API's for all your heavy lifting needs, and utilizing JS when needed to make your sites interactive or reactive.

[https://jamstack.org/](https://jamstack.org/)

Here's a great talk on the principles of the JAMstack by one of the leaders in the field, Matt Biilmann, CEO of Netlify. He covers the essentials in about 5 minutes, but the rest of the 19 minute talk is worth listening to [https://www.youtube.com/watch?v=c5UEHm8Kets](https://www.youtube.com/watch?v=c5UEHm8Kets)

</comment></comment><comment><USER13> I have a habit of hiring entry level folks for CSR work. Generally not much coding experience. Those that grow to want to contribute to our WebApp I start with HTML+CSS. Asking them to redesign screens, or modify/tweak the UX. It's a great way to start and many times their contributions make it in production. This creates a positive feedback loop. Nearly everyone expands to some scripting language after that (JS, bash, PHP, python).

My goal is to train them all up on coding but if you "only" know HTML+CSS there is still room - or rather an open door to more.

It's just one rung on a mobius type ladder.

</comment><comment><USER14> Eh, there's definitely some value in it. Despite a lot of web agencies and startups focusing more on Javascript frameworks and whatever programming language is in vogue at the moment, there's also a 'low end' web development world which just delivers simple sites and projects.

Like say, the freelancers who sell premade WordPress themes with the logo and content swapped out. Or smaller agencies that are pretty much either pure HTML/CSS or HTML/CSS as a WordPress theme with no custom functionality besides premade plugins.

These folks are less common at events (hence the lack of response to the article author), but they definitely exist out there.

There's also obviously people who do HTML/CSS as part of a different role (like say, desugn or marketing), or those few unlucky souls stuck doing nothing but email templates.

So there are jobs out for people who specialise in purely HTML and CSS, as well as opportunities to made in the market. They're just nowhere near as glamorous or high paying as say, working at a large tech company.

On another note, I definitely agree with the article point about how expecting people to 'know everything' can be worse than letting them focus on something they're good at. Way too many job descriptions ask for 'experience' like:

In depth knowledge of HTML, CSS, Javascript, React, Node.js, Angular,PHP, MySQL, Python, Ruby on Rails, Go, Perl, ColdFusion, WordPress, Drupal, Magento, SEO, content writing, server configuration and tea making.

Not sure who exactly is that generalist, but they probably wouldn't have much actual knowledge about any of those things.

</comment><comment><USER15> I was so on-board at the beginning - yes, html and css skills are undervalued.

And then the essay tried to generalize the lack of respect for HTML/CSS specialists as an example of lack of respect for specialists compared to full- stack devs. This is where I think the essay took a wrong turn.

The technical community has tremendous respect for backend or math specialists. Now more than ever, ML and data science is cool. High performance is cool. Security and cryptography are cool. Etc.

But HTML and CSS? There is a general attitude that they're "easy" and javascript is "harder". But writing good HTML and CSS should be considered one of the highest art forms. Good HTML and CSS makes the end user go "wow, this is nice and clean" and makes the javascript developer go "wow, this is nice and clean". Achieving both of these is so fricking hard!

<comment><USER16> It is odd attitude. Css is harder then javascript. I mean, javascript is quite easy to learn, that is its biggest advantage.

<comment><USER5> Only true as of language. If you're doing websites you get to learn idiosyncrasies of browsers, DOM manipulation, asynchronous design, performance considerations, etc. That on top of how HTML and CSS is laid out and converted to DOM. Which is as hard if not harder.

Of course it is easy to produce toy projects.

</comment></comment></comment><comment><USER17> Now to put my comment into context : I'm self taught.

I can now code quite comfortably in: c#, python, html, css, JavaScript, php, MySQL queries and can learn most frameworks fairly quickly. (Infact I probably missed a few things I have played with over the years).

Point being: if you can code htnl/css, from my point of view, it isn't such a stretch to learn a more formal language is it?

(I did start with Qbasic and vb though, so I may be coming at this from the wrong direction?)

Edit: after reading some more of these comments I can _almost_ understand, but wouldn't someone who was able to show how they could work with htnl/css show at least a basic understanding at a technical level and be worthwhile at an entry level position?

<comment><USER10> > Point being: if you can code htnl/css, from my point of view, it isn't such > a stretch to learn a more formal language is it?

No, it isn't, if that's your thing.

