Show HN: Intercept.rest – Faster API debugging - <AUTHOR> Sharing an internal tool that accelerated my development work 10-fold, especially with API debugging. Thought fellow developers here might find it useful.
As a developer, I often have trouble reproducing errors at the client end. https://intercept.rest lets me debug and monitor API requests and responses. It is similar to the Network tab in Chrome Developer Tools but works for any API: mobile apps, webhooks, frontend etc.
After I shared it with a close circle of friends, they found it incredibly useful and even found new use cases, I never imagined. Been a long time lurker here and have found several such tools that made my life easier. So, wanted to share this here and keen to hear if you folks find it useful too.
Some of the Use cases (Look forward to other use cases for this tool):
- Reproduce error requests at client side, helps to debug faster. – Easily switch between mock, dev, staging and production – You can even record requests and run load tests to see how your server behaves when  100,000 hit it – debug/monitor webhooks.
– Share requests with the backend team for debugging.
If you would like to take it for spin, DM me at https://twitter.com/intercept_rest , I can hook you up with credits.
Also made a blog post on how this tool could be used to monitor network requests in real time. https://medium.com/intercept-rest/how-to-monitor-network-req...
Let me know what you think :) Happy Developing! <comment><USER2> How does this compare to tools like Charles and BurpSuite?

I've used Charles extensively in the past for this sort of testing, and particularly on mobile apps (it's not clear if/how mobile apps are supported with this).

Edit: Ah, "Now you just need to replace the original endpoint with interceptor's URL inside the app." – so it sounds like this is basically a proxy at the HTTP level in the target app, rather than a network traffic interceptor at the network level on the system.

<comment><USER3> Just saw the edit, Exactly to your point

<comment><USER2> So what's the advantage of Intercept, what can it do that tools like Charles can't? Honest question, I expect it can be smarter being at that level, but less generic and unable to intercept apps that haven't been modified as a consequence.

<comment><AUTHOR> Charles proxy works only for local development as proxy for all your network.

intercept.rest monitor only request sent by your client to your server and it is easier to setup (just change the API endpoint), works both locally and in staging/production etc.

Some use cases are :-

\- When you give an app to the client for testing and you wanted to monitor the API calls and its responses for debugging purposes.

\- It can also be used to debug webhooks,

\- You can also choose to share all the data with your team members without additional setup.

</comment></comment></comment></comment><comment><USER4> Some feedback:

* How did you measure that your development work was accelerated 10x faster? Or is that just a hyperbole? I think this matters because otherwise you are making claims that are not justified.

* When I visit the website, it autoplays some voice and it put me off immediately.

<comment><AUTHOR> For us, it saved a lot of time after creating this tool. We are running appmaker.xyz for the last 3 years. And we convert WooCommerce website to the mobile app in minutes.

For us, while user create an app using our platform we have no access to the client-server, It was a hell to debug. We built this tool a couple of weeks back. For us reproducing the error at checkout page will take a while(without tool). (Choose product -> Add to cart -> enter address -> Choose payment gateway).

We build this to overcome all those and in one click we can reproduce that. The beauty is that we can reproduce the same request caused by the client while testing the app.

<comment><USER4> Surely that is your pitch. But what I am getting at is how you arrived at the particular claim that this tool "accelerated [your] development work 10-fold," and "10 x Faster API debugging" which was the original title. Without justification, you are misleading the potential users and that does not inspire confidence. i.e. why not 5-fold, 8-fold or 100-fold?

</comment></comment></comment><comment><USER5> Shameless plug: I made an HTTP(S) debugging tool for macOS[0]. Not exactly like what OP does, but if you are looking for a _native_ alternative to Fiddler on macOS, consider giving it a try.

[0] [https://proxie.app/](https://proxie.app/)

<comment><USER6> This looks more as a Charles replacement than intercept

<comment><USER7> You are right. Charles is a great tool and I used it everyday.

However, besides not being native, I really missed the scripting ability that Fiddler has. This is another major motivation for me to build this tool.

</comment></comment></comment><comment><USER8> There's autoplay sound on your website and absolutely no way of turning it off.

<comment><AUTHOR> oops. Apologies for that. Fixing that soon.

</comment></comment><comment><USER9> This looks great! I'm currently in the process of reverse engineering an API from its source. This is perfect for quickly comparing the requests made between the official client and my own implementation.

<comment><AUTHOR> Thanks for your feedback. I hope this will work for your use case

</comment></comment><comment><USER10> Happy to see this here :) I've been using it since the invite-only release. Helped us track down a bunch of bugs spot on. Burpsuite was my go-to tool before this, which simply is an overkill for this kind of testing. Intercept.rest makes it super simple and neat.

<comment><USER11> Thanks for using shitty early version ;) Look forward to continued support in the days to come. Again, we are thankful for the early feedback.

</comment></comment><comment><USER12> Cool product.

What's your stack?

Is the persisted request/response information encrypted in any way? Any chance of a locally hosted version being available?

What is your growth strategy? Who are your competitors? How long have you been working on this product?

<comment><AUTHOR> Glad you liked it, All are running on node js server. + react js. We build this for our internal purpose, right now request/response is not encrypted. This is we should have done in first place. (WIP). We have desktop apps which work offline on the local machine. We offer self-hosted in our enterprise plan. You can email me saleeh at intercept.rest.

I'm running a startup appmaker.xyz as fulltime. This is a simple tool that we build for our usecase

</comment></comment><comment><USER13> I've been using this tool since the invite-only release and find it super useful during development.

It helped in coordination between the backend and mobile app teams and even let us catch some potential bugs in the API.

Good to see this on Show HN!

<comment><USER11> Glad to see this helped your use-case.

Your Early feedback helped us immensely to improve this tool.

</comment></comment><comment><USER14> Looks awesome! Quick note about the landing page: the GIF captures in the "How it works" section are a bit vertically stretched, weirdly pixellated and really too quick to understand what's going on.

<comment><AUTHOR> Thanks for pointing out. Will update the GIFs soon.

</comment></comment><comment><USER15> Just a couple of small things I noticed:

\- There's a typo on the sign up - it says "Sing Up to Get Started"

\- There does not seem to be any forgot/reset password functionality

<comment><USER11> Haha. Just fixed the typo.

We are super early. And Build as an internal tool to get feedback. We are sure to move fast and work on the suggestion you mentioned.

</comment></comment><comment><USER16> The animations on the home page are way too fast, and with such tiny text, that I can't figure out what they're doing.

<comment><AUTHOR> Thanks for the feedback, We are working on it, Here is a simple video on how it works [https://www.youtube.com/watch?v=wVIE_yeViNo](https://www.youtube.com/watch?v=wVIE_yeViNo)

</comment></comment><comment><USER6> Can I use it as a transparent proxy with SSL certificate support like Charles?

<comment><USER3> This is a proxy at the HTTP level. So you can proxy and view request/response for HTTPS requests without configuring any certificates

<comment><USER17> Can you explain what this means?

<comment><AUTHOR> This acts as a proxy server for any API. All the request capture by intercept and it'll capture the response from the original endpoint and reply back

<comment><USER17> This is the same for HTTPS traffic? You can view the content of requests without installing a cert?

<comment><AUTHOR> Yup, this works both HTTP and HTTPS without any certs.

Hope this helps

<comment><USER17> Thanks!

<comment><AUTHOR> I would really appreciate if you could give us some honest feedback. or any suggestion

Thanks

<comment><USER17> I've used mitmproxy in the past for debugging purposes but there was always a stipulation that one must install a cert on the machine in order to intercept HTTPS traffic. If intercept.rest can accomplish the same thing without the need to install a cert I could see this being very useful.

<comment><AUTHOR> Yes, this can work without certificate installation and you don't have to do anything in client side. Only need to change the endpoint URL

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> will this do what ngrok does as well ?

<comment><AUTHOR> Right now, It doesn't support that feature, Its in out TODO list after getting feedback from users

</comment></comment><comment><USER19> Looks interesting. More useful for beta testing looks like

<comment><USER20> Please see [https://news.ycombinator.com/item?id=18078660](https://news.ycombinator.com/item?id=18078660). Promotional comments aren't good here.

</comment></comment><comment><USER21> this looks great! how do you guys compare with requestbin?

<comment><USER11> That's great. Request bin is a great tool for capturing requests while testing the webhook.

Our tool is similar to that. But our tool will monitor and forward requests to the original URL and reply the response (a proxy for your API with monitoring ). So your endpoint will work as expected and you can monitor that for debugging purposes.

one use case is that when any client reports any bugs regarding API/network requests, you can easily reproduce that without getting any inputs from the user.

</comment></comment><comment><USER17> Is there an extreme amount of astro-turfing going on in this thread? I looked at the profiles of 3 of the most fervent supporters of this tool (comments by livin21, shyjal, and g0vz) and the accounts had only 1 other comment among all 3 over the course of years. Is this tool really that amazing that several lurkers have come from the shadows after years of silence to pledge their allegiance? Those were literally the ONLY 3 I looked at as well.

<comment><USER10> :D I am not active on HN. But was using this tool since its development phase and was in a constant feedback loop with the devs. Classifying some HN noob's positive comment on a tool he used as astroturfing is kinda discouraging :)

<comment><USER22> This sparked my curiosity.

Is this your github [https://github.com/Livin21](https://github.com/Livin21) ? I see this person is from Cochin, India [1]. I then see the facebook page linked to on your website [2] mentions your founder [3] who happens to be from Kochi [4] which is the same city [5].

This is quite odd, no?

[1] [https://imgur.com/a/tBCmKGY](https://imgur.com/a/tBCmKGY)

[2] [https://imgur.com/a/RZgKg9Y](https://imgur.com/a/RZgKg9Y)

[3] [https://imgur.com/a/fbMnrrh](https://imgur.com/a/fbMnrrh)

[4] [https://imgur.com/a/9sn4LSs](https://imgur.com/a/9sn4LSs)

[5] [https://en.wikipedia.org/wiki/Kochi](https://en.wikipedia.org/wiki/Kochi)

<comment><USER23> I don't find it necessarily odd that one of the early users is from the same city as the company that created the app.

Sometimes, when I've worked on a small tool I want to share with others, I've found that telling people about it at local meetups is the easiest and quickest way to get people to try it out.

Maybe something similar happening here?

Or they just happen to work in the same building, or same coworking space, etc.

<comment><AUTHOR> This is what exactly happened.

</comment></comment></comment></comment></comment><comment><USER24> This is exactly what I was looking for. Thanks for building this..

<comment><USER20> Please see [https://news.ycombinator.com/item?id=18078660](https://news.ycombinator.com/item?id=18078660). Promotional comments aren't good here.

</comment></comment><comment><USER25> It's time to ditch Charles proxy and start using intercept. The configuration looks easy and simple when compared with Charles.

Thanks for creating an awesome tool.

<comment><USER20> Please see [https://news.ycombinator.com/item?id=18078660](https://news.ycombinator.com/item?id=18078660). Promotional comments aren't good here.</comment></comment>


Connecting to Google Sheets with Python - <AUTHOR> http://tinaja.computer/2017/10/27/gspread.html <comment><USER2> Google Spreadsheets and Python | [https://news.ycombinator.com/item?id=13668916](https://news.ycombinator.com/item?id=13668916) (2017Feb:140comments)

・SQL into Sheets - [http://pastebin.com/ACwqc5um](http://pastebin.com/ACwqc5um)

・LibreOffice Calc server - [https://github.com/robsco- git/spreadsheet_server](https://github.com/robsco-git/spreadsheet_server)

・Sheets API (JS) - [http://chriszarate.github.io/sheetrock/](http://chriszarate.github.io/sheetrock/) | [https://github.com/theoephraim/node-google- spreadsheet](https://github.com/theoephraim/node-google-spreadsheet)

・Grunt / Jekyll - [https://github.com/stpe/grunt-gss-to- json](https://github.com/stpe/grunt-gss-to-json)

・simple read-only (JS) - [https://github.com/franciscop/drive- db](https://github.com/franciscop/drive-db) | [https://github.com/digplan/gsheet-web](https://github.com/digplan/gsheet-web)

・auth proxy (Golang) - [https://github.com/VLO-GDA/server- app](https://github.com/VLO-GDA/server-app)

<comment><USER3> Thank you for sharing the links. Is there a pure JavaScript library that helps with reading and writing data from/to Google private spreadsheet? From the links above, I think node-google-speadsheet repo comes closest to what I'd like to achieve, but it uses node, which I'm not very familiar with.

</comment></comment><comment><USER4> We used to use the excellent Xero for our accounts, but it couldn't handle international business (exchange rates, different tax regimes etc)well. So we rolled our own system of python scripts and Google sheets.

The python scripts use gspread to import and process bank data from eight accounts around the world. Summary sheets pull that data together into real- time profit and loss, position statements, and tax summaries.

It's easily shared with our accountant, who can add a sheet to do some custom analysis at the drop of a hat. Our annual report takes about an hour to prepare, and sheets mimicking tax forms make filing tax returns simple.

<comment><USER5> Sounds awesome! We are in the process of revamping our sheets internally and would love to do something similar. Anything you could share on the subject?

<comment><USER4> Not sure what you need - contact me by doing a whois for vig.co.nz.

</comment></comment></comment><comment><USER6> In addition to the popular gspread project, there is a port that uses api v4 here: [https://github.com/nithinmurali/pygsheets](https://github.com/nithinmurali/pygsheets)

Since v4 was substantially different from v3, it's (almost) a complete rewrite and unfortunately still not as stable as gspread.

Anyone here writing some interesting code using the GoogleDocs APIs?

While this ([https://digitalinspiration.com/google- addons](https://digitalinspiration.com/google-addons)) is interesting, I would like to see some client code (preferably Python!)

Also of interest:

[https://sheetsu.com](https://sheetsu.com)

</comment><comment><USER7> Am I the only one that finds the Google Sheets API not fully baked or has had issues with it?

Search functionality is not there, retrieve row, find and replace is not adequate, row index not sent when retrieve values etc. Updating particular row gets hard etc. We ended up adding row counter as a column as well.

We used Sheets in between two major iterations of our internal tools and we found it inadequate for any advanced usage.

Also sheets api would tend to 503/504 (not sure which one) if there was more than 10k rows with 4-5 columns.

</comment><comment><USER8> There's butterdb (formerly known as fuckitdb) which is based on gspread. It made its rounds on HN and other sites a while ago as an abstraction on top of gspread.

</comment><comment> adam-p I used Google Sheets as the database for a neighbourhood association, written in Python, running on Google App Engine. [https://github.com/adam-p/danforth- east](https://github.com/adam-p/danforth-east)

It has worked pretty well for a few years now, and it allows ordinary humans to filter and review in a familiar format. (With the risk that they start messing with stuff enough to break its DB-ness.)

<comment><USER9> Why hello there, neighbour!

</comment></comment><comment><USER10> A couple weeks ago I helped my nephew with a project he was working on using gspread. I haven't programmed in Python in years but was able to make it all go in an hour or so of poking at the gspread docs. It's pretty neat. I've often thought spreadsheets should be more commonly used as the UI for software. Lots of business folks have a good grasp of spreadsheets, but not of programmer-y or database concepts. I dunno how I'd integrate spreadsheets into anything I'm working on, but if I were doing enterprisey stuff, I'd be trying to make it fit.

<comment> stephen-mw That's funny you say that. One of my pet projects was using google sheets to control SSH access with non-techies. It worked surprisingly well.

[https://github.com/stephen- mw/gdoc_ssh_manager/blob/test/REA...](https://github.com/stephen- mw/gdoc_ssh_manager/blob/test/README.md)

</comment></comment><comment><USER11> I made the same thing for Node.js but without credentials. The main gotcha is that your spreadsheet is public (but unlisted). It also has some basic commands to use it as a Mongo database, or just use the array of data:

[https://github.com/franciscop/drive-db/](https://github.com/franciscop/drive- db/)

I also made a small tutorial of how to use it:

[https://serverjs.io/tutorials/spreadsheet/](https://serverjs.io/tutorials/spreadsheet/)

</comment><comment><USER12> I've used gspread a few times to automate generating reports. I wrote a library ([https://github.com/elliottcarlson/pptx- canvas](https://github.com/elliottcarlson/pptx-canvas)) that allows you to draw in a powerpoint file using canvas style syntax, and combining that with a spreadsheet another team was maintaining/updating, we could quickly generate new reports for them at a time. gspread was definitely easy to use in this scenario.

</comment><comment><USER13> This seems useful. Google spreadsheets are pretty universal, easy for non- technical folks to update and have zero infrastructure and cost.

However, don't try to create a full fledged (or even read only) rest API against a Google spreadsheet. I did, and I wasn't pretty:

[http://www.mooreds.com/wordpress/archives/1359](http://www.mooreds.com/wordpress/archives/1359)

</comment><comment><USER14> I've been using this for working with people on managing/reviewing data. I can get them to enter some data on google drive, then lookup relevant info from various services and fill in

It's a really nice setup for bringing data from APIs and other services into a more usable, query-able setup for people more used to spreadsheets.