Personally, there are days I regret being a programmer and wish I had just stuck with being a designer. Usually, it's the point where I'm struggling to come up with something unique or distinctive.

Or when I realize that if I'd focused more on design, then I might be amazing at it, rather than mediocre at design and programming.

But that's me. You do you.

<comment><USER17> Hmm maybe it's my point of view then - I only code in my free time or for some contracts I manage to pick up.

I had assumed anyone that bothered to learn html/css would be interested in coding in general though.

</comment></comment></comment><comment><USER18> I have been hired few times to _just_ write HTML and CSS. I _am_ really knowledgeable about Javascript, but for some projects the hiring company (some of which you know) just needed those bits so I provided those. When a company is looking for advanced animations and transitions, with a big budget and fine attention to detail they hire specifically for this. Of course this is not so common, and I wouldn't expect the _owners_ of these kind of companies to be in a random web dev conference, but there are some around.

</comment><comment><USER19> I think there's a general desire for a single employee to do all the things because it's easier to put "all the things" in a job description than to set up an environment in which specialists effectively interact. My employer, for one, has taken it to an extreme in making incentives such that one should have the necessary domain knowledge to find a problem to solve without being told what to work on, then go build the thing from the ground up.

</comment><comment><USER20> It's extremely rare to find someone who don't do JS but is also actually _good_ at HTML+CSS, as in usable markup and styles. But I'd hire that person if I found him.

</comment><comment><USER21> Suppose the thesis is true -- the job market has undervalued workers who can't write JS.

Why would the obvious arbitrage persist?

<comment><USER22> Not that I agree that "HTML + CSS" only workers are improperly valued less than JS coders, but one reason that might explain if this were the case could be because the technology job market isn't as rational or merit-based as some assume. Instead it's festooned with the same cult-of-X (where "X" is "technology", "framework", etc.) bandwagoning effect many practitioners of programming mock other fields for having.

There's no reason, as I see it, to think that an "arbitrage" of this sort couldn't persist for some time (years/decades) in this industry: it's too insular and full of itself in many respects.

<comment><USER21> You certainly could be right. But what's your conviction level? Is it as high as "earth's gravitational pull is real" or is it lower?

If it's high, can't you think of some way of capturing the arbitrage? Perhaps starting a company that employs HTML+CSS wizards?

<comment><USER22> Conviction level for which?

For the state of the industry comment: quite high. Developers think too highly of themselves, their ability to reason (in general), and assume unjustifiably that this industry is somehow more merit-based and rational than others.

For the particular arbitrage you describe: next to none. I know enough JavaScript and enough webdevs to know I don't care to know any more. I'll stick with data engineering, computational research, and systems programming, thanks very much.</comment></comment></comment></comment>


Restoring YC's Xerox Alto, day 1: Power supplies and disk interface - <AUTHOR> http://www.righto.com/2016/06/restoring-y-combinators-xerox-alto-day.html <comment><USER2> Not sure it was mentioned in the last thread on this computer but if anyone wants to actually use a real Alto and many other vintage computers check out the Living Computer Museum in Seattle: [http://www.livingcomputermuseum.org/](http://www.livingcomputermuseum.org/) They have an Alto you can walk right up to and start hacking on--when I last saw it it was running a pretty fun billiards game (worked well on its vertical monitor). There are tons of other vintage computers you can use, including even giant mainframes in a cold room like an IBM System 360, PDP-10, VAX systems, and a lot more.

<comment><AUTHOR> Keith at the Living Computer Museum has been very helpful with our Alto restoration, providing information from their restoration experience, as well as diagnostic hardware.

</comment></comment><comment><USER3> As cool as restoring the power supplies in their original condition is, it might be a lot easier at least temporarily to replace them with modern 5V and 12V units. Also a great deal less damage risk to the electronics on the PCBs which is what's truly rare and irreplaceable. Then you can repair and test the 'old' power supplies at your leisure and put them back into use if full authenticity is required.

<comment><USER4> This might not be as easy or practical as it sounds. Replacing an existing power supply that is known to match the requirements of the system with one that was cobbled together from modern components is inherently risky. You're either building something brand new and un-tested or hacking an existing supply to fit a job it wasn't designed for. If the original is reasonably intact and can be verified, it would be simpler and safer to repair it and know the supply matches exactly.