</comment><comment><USER15> I found this to be a very clear and well-structured post. I was not surprised to read that the author is a historian. I especially liked the detail in their process where they automatically update the communal sheet to indicate that the data has already been processed.

</comment><comment><USER16> Combine this with Multicorn and Postgres and you can query Google Spreadsheets from your database

<comment><USER17> Excuse my ignorance on FDWs but how does this work with respect to DB constraints? For example, if a postgres column is supposed to be a date, but it's not a properly formatted date, does it throw an error at query time? Or is everything treated as a varchar/text?

</comment></comment><comment><USER18> Did you try stuff like airtable or maybe even use spreadsheets with zapier? They "seem" pretty powerful alternatives</comment>


Twitter founders should get the Nobel Peace Prize - <AUTHOR> http://www.techcrunch.com/2009/06/22/former-deputy-national-security-advisor-twitter-founders-should-get-nobel-peace-prize/

<comment><USER2> Let me get this straight... an Advisor to Bush - the president who started 2 wars in Afghanistan and Iraq and was well on his way to a third. Who reopened gitmo to do unspeakable acts is talking about who should get the Nobel _Peace_ Prize?

Does anyone else see the irony in this?

Not only that, but he thinks it should go to a web company.

What about the many organisations that have done ACTUAL good around the world? You know, the kind that do activities like feeding starving people, providing medical supplies, mediating intense situations.

As far as I can see, all twitter has actively done for the iranian elections was reschedule some downtime, since they would have been operating regardless - that's deserving of a peace prize?

I don't even know where to start on just how idiotic this actually is.

</comment><comment><USER3> The funny thing about this issue is that if you are a vendor of products for sale, you are not allowed to sell your wares in Iran, yet the united states govt is more than happy to let twitter help them stage a revolt.

<comment><USER4> I guess its a good thing they don't have a business model.

</comment></comment><comment><USER5> A small part of me wants to read what must be a profoundly ridiculous argument for this. Thankfully, I'm not that masochistic.

</comment><comment><USER6> How about not... their network should have been spread far enough that it shouldn't have gone down.

Accidentally or Scheduled.

</comment><comment><USER7> Well they'll probably get nominated now. Remember that a nomination for the Nobel Peace Prize doesn't mean much.

</comment><comment><USER8> that would make my head explode

</comment><comment><USER9> Sure. Why not? After all, Kissinger, Arafat and Gore have won the Nobel Peace prize. The prize does not mean anything, and it's awarded solely for political reasons. The "good" Nobel prizes go to physicists, chemists, biochemists and medical doctors.

<comment><USER10> I wish I could give you an additional upvote for leaving out (intentionally?) economists from your list.

<comment><USER11> The economics prize is not a Nobel prize.

<comment><USER9> The economics prize is called the _Bank of Sweden Prize in Economic Sciences in Memory of Alfred Nobel_. Like you said, it's not a Nobel prize.</comment></comment></comment></comment>


Walking Through the Design Process - <AUTHOR> http://ianstormtaylor.com/walking-through-the-design-process/

<comment><USER2> Love it. This is a great read on the evolution of a design and what goes through a designer's head as they're iterating on a concept. One thing that should particularly stand out is that the format of the article is a continuous loop of 1) Design problem followed by 2) How I solved the problem. This is how great designs are made: constant iteration.

What is more interesting to me is that it seems like one of the key things to generating this loop is identifying design problems. If you can't really pinpoint what is wrong with a design, how can you make it better? Here, Ian seems to get a lot of feedback from other people, but I'm curious as to what kinds of internal thought processes he has when trying to identify exactly where a particular design is lacking.

One heuristic that works for me is thinking about the context of a design. In other words, how did the user get to this particular screen? What are their intentions when entering this view? Almost no individual UI element is self- explanatory when it's devoid of context. Just thinking about what the user wants to do at this particular part of your UI flow can help identify ways in which you can make the design clearer and more in line with their intentions.

In any case, there are a ton of great design patterns to pick up from seeing how Ian thinks about problems. Every designer needs to read this.

<comment><AUTHOR> Thanks! Truth be told, my internal processes are way less useful than just asking the rest of the guys for feedback. I usually get way too familiar with the design, and devolve into just perfecting the visual appearance. Forgetting the bigger problems, until I ask someone and their reaction is basically what Peter said in the article, AKA "WTF?". :p

</comment></comment><comment><USER3> I tried Layervault, but I didn't like how it takes a 'snapshot' everytime I save - since I was saving to prevent crashes and losing my work, not because I felt it was it a good place to call it a separate version. Then I'd end up with a ton of versions on LV, most of them not true versions.

What are your thoughts on this?

<comment><AUTHOR> OP here - I also have the Cmd-S habit and get tons of versions in my timeline. But I actually would prefer to have that, because I don't usually pause all the time and think to "save" a version that I want to show for process later.

They also have a "Signpost" feature which lets you mark real versions, which you probably want to be using instead. (Might not have been there when you tried them first.)

That being said, my use of LayerVault is purely as a backup since I'm the only designer on the team.. and I just email out mockups via screenshots.

</comment></comment><comment><USER4> I really, really enjoyed reading this. The insights are awesome and the ability to see each small iteration was really cool. I would definitely encourage you to do this in the future.

Anyone know of similar write ups in this style?</comment>


Add quizzes to your apps - <AUTHOR> https://www.noodl.io/market/product/P201604061143930/quiz-module-add-quizzes-to-your-app <comment><USER2> In English a quiz generally has a right answer and is used to test knowledge.

>You can add a set of questions and the final answer is based on the most checked options.

This describes a poll.</comment>


Mobile Cloud Platform to bring rain to Burning Man - <AUTHOR> http://www.kickstarter.com/projects/966222131/ardent-mobile-cloud-platform-0/

<comment><USER2> I know some folks on this project, I think its excellent. I think I like Dance Dance Immolation more, but I think this is going to be a hit!

<comment><USER3> Thanks! Dance Dance Immolation will be there too, but we couldn't resist building something new. Funding the Cloud will help free up our other resources to get DDI up to the Playa, where it'll be part of the Charcade, a whole bunch of fiery video games.</comment></comment>


Moonshine Master Toys with String Theory - <AUTHOR> https://www.quantamagazine.org/20160804-miranda-cheng-moonshine-string-theory/ <comment><USER2> From their paper:

""" According to the Oxford English Dictionary, a flame or light that is lambent is playing "lightly upon or gliding over a surface without burning it, like a 'tongue of fire'; shining with a soft clear light and without fierce heat." And since the light of umbral moonshine is apparently of this nature, we call the six values in Λ = {2, 3, 4, 5, 7, 13} lambent, and we refer to the index ℓ ∈ Λ as the lambency of the connections relating the umbral group G(ℓ) to the umbral forms Z(ℓ) and H(ℓ)g . """

That is some very fine literary influences indeed.

</comment><comment><USER3> The title makes me think it's talking about Richard Borcherds, who solved the moonshine conjecture (and got the Fields Medal for that), and is now interested in TQFT (topological quantum field theory).

However it's about Iris Cheng. I'm not saying she's not good or anything like that, but how can the author call someone "moonshine master" while what happened is "She happened to have read a book about the "monstrous moonshine,""?

<comment><USER4> Probably because her CV [1] is full of uses of moonshine algebra. I'm sure there's multiple mathematicians you could call a master of moonshine.

[1] [https://arxiv.org/a/cheng_m_1.html](https://arxiv.org/a/cheng_m_1.html)

<comment><USER5> Homepage

[https://sites.google.com/site/mcheng0606/research](https://sites.google.com/site/mcheng0606/research)

</comment></comment></comment><comment><USER6> I took John Duncan's course on intro abstract algebra when I was a sophomore at CWRU. I had signed up to take his class on modular forms the next semester but he had been hired away before I had the chance to take it. A big shame as he was one of the best professors I've had (nearly the entire course grade was based on homework- exactly as it should be IMO).</comment>


ScreenBoards: Dashboards to tell a story with your live data - <AUTHOR> http://www.datadoghq.com/2013/06/introducing-screenboards-your-data-your-way/

<comment><USER2> Nice....but without a self-hosted option we can't even begin to consider using this, any plans for this in the future?

<comment><AUTHOR> We do, but it only makes sense for very large deployments. Happy to discuss - oli@ our domain.</comment></comment>


Boeing lands $1.2B deal for eight F-15EX fighter jets - <AUTHOR> https://www.washingtonpost.com/business/2020/07/13/boeing-f15ex-contract/ <comment><USER2> A much better article on this plane is at The Drive:

[https://www.thedrive.com/the-war-zone/34568/](https://www.thedrive.com/the- war-zone/34568/)

<comment><AUTHOR> This article is about the contract with Boeing (it's in the title and everything), the other article does not mention the contract with Boeing and appears to be about the engine contract.

</comment></comment><comment><USER3> Rationally, I know these planes have a lot more capabilities than the F-15s that were popular in my youth.

But as a taxpayer, it's really hard to swallow that these planes cost ~10x as much while every other technology is 100s of times cheaper.

<comment><USER4> I used to work in a DoD acquisitions role (as sort of an engineering analyst).

It's not the actual planes or engineering design work that costs so much money. Most of the time, the companies building the systems know what they're doing. (Not always though... I saw some awful stuff...)

The real costs come from all of the work necessary to get those systems through the government's testing and certification processes. Typically, each individual subsystem has to be checked by a different DoD agency that specializes in that kind of technology. That means dozens or hundreds of similar but different documentation packages need to be created, reviewed, revised, and signed off...

<comment><USER5> Is that an opportunity for software to standardize and be able to output different kinds of specs? Or is this something only a human can do?

<comment><USER6> Defense is as much about creating and maintaining jobs as it is about building war machines. The military-industrial complex is very politically motivated to keep jobs over any real need for efficiency gains.

</comment></comment></comment></comment><comment><USER7> Every gun that is made, every warship launched, every rocket fired, signifies in the final sense a theft from those who hunger and are not fed, those who are cold and are not clothed.

<comment><USER8> From that well-known loony-leftist, Dwight Eisenhower.

/s

<comment><USER9> He did write with remarkable candor when leaving office.

"In the councils of government, we must guard against the acquisition of unwarranted influence, whether sought or unsought, by the military–industrial complex."

</comment></comment></comment><comment><USER10> What role is the F-15EX supposed to cover that is not already covered by the F/A-18 F-22 and F-35?

<comment><USER11> Seems mostly like a stopgap to me. This is meant to replace a bunch of old F-15 C/Ds which are aging out of their operational life. The -18s are Navy, and so using them in the Air Force to replace existing -15s would be pricey on the logistics side, F-22s aren't being manufactured anymore and would far too expensive for the National Guard units these are going to, and the F-35s just aren't available in large enough numbers yet. The -15 has also turned into a very versatile aircraft, and it a lot cheaper to operate than a -35.

Part of the reason these old aircraft stick around is due to the very low risk involved with upgrades. We have -15s, we know they work very well, we know how to fix them, we know what to do with them.

<comment><USER12> > F-22s aren't being manufactured anymore and would far too expensive for the > National Guard units these are going to

The 149th and 199th Fighter Squadrons are ANG and fly the F-22A.

<comment><USER11> You are absolutely correct, I should have been more clear that I meant they would be too expensive to go to the number of ANG squadrons that currently fly the C/D, I think they would have to double current F-22 numbers.

</comment></comment></comment></comment><comment><USER13> Why make an order for only eight? It seems wasteful for a country like the US to order so few. Either you need a lot more, or you don't need them at all.

<comment><USER14> They plan to buy many more but the contract for procurement in future years hasn't been formally signed yet.

</comment></comment><comment><USER15> I'm honestly wondering why those planes are so expensive. If it's mostly human work, 1.2 billion is (very) roughly 1000 highly-skilled people employed for two full years. This feels out of proportion, even for bleeding-edge technology.

Does someone here know a bit more about the breakdown of costs?

<comment><USER16> I imagine there is quite a bit of pork and middlemen rewarding themselves in the pipeline.

</comment></comment><comment><USER17> At this point, even the most obtuse observer should realize that military contracts are nothing but jobs programs for the big defense corps.

The actual deliverables seem to be a distant, almost irrelevant goal

</comment><comment><USER18> Somewhat related:

>US May Need to Nationalize Military Aircraft Industry, USAF Says

[https://www.defenseone.com/business/2020/07/us-may-need- nati...](https://www.defenseone.com/business/2020/07/us-may-need-nationalize- military-aircraft-industry-usaf-says/166894/)

Probably not serious consideration at this point, but the salient TL;DR: it's hard to retain talent and industrial base when there's so few engineering projects. Talent leaves if they only get to do 1 major project throughout their career. So here's busy work. Some of it might be productive. Though I'm sure has more to do with Boeing needing more dough after losing 60 orders this month, 800 so far this year.

</comment><comment><USER19> F15-MAX? I think there's typo

<comment><USER20> F15-MAXTURBOWTFBBQOMG coming soon to a sky near you! Well, give or take a generation change.

</comment></comment><comment><USER21> "A Boeing news release published Monday boasted that engineers would be able to adapt from older F-15 jets to the new F-15EX in a matter of days."

This sounds familiar...

<comment><USER22> yeah, except they don't have to go through the FAA this time >_>. /s

What drove me nuts about the 737 fiasco, is that the military version of a 767 had a similar issue that was easily overridden by just... moving the stick.

[https://qz.com/1718506/boeings-737-max-mcas-has-better- desig...](https://qz.com/1718506/boeings-737-max-mcas-has-better-designed- military-forerunner/)

(the military aircraft is based on the 767 which only has rudimentary fly-by- wire for the spoilers along the wing, so everything else is hydraulic like the 737).

<comment><USER23> The military plane didn't have absurd economical reasons against increased pilot training that 737 MAX had.

<comment><USER24> Ah, you've found the solution. The military should go into the passenger business!

</comment></comment></comment></comment><comment><USER25> F-22: What am I to you?

<comment><USER22> F-22 is the greatest plane in the US arsenal. It's unhackable (because the IBM mainframe powering it is so old, it would be difficult for the chinese or russians to attempt to do so). And -nothing- can currently beat it in a 1v1.

The issue, however, is we can barely keep 50% of the already existing raptors operational. [https://www.thedrive.com/the-war-zone/28659/air-force- admits...](https://www.thedrive.com/the-war-zone/28659/air-force- admits-f-22-raptors-wont-hit-80-percent-mission-capable-target-on-time)

The raptor is, unfortunately, not the future due to costs and maintenance (tho the f-35 is having the same maintenance issues with the stealth coating. Hopefully it's not as bad.)

[https://www.thedrive.com/the-war-zone/29218/these-images- of-...](https://www.thedrive.com/the-war-zone/29218/these-images-of- an-f-22-raptors-crumbling-radar-absorbent-skin-are-fascinating)

<comment><USER24> IBM mainframe? Does it run COBOL?

<comment><USER26> HAL 9000

</comment></comment></comment></comment><comment><USER27> > Boeing will build a new version of its F-15, an older fighter jet developed > in the 1960s

Am I the only one that immediately thinks about the 737max disaster where they tried the same thing?</comment>


Bricks, Bikes, and Code - <AUTHOR> http://andreyf.tumblr.com/post/68667621/bricks-bikes-and-code

<comment><USER2> "when humanity matures - human language will become less ambiguous"

That seems very unlikely. In fact I'd guess natural language has to be imprecise to work.

<comment><USER3> I always thought of natural language as a lossy compression algorithm for ideas, and as always in every lossy compression, you sacrifice some accuracy for the sake of brevity.

</comment></comment><comment><USER4> I don't understand, sorry.

<comment><USER4> OK, so tell me, what did you learn from "They go where they mean to go, and they mean to go where they go"? Is it some sort of ZEN puzzle?

</comment></comment><comment><USER5> Please don't post your _Chicken Soup for the Hacker's Soul_ pablum to news.yc</comment>


Top Bootstrap Extensions - <AUTHOR> http://magifox.com/top-bootstrap-extensions/

<comment><USER2> As the Site and Submitter seem the same, a typo heads-up:

As you probably know, a new version of _Bootsrap_ Framework was released recently. At the same time, they've announced that 4th version will be available soon (When? Who knows…)</comment>


Craft Coin is up 1000% today - <AUTHOR> http://coinmarketcap.com/crc_30.html <comment><USER2> It's creator probably bought one.</comment>


Backpressure and Unbounded Concurrency in Node.js - <AUTHOR> http://engineering.voxer.com/2013/09/16/backpressure-in-nodejs/ <comment><USER2> There are two Node projects that I've been part of which illustrate some of these problems:

The first one is a hobby project of mine, admittedly a small app with no more than 300 users connected through websockets. Node was fantastic for this use case (and I replicated this model afterwards for a largish gambling site I contracted on): listening for connections, keeping them open, manage their relatively minimal state, and buffer relatively small streams. At no point in the app is there more than one stream per connection in the air. Backend requests are issued quickly and return quickly.