<comment><USER3> The original post shows that it needs +15V, -15V, +5V and -5V. This could be implemented with four separate high quality active PFC modern power supplies tuned to the right voltages. One thing that's unknown is what the load is for the whole thing, so it'd be necessary to somewhat deliberately oversize the power supplies, but it's not hard to find 700W rated power supplies that will do 15V.

Any modern power supply will be safer and more reliable. If there's any doubt about the pinout and cabling arrangement of the old power supplies, it's totally possible to pull the old power supply, repair it as best as possible with new capacitors, power it up on a test bench and probe it to see exactly what its output is. Then match that on a new cable harness with a new power supply.

It's not "hacking" to provide +15V or -15V , that's within the range of many good quality tunable 12V power supplies.

<comment><USER5> You don't even need to tune a 12v supply. +15v -15v is a reasonably standard part.

<comment><USER3> True, though there's a much greater selection of really high quality (medical grade, even!) active PFC 12V power supplies that will tune to 15V.

Some of them even come in specific 15V versions like a Meanwell RSP-750-15:

[http://www.meanwell.com/mw_search/RSP-750/RSP-750-spec.pdf](http://www.meanwell.com/mw_search/RSP-750/RSP-750-spec.pdf)

</comment></comment></comment></comment></comment><comment><USER6> I find it interesting that they only had to replace three capacitors in one power supply. Don't electrolytic capacitors (the most commonly used type) have a limited lifespan because of electrolyte evaporation? Naively, I would have expected that every single capacitor in the system would need to be replaced.

<comment><USER7> The average lifespan of electrolytic capacitors between 1999 and 2007 was much worse than usual, due to poor industrial espionage: [https://en.wikipedia.org/wiki/Capacitor_plague](https://en.wikipedia.org/wiki/Capacitor_plague)

You could easily get the impression that electrolytics had really lousy lifespans as a result of this.

<comment><USER8> I work on machines that are usually 20-30 years old if not more and I pretty much have to replace all the capacitors on them due to age. They tend to dry out, crack, or balloon up.

Not a single one built after 1999.

</comment></comment></comment><comment><USER9> Thoroughly enjoying following this. Please keep the videos and articles coming.

</comment><comment><USER10> Disk drive problems with an old computer reminded me of this discussion: [https://news.ycombinator.com/item?id=11376711](https://news.ycombinator.com/item?id=11376711)

</comment><comment><USER11> Awesome, I actually have a platter disc that looks similar but just has a permanent opening in the side, it doesn't pop up on top like this one.

</comment><comment><USER12> I can't wait to see an original version of smalltalk running on this!

</comment><comment><USER13> When the hardware is fully documented, I'd love to see on Kickstarter a small board with some USB ports, HDMI output and an SD card slot emulating an Alto (or a Star). Extra points if it came with a keyboard with the same layout as the original (so you don't need to use a PC keyboard).

<comment><AUTHOR> The Alto hardware is fully documented [1], source code is available [2] and a simulator is available [3], so there's not really anything stopping someone from making an Alto clone.

[1] Complete schematics at [http://bitsavers.org/pdf/xerox/alto/schematics](http://bitsavers.org/pdf/xerox/alto/schematics)

[2] Source code at [http://www.computerhistory.org/atchm/xerox-alto-source- code/](http://www.computerhistory.org/atchm/xerox-alto-source-code/)

[3] Simulator at [https://github.com/brainsqueezer/salto_simulator](https://github.com/brainsqueezer/salto_simulator)

<comment><USER13> I don't think it'd be an easy endeavor. I'm almost inclined to think it'd be easier to start from an emulator source towards a hardware implementation abstracting away stuff that's done in microcode hoping the software doesn't look too close.</comment></comment></comment>


Provide Sharp Knives (DHH) - <AUTHOR> https://m.signalvnoise.com/provide-sharp-knives-cc0a22bf7934?gi=f6b0f350c60 <comment><USER2> > I've yet to hear a single programmer put up their hand and say "I can't > trust myself with this power, please take it away from me!"

I'm not sure... I guess people who prefer static type systems (me included) often have these feelings working with dynamic languages. Or functional programmers using state in imperative languages... ;)

</comment><comment><USER3> >Programmers who haven't learned to wield sharp knifes just aren't going to make meringues yet.

For meringue you need only mixer and patience. Knife skill are not required at all.</comment>