This works so well because the actual backend processing is a separate construct. Even though websocket connections can and do stay open for days, they don't drain a lot of resources (except for a small amount of memory for state and data buffers). No part of the service - except for the dead-simple broker core - will ever be in a contentious state or stranded midway through an action waiting on an unreliable communication partner.

Howeve, this isn't always feasible. My second example is a Node.js project I consulted on for a bigger company. The architecture was quite different: there were the same client-facing persistent connections to manage, but on top of that the backend logic was so immensely stateful and data-laden that a large chunk of it was actually implemented right in node. This meant, because streams and callbacks seem so misleadingly elegant sometimes, that situations occurred where lots of file streams, database connections, and all sorts of backend systems had to be kept in lock-step with the frontend-facing Node.js client connections.

It's no surprise this construct choked, a lot. Some of these are actual hard choices, for example where large and long-running data streams are concerned, but in the end we managed to make the entire thing stable by decoupling client-facing mechanisms from backend resources, and yes: by putting some blunt restrictions in place.

Like with any technology, you need to be aware of the tradeoffs.

</comment><comment><USER3> Running out of CPU will cause problems regardless of what platform/framework/system you're using. This problem has no meaningful software solution (whether you leave your requests pending in a queue as in Node.js or reject them outright - The end result is your user is not being serviced) - It's a hardware problem.

<comment><USER4> While your premise:

> Running out of CPU will cause problems regardless of what > platform/framework/system you're using.

Is technically correct, your subsequent conclusion is faulty in this context since Node.js does not intrinsically use more than one CPU:

> A single instance of Node runs in a single thread. (source: > [https://nodejs.org/api/cluster.html](https://nodejs.org/api/cluster.html))

Therefore in the context of a "meaningful software solution", if it is desired to utilize more than one logical CPU on a machine (of which modern server hardware typically have numerous), then choosing a platform capable of running on more than one CPU would allow a solution to do so by definition.

Node.js, according to the project's documentation quoted above, does not provide this support.

<comment><USER3> A single Node.js process does in fact use more than a single CPU core when it performs IO operations (it uses threads behind the scenes). But you would be right in thinking that your own code runs in a single thread/process by default.

That said, Node.js makes it really easy to spawn and communicate with other Node.js processes - [https://nodejs.org/api/child_process.html](https://nodejs.org/api/child_process.html). To compare it with Go; the main feature which Go has over Node.js is that Go allows you to run functions (defined in the same source file) as separate processes/threads. Node.js forces you to separate processes into different files.

I think that this feature of Go is cool at first but I don't think you would use it that often in a large-scale app. Usually you want to separate processes into different source files (for the same reason that you would want to define different classes in separate files).

There are many Node.js modules which automatically leverage multiple CPU cores. I'm the main author of one such module: [http://socketcluster.io](http://socketcluster.io)

</comment></comment></comment><comment><USER5> This problem extends to other event-driven environments as well. When you have a thread pool it's easy to know your limit (e.g. N threads can support N concurrent requests, and N is usually a known, reasonable number), but in an event-driven environment concurrency can feel limitless. For a typical event- driven HTTP server, the default limit may simply be the operating system's file descriptor limit.

You could limit fds, but to me this is crude (because you need fds for things other than incoming requests), and in some cases an fd limit isn't enough. In our case, we've built event-driven workers using ZeroMQ, where the number of peers is usually stable, but these peers may each issue a variable number of parallel requests over their ZeroMQ connections. To ensure we can still have backpressure in this situation, we have a setting to limit the number of active requests at once. The number to choose here feels a little arbitrary (as the limit is entirely enforced in-app, and it has nothing to do with hard OS limits like threads or fds), but just some number that we know the CPU can support in general.

<comment><USER6> Couldn't Node just use a system thread per every accepting socket per port and then signal that thread to block when oh-shit-panic mode kicks in? I doubt very many Node programs are accepting on more than one port anyway.

<comment><USER4> Or...

Have a machine fronting the ones running any system lacking the ability to manage incoming request rates perform the load balancing/throttling, using something like:

[http://www.haproxy.org](http://www.haproxy.org)

Best fight? Not to be in one.

</comment></comment></comment><comment><USER7> Jane Street's Async library is a great example of backpressure (or as they call it, pushback) done right. Specifically, their Pipe module[0] is what implements this concept very nicely. In essence, a Pipe is a stage in a pipeline. You shove values into one end, and it'll pop out the other end. Then, you can build on a pipe by map-ing over it, filter-ing over it, doing whatever you want over it. Each time you add another operations like this, you're extending a pipeline with another stage, all of which can proceed concurrently.

A Pipe is an unbounded FIFO. But, you can give it a size budget. What that size budget does is determine when writes to a Pipe will block. So if a Pipe has a size budget of 0, then any write will return a Deferred.t (i.e., a promise) that will become determined only when the value has been sent downstream to the next stage of the pipe. If the size budget is 1 on the other hand, then the Deferred.t of the first write will become determined immediately, allowing computation to proceed. If on the second write the first value hasn't been sent downstream, then it'll block. Once there's only one value waiting in the first stage of the Pipe, the second Deferred will become determined.

Another nice module in the library that addresses the connection pooling issue at the end of the blog post (and really that's all it amounts to) is the Throttle module[1]. Here's you can create a Throttle object with however many connections you like, say 5, to however many servers you like, say 5 or possibly less with some redundancy in there. Whenever you want a connection to one of these servers, you go through the Throttle object to get the connection, do the work, and release it automatically when your operation completes (or throws an exception). If there are more than 5 active connections, then you block until one of those gets relinquished. If you want to fail instead of block, you can query the Throttle object to check the number of jobs running, and if there aren't any free jobs, fail.

It's a really nice library. I think that you can't compile Async to JavaScript using js_of_ocaml just yet, but it'll probably happen sometime in the near future.

By the way, this is all OCaml.

[0]: [https://ocaml.janestreet.com/ocaml- core/111.28.00/doc/async_...](https://ocaml.janestreet.com/ocaml- core/111.28.00/doc/async_kernel/#Pipe)

[1]: [https://ocaml.janestreet.com/ocaml- core/111.28.00/doc/async_...](https://ocaml.janestreet.com/ocaml- core/111.28.00/doc/async_kernel/#Throttle)

</comment><comment><USER8> It's an okay discussion, but it would be infinitely better with some simple code that actually causes node to fail under load because of back-pressure problems (and then patch the test such that node survives).

</comment><comment><USER6> I haven't used Node.js in ~3 years (thank god!) but if I understand this correctly, Node.js doesn't have an internal way to stop receiving data which in turn prevents Node.js from signaling backpressure on the client by way of the client's buffers being full (assuming the client is using TCP).

That seems odd given how easy of a feature this is to implement usually. I know Node.js doesn't allow its users to use threads in their programs but they should consider carefully using threads in a few more places internally to implement necessary functionality like this.

<comment><USER9> I think you might find it useful to read the comments in this question on backpressure in Node.js. It points to a easy solution built into to Node's Streams. [http://stackoverflow.com/questions/25237013/node-js- unbounde...](http://stackoverflow.com/questions/25237013/node-js-unbounded- concurrency-stream-backpressure-over-tcp)

<comment><USER6> This article (the article we're commenting on, not the article you linked) precisely points out why Streams will not save you.

<comment><USER9> The article we are commenting on points out that backpressure is not easily handled by the given tools of Node.js it speaks of a way to fix it from crashing from memory overload. The comment above points out in a way that I understood as Node being bad for not having a way to deal with backpressure with its own tools. The link I shared shows that Node.js does have a built in tool in streams to handle that exact problem. As other comments have said having too many connections will always eventually crash a single server. So my question is what will save you? Can it be done in the JS part of Node? Can it be done in a Node C and C++ module? I look at my self as a beginner when it comes to these things so I would surely enjoy an informative response.</comment></comment></comment></comment>


ArchLinux, Not Just For The Elite - <AUTHOR> http://standardsandfreedom.net/index.php/2011/11/06/archlinux-notforthe-elite/ <comment><USER2> I like arch, except for the stupid command line arguments to pacman. I wish they had just kept it more standard. There's nothing wrong with naming "install" install and "search" search. Feels to me like a case of inventing complexity just to make it feel a little more elitist.

       pacman -Ss gnome # searches for gnome
       pacman -S gnome # installs gnome

<comment><USER3> That's just how CLI apps work, there is nothing elitist about it. Its "cd" and "ls -la" and "cat", not "change-directory," "list-directory long-format everything" and so on. The learning curve might be steep, but it's well worth it, especially for those of us who "live" in a shell.

In the particular case of pacman, I really like the design of the arguments, in particular the top level ones. -S is for syncing, -R is for removing, and -Q is for querying and so on. Nice!

<comment><USER4> Yes, but why rename install to syncing and search to query? Why not just call it install and make it -i for install and -s for search which is still search. I think that is what the OP is trying to say.

<comment><USER3> Searching isn't the same as querying. -Q is for operations dealing on the _local_ repository. -S synchronizes your local repository with the remote repository. In a way installing could very well be -Si (-S --install), but installing is the default action in -S mode instead. Pacman is maybe somewhat idiosyncratic, but I find it very useful and simple once you get the basics.

<comment><USER4> Oh, i used it. Found it delightful, actually I am yet to encounter a very bad package management system. They are all really good since I started using linux.

</comment></comment></comment></comment></comment><comment><USER5> It's pretty stupid, but the only problem I have with using something like Arch on my desktop is I can _never_ seem to get the fonts to look nice (ie. like they do in OS X or Ubuntu) when I've installed/configured Xorg myself.

<comment><USER6> That is quite a normal concern. Fortunately, the Archlinux wiki has good info on how to configure fonts: [https://wiki.archlinux.org/index.php/Font_Configuration#Ubun...](https://wiki.archlinux.org/index.php/Font_Configuration#Ubuntu) (that link leads to the section about Ubuntu-patched packages, but the whole page is a good read).

If you use Archlinux, make sure you use the wiki and bbs to their full power. Most of the problems you think of have been solved in a way or another. It usually just requires installing some packages, which is a breeze.

<comment><USER7> I use the Ubuntu patchset. The difference between that and stock fontconfig is night-and-day; installing it is a constant reminder that for all the controversial moves Canonical has made in recent months, making Linux fonts _not look like ass_ was one thing they did about as well as they possibly could have.

</comment></comment></comment><comment><USER8> I don't use Arch personally, but I have found that every time I've looked for documentation on something lately (like setting up xmonad), I would be directed to the Arch wiki and forums quite a bit. They seem to have a good community going on over there.

<comment><USER9> The community is amazing. The forums are a wealth of information, and I've tracked down almost every single bug just by searching. The wiki is updated regularly and is just as rich.

In my experience Arch users are very happy and proud to be running such a powerful, flexible system, and they give back by helping others. I ran Slackware for a year, then messed around with Mint before trying Arch. I can't see myself trying anything else -- except maybe LFS ;).

</comment></comment><comment><USER10> "Arch Linux is a very fun and stable distribution that successfully blends the bleeding edge, stability and hackability of Linux"

let's define 'stable' <http://www.tuxtips.org/?cat=3>

<comment><USER11> I would say it has a bit of both kinds.

<comment><USER12> Anecdotally, ArchLinux has bitten me before with its rolling releases. They moved the hostname utility to a new package, but pacman (their package manager) didn't prompt or download the new package. This promptly broke my laptop's network stack right before I left for a weekend trip. Now I didn't have internet, and I didn't have internet to find out how to fix my internet. It all worked out fine by writing a bash script named hostname sitting on my path that echoed a constant string, so I could connect and download the new package.

If you are looking for a pain-free linux system, Arch Linux isn't it. You will run into little things like this, living one step behind the bleeding edge (basically someone compiles your software for you, does a sanity check, then you get it ASAP). Don't get me wrong, I love it, and will continue to use it as long as it has the most flexible and clean system, because I appreciate their dedication to simplicity of implementation.

<comment><USER13> I ran Debian unstable on my desktop for a number of years and the experience sounds pretty comparable. For the most part I just got working bleeding edge packages with minor quality control. Occasionally you would get some breakage (which was usually mentioned in apt-listbugs before upgrade anyway), and the nice thing about debian was I could either pin the package to the current more stable version, or if I had already upgraded I could just grab the previous package off of the debian snapshot mirrors.

<comment><USER11> I would argue that yes, debian unstable and arch are both rolling release distros, so the experience will be sort of similar, but I think that's where the similarities end.

Arch on one hand has a large user base (everyone) using the rolling release packages, this means that bugs get quickly found and squashed. There is also a testing repository which is used for the "base packages" so major bugs don't get get past into the "stable" repos. For example, kernel 3.1 is still in testing because of some problems that the testers experienced.

On the other hand, debian unstable has bitten me more than once very hard. So from my experience, it feels like debian does very little if any Q&A on debian unstable. I would compare Arch to Debian testing more since by then, packages have had some time to test and mature.

That said, I've experienced less crashs on arch than on any distro. Mind you I actually read the news. I honestly can't even remember the last time I've had a crash on archlinux.. maybe several years ago with some kernel update.

</comment></comment></comment></comment></comment><comment><USER14> Tried to install it last week, almost everything was done until GUI. Could not make to install & configure one of window managers.

<comment><USER15> What window manager are you talking about? And when you say install & configure, are you talking about compiling from source or installing via Pacman?

I only ask because I have never had a problem with a window manager on Arch.

</comment></comment><comment><USER16> Google cached version: [http://webcache.googleusercontent.com/search?q=cache:KJXbNFy...](http://webcache.googleusercontent.com/search?q=cache:KJXbNFyM7jwJ:standardsandfreedom.net/index.php/2011/11/06/archlinux- notforthe- elite/+http://standardsandfreedom.net/index.php/2011/11/06/archlinux- notforthe-elite/&hl=en&gl=uk&strip=1)

</comment><comment><USER17> I used Arch for a while, and really loved it... in theory. In practice, updates would often break things, especially when those updates were x.org- related.

Using Arch also really made me appreciate all the work Ubuntu does to make a desktop that isn't ugly. I found myself installing Ubuntu-patched versions of many Arch packages just to get things like a decent notification system and non-ugly fonts. (And even then, OpenOffice fonts never did work correctly.)

I was raised on Slackware, so I'm no stranger to DIY-style Linux, but these days I'm happy to install Ubuntu and have a working, decent-looking desktop system in 20-30 minutes.

That said, if I was looking to build a minimalist dev box or something other than a general desktop system, I wouldn't hesitate to install Arch.

</comment><comment><USER18> >The installation process may take a while (several hours.. or less)

It depends on what you're talking about. With relatively fast internet (I have 20Mb/s), I can have a functional box up with my favorite DE in just an hour or so. It's true that I configure things here and there for the next couple days as I need them, and each configuration is simple and only takes a second or two, but several hours seems a lot longer than the average install to me.

<comment><USER6> Two things helped me a lot with my Archlinux installation:

1) I previously tried in a virtual machine 2) I had a second machine next to mine to look up stuff in the wiki and follow the installation guide.

<comment><USER12> I agree. Arch Linux configuration is educational and well worth the few hours it takes on your first try, but you should definitely have another computer with the wiki open while you do it.

</comment></comment></comment><comment><USER19> Am I right in thinking that Arch is the new Gentoo?

<comment><AUTHOR> Gentoo spirit, without long compiling time.

<comment><USER20> I remembered my first time trying gentoo took some 12 hours to compile KDE... Well that was really long time ago.

</comment></comment></comment><comment><USER21> [..] Arch Linux is a very fun and stable distribution that successfully blends the bleeding edge, stability and hackability of Linux. Don't be fooled by the rumours saying it's for the elite. [..]

Agree! I have been using it for almost a year and the most atractive thing is the rolling release update. I don't have to worry about upgrading the whole system like others distros.

</comment><comment> exo-terrestrial Arch taught me a lot about my computer. I use a libre/Free Software distribution of it, Parabola GNU/linux-libre.

</comment><comment><USER22> "almost as easy than Ubuntu or any other distribution"

But if Ubuntu is easier, why not use Ubuntu?

<comment><AUTHOR> nano is easier than vim to use, so why everyone bother to learn vim then ?

Ease to use is not the only thing mater for everyone, and having something powerful, more customizable, more understandable, those kind of things mater to some persons.

<comment><USER22> You know, my question was serious. There are several reasons for using vim, like maybe you can edit faster if you know the commands, there are more plugins and so on. So if my question had been "why use vim instead of nano", there would have been possible reasonable answers.

But what is the advantage of Arch over Ubuntu? They are both Linux... My question was serious, I really don't know why I should prefer Arch.

<comment><AUTHOR> My answer was almost serious as well, and was answering the question "why not use Ubuntu if it's easier" and not "what is the advantage of Arch over Ubuntu?". They are two different questions.

Your question, now, is a much more open one, then more difficult to answer. This page try to explain the Arch Way <https://wiki.archlinux.org/index.php/The_Arch_Way>

I wrote something that tried to explain why AUR is an important part of Arch Linux [http://www.nicosphere.net/why-aur-is-part-of-the-arch- linux-...](http://www.nicosphere.net/why-aur-is-part-of-the-arch-linux- success-2529/)

<comment><USER22> I thought my question was kind of the same. If there is no advantage of Arch, then it doesn't make sense to use it if it is harder to use. Unless you want to work on improving Arch.

<comment><AUTHOR> You're right, if Arch would not have some advantages, nobody would use it.

Simplicity of use, packaging, configuration, understanding. No default choices as Unity, it's light and fast, a great distro to learn from, great community and documentation, and much more, that make Arch a great distribution widely used.

<comment><USER22> If packaging really is easier, it might be interesting. It seems to be quite complicated to create debian packages.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> that's it ... i'm moving to gentoo.</comment>


LinkedIn, others show why transparency is needed - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2011/11/11/BUKH1LSL96.DTL&type=tech <comment><USER2> I don't really understand the logic of easing disclosure requirements. It seems like just a way to play the greater fool theory even further.

Perhaps they should focus on building better companies than trying to hide their problems and weaknesses.

</comment><comment> brown9-2 Why is a dearth of IPOs a bad thing?

Isn't it pretty naked when the private equity and venture capital funds that profit mostly from IPOs are the ones asking lawmakers to ease the rules?</comment>


Nginxconfig.io - <AUTHOR> https://nginxconfig.io <comment><USER2> Why not just post the URL to the thing instead of a URL to something that just redirects to the thing?

[https://www.digitalocean.com/community/tools/nginx](https://www.digitalocean.com/community/tools/nginx)

</comment><comment><AUTHOR> nginxconfig.io redirects to an nginx configuration builder from Digital Ocean. It's an easy(or easier) way to build an nginx configuration.</comment>


Petition the White House to veto EARN IT - <AUTHOR> https://petitions.whitehouse.gov/petition/reject-earn-it-act-s-3398-which-threatens-free-speech-encryption-privacy-and-nations-cybersecurity <comment><USER2> I read it, and the first sentence says "The EARN IT Act intends to combat child exploitation online". That's the worst thing you could lead with. It makes it sound like to support you, I must be in favor of child exploitation. It is the political equivalent not just of putting your foot in your mouth, but opening your act with it. How else could the White House respond but by restating its commitment to combating child exploitation? That is nonsense of course, but managing such nonsense is the political art. You need political logic, not real logic.

It's the same reason why they use names like the "EARN IT" act, so anyone who opposes it looks like they're against EARNing things. It's American to EARN things, what are you a commie? If you're opposing people like this, don't make your opponent's moves for them. Lead with your strong point, which is that this would destroy security on the internet, undermining national security and making it easier for criminals to steal your identity and bank account.

</comment><comment><USER3> Previous discussion on EARN IT and its place in killing e2e [https://news.ycombinator.com/item?id=22202110](https://news.ycombinator.com/item?id=22202110)

</comment><comment><USER4> They tried this with SOPA and PIPA like 8 years ago, and about 12 years before that. Although I'm glad to see Lamar Smith isn't anywhere here. He was the jackhole who tried forcing that...many times.

</comment><comment><USER5> Why do all American laws have such stupid names?

<comment><USER6> It's marketing to stupid people.</comment></comment>


Defense Companies Warn Thousands Of Layoffs Imminent Due To Shutdown - <AUTHOR> http://www.forbes.com/sites/lorenthompson/2013/10/04/defense-companies-warn-thousands-of-layoffs-imminent-due-to-shutdown/ <comment><USER2> To provide a contrary viewpoint here, NPR's Planet Money had a rather good piece a few weeks back on the downsides to drastically scaling back Military Contractors.

The basic gist is that if contractors that supply all of one component or product dry up, those former employees don't just stay unemployed, they go to work in other industries. But, if in 5, 10, or 20 years, you decide you actually need that component or product again, you can't just flip a switch and re-activate manufacturing. The knowledge is gone, all the workers you had who were trained in the process have gone into new fields, and rebuilding your military production infrastructure is very painful. For a good example of this in recent years, FOGBANK.

FOGBANK was a mysterious classified material critical to creating nuclear warheads. Following the turn-down of the cold war and missile reduction plans, the manufacturing plant was mothballed. And the process for creating it was so secretive that no one remembered quite how to make it. Decades later, when aging missiles needed replacements, the process for manufacturing was lost and scientists couldn't reproduce the process based on the information left behind. The US government ended up spending _a decade and over eighty million dollars_ just to research and _rediscover_ the manufacturing process for this one particular component.

[http://en.wikipedia.org/wiki/FOGBANK](http://en.wikipedia.org/wiki/FOGBANK)

Obviously FOGBANK is an extreme case, but it's a fair point worth considering. Drastic cuts to military contractors may leave large holes in military supply, especially of sensitive and classified materials.

NPR Planey Money episode: [http://www.npr.org/blogs/money/2013/08/23/214928040/episode-...](http://www.npr.org/blogs/money/2013/08/23/214928040/episode-482-why- the-u-s-keeps-sending-weapons-to-egypt)

<comment><USER3> Here's the thing... It is _not_ in a military contractor's best interests to properly document and mothball any knowledge or capability so well that it can be handed over to the government, stuck in a warehouse for decades, and be dusted off by someone completely different without difficulty. Doing so is tedious, expensive, and makes the contractor instantly replaceable. Failing to do so is cheap, fast, easy and improves their odds of getting future business!

The flipside is that it's impractical to pay companies to maintain the capacity to build everything they've ever built for all time. Imagine what it would cost IBM to keep people trained in building new versions of every product they've ever invented! If it costs billions to adequately document and mothball the construction process for every wheel you've ever made, but it only costs millions to reinvent the occasional wheel, what do you do?

<comment><USER4> _The flipside is that it 's impractical to pay companies to maintain the capacity to build everything they've ever built for all time._

The defense contractors handle that problem by putting those people on other projects. Sometimes it is productive work, sometimes it is just any project with a budget surplus. Their intent is to maintain institutional memory even if the project itself has been mothballed.

That's what I saw happen to people numerous times while working as a consultant to a couple of DoD contractors. I billed a crazy-high rate and they even shuffled me off onto a peripheral program in order to keep me around as a sort of security blanket for the original program that was (slowly) spinning down.

</comment></comment></comment><comment><USER5> If a normal business were as fiscally irresponsible as the US Government, all of its employees would have long since been out of a job. I find it bizarre that people apply a different financial standard and expectation to a nation's finances as they would to their own or a business'.

The massive deficit spending, financed by the Fed, that keeps all of these jobs going, is mostly in fact funded out of the pocket of Americans without their knowledge. If we were forced to balance the budget tomorrow, a million people would lose their jobs. Given the guaranteed increase in the cost of debt over the next decade, that tells you exactly what is going to happen to all of these jobs given our national debt will climb past $20 trillion (just 5% on $15 trillion wipes out social security or the US military).

This shutdown will end very soon, despite the hoopla. Not one of the major financial problems that America has will be resolved however. An even bigger disaster will merely roll closer.

The most surprising thing about what's going on, is the fact that so many people dependent on government largesse have for so long been spared the consequences of the out of control financial problems in DC.

<comment><USER6> Anyone still remember how those banks got bailed out by the government? Wouldn't it be nice to have the gov save your company every time you do something stupid :-)

<comment><USER7> It would also be nice if my company could print it's own money, and I could pick up a gun and jack the company next door and steal all their resources or extort them without any legal repercussions. It would also be great if my employees had to pay me back a tax everytime I gave them a paycheck so I could get some more guns.

<comment><USER8> I too would enjoy the franchise wars and have every restaurant called Taco Bell.

</comment></comment></comment></comment><comment><USER9> So basically we're not making as many weapons, in which case you won't hear me complaining.

<comment><USER10> Not trying to refute your point, nor even argue that we need a bunch of nuclear weapons; but nukes have a shelf life. They have to be maintained / reconditioned periodically.

<comment><USER11> Or we could eliminate this as an issue and decommission them.

<comment><USER10> Hey! That sounds like something that some kind of hippie peacenik might say, or Ronald Reagan. Besides, it makes too much sense.

</comment></comment></comment></comment><comment><USER12> The first thing all these people do the day they are laid off is file for unemployment (justifiably).

So this passes all the costs onto the states.

I am wondering why state governments aren't foaming at the mouth yet about this.

<comment><USER4> _The first thing all these people do the day they are laid off is file for unemployment (justifiably).

So this passes all the costs onto the states._

Unemployment insurance is primarily paid for by payroll taxes that go into a dedicated fund. That probably doesn't apply when the federal government decrees an extension to unemployment benefits, but the first 180 days or so come from that dedicated fund.

My understanding is that the payroll tax varies based on the historical rate of lay-offs. So a company that regularly lays people off (say a hollywood production company that lays people off at the end of every movie project) will have a higher payroll tax than a company with much better employment continuity. I could be wrong, that's just what I've been told and I have not dug into the details, although I did marry a woman who works in movie production.

</comment></comment><comment><USER13> I'm not an American, so this question may be rather uninformed: why doesn't this "furloughing" lead to a rash of "fsck you, pay me"? I know labor protection isn't that strong, but contracts still mean something and plenty of these workers are sufficiently unionized that they can't just be fired.

<comment><USER14> In cases where unions are involved, the terms of the furloughs are usually negotiated with the unions beforehand. I don't know about contractors specifically, but for civil servants, their unions were definitely involved in the furlough negotiations during sequestration. In this case I don't know how much they'd get to say since the entire federal government has shut down and the issues go all the way to the highest parts of the government.

Also keep in mind furloughs are not layoffs - just unpaid leave.

<comment><USER15> >Also keep in mind furloughs are not layoffs - just unpaid leave.

they pay back the salary for the furloughed days once shutdown ends - at least that happened to gov employees after previous shutdowns

<comment><USER16> >they pay back the salary for the furloughed days once shutdown ends

And here I thought that the sliver lining of the shutdown was that the government would spend less taxpayer money this year!

So much for that hope.

<comment><USER17> I'd be surprised if chaotic, unorganized spending cuts would actually save money in the long run.

</comment></comment></comment></comment></comment><comment><USER18> Welfare through military spending.

</comment><comment><USER19> Lay them all off already, give our privacy back.

<comment><USER20> What I get confused about and fail to understand, is why people get excited about hearing that others are being furloughed. What's so good about people not being able to support their family, or possibly default on debt and even worse allow city and state budgets to shrink? We all lose together.

<comment><USER21> Isnt that whole shutdown about spending ? well this is where money could be saved, by aborting all these expensive and useless weapon deals, instead of cutting food stamps for the poor. US society dont need new tanks, drones or missiles. Let's cut defense spending.

<comment><USER22> No. The shutdown is about a minority faction of the GOP trying to repeal the Affordable Care Act which is already funded. It has nothing to do with spending.</comment></comment></comment></comment>


Ask HN: What software engineering process for startups? - <AUTHOR>

What kind of engineering process do you want for a startup?
Typically you want to iterate fast, adding/changing features as necessary. Unit test make code harder to change (you may need to fix broken tests) but also more reliable (you can be pretty sure you didn't miss anything if the unit test all pass). If you have many people working on the same code, you typically need to agree to certain things ("architecture") in advance and set it in writing as a design doc. If it is just one or two guys writing code and talking to each other, isn't that too much overhead?
To set some baseline, Google apparently did design docs, code and design reviews, and unit tests from the start. OTOH, it seems PG doesn't write unit test, at least there were no unit tests in the Arc/Hacker News source code release. He obviously doesn't write specs or design docs as he prefers exploratory programming.
What do you practice and why? <comment><AUTHOR> In a current project I do mostly exploratory programming (figure out the code structure as I go), but I will probably also have automatic tests that exercise large chunks of the application at once, from user perspective, without going into any detail. These are supposed to serve as smoke tests, ringing the alarm if I broke anything big.

</comment><comment><USER2> Exploratory programming to play with ideas and concepts and to quickly prototype and evaluate things.

Once a clear vision/direction is established, I switch to a more test driven development model more to ensure robustness and iron out errors than anything else.

</comment><comment><USER3> agile/xp. release early. release often. a startup in its infancy needs to get the product out fast.</comment>


Ask HN: Good books on the history of computer science? - <AUTHOR>

I like computer science, but I would like to know more about it's history. Any good book recommendations? Maybe a good book on the overview and then some good ones on specific aspects (business, technical, biographies, etc.) <comment><USER2> Computing: A Concise History by Paul E. Ceruzzi

From Airline Reservations to Sonic the Hedgehog: A History of the Software Industry by Martin Campbell-Kelly/

The Computer History Museum is in Mountain View, CA, part of Silicon Valley, close to the Googleplex and Microsoft SV. It has the second, working Babbage Difference Engine. Also a youtube channel of lectures.

<comment><AUTHOR> Cool, I'll take a look that those. I didn't get around to seeing the computer history museum this summer, maybe another time. It sounds awesome!

</comment></comment><comment><USER3> While not a complete history, the following book, 'Design and Evolution of C++', does go into some history of other languages that influenced C++:

[http://www.amazon.com/The-Design-Evolution-Bjarne- Stroustrup...](http://www.amazon.com/The-Design-Evolution-Bjarne- Stroustrup/dp/0201543303)

If you happen to be in bay area, visiting the 'Computer History Museum' is a good start too:

<http://www.computerhistory.org/>

</comment><comment><USER4> _Hackers_ by Steven Levy, if you haven't read that yet

<comment><AUTHOR> Thanks, I'll check it out!

</comment></comment><comment><USER5> Turing's Cathedral

Darwin Among the Machines

Technomanifestos

Possiplex

What Technology Wants

A couple of not computer related, but quite interesting books-

The Structure of Scientific Revolutions

A Thousand Years of Nonlinear History

</comment><comment><USER6> I enjoyed this one: <http://www.codersatwork.com/> A bunch of interviews with famous coders.

</comment><comment><USER7> CODE by Charles Petzold might be worth it.</comment>


Man on death row for 30 years exonerated, freed. - <AUTHOR> http://cir.ca/s/GNz

<comment><USER2> Here's a link to a story with more than 5 sentences.

[http://www.washingtonpost.com/news/morning- mix/wp/2014/03/12...](http://www.washingtonpost.com/news/morning- mix/wp/2014/03/12/after-nearly-30-years-on-death-row-glenn-ford-is-exonerated- and-free/)

<comment><USER3> Much better. Thank you.</comment></comment>


You Can't Launch the Next Generation of Startups Without Women - <AUTHOR> http://www.readwriteweb.com/start/2010/02/you-cant-launch-next-generation-startups-women-diversity.php

<comment><USER2> I can't help feel there is a little tension between:

1) Women founders are disproportionately in their 40s, with families and careers and mortgages. We can't be expected to drop everything and fly across the country to attend a startup incubator program. Instead, we need to receive large amounts of money on the strength of a napkin or Powerpoint deck.

2) Those darn twenty something male techies keep wanting to get paid salaries. Don't they know they're supposed to work for free in promise for 2% of the profits after we get rich?

Tell you what, ladies: I didn't crawl out of the womb knowing how to build web applications. I studied it in school and then made stuff. How's about y'all bang away on that for the next twenty years or so, and then I'll give you the napkin to implement. You can have 2% of the profits after you make me rich.

Sounds like a great deal, right?

<comment><USER3> This article is incoherent and you appear to be both dignifying it and contradicting yourself. How un-McKenzian of you!

First, barely a cobweb strand of logic connects the point of this article to gender. "If I had a nickle for every time I've heard that you can't get a startup founded without an engineer". What does this have to do women? Either of my younger brothers (both of whom work in the arts) could make the same complaint.

Second, the idea that funding and attention is inappropriately piled on a narrow slice of young males is a point I think I've seen you make about 100 times on Hacker News.

(If I wanted to further engage with this article --- and I don't, really --- I'd also point out that the "accelerators" and "incubators" and whatnots that this author feels women are excluded from aren't really blessings. A point I feel like you'd at least sympathize with, since you built your company up on 5 hours a week of downtime off being a salaryman).

<comment><USER2> I don't think it is a contradiction to say "Tech people overbuild for tech people" and "If you want tech people to work for you, paying them market wages is kind of a good idea."

(I agree that there are a bunch of options aside from "seek funding" and "draw yourself into the Valley culture" if you want to think outside the box for your startup. No money, no time, can build stuff: I have useful suggestions for you. No money, no time, can't build stuff? I have no useful suggestions for you, aside from "well, learn to build stuff and then we'll talk.")

</comment></comment></comment><comment><USER4> There's a very good point buried in this article: Technology-oriented startups tend to have some heavily skewed demographics, not just in gender, but in socioeconomic background, political leanings, tastes in entertainment, etc, and the kind of things startups do tend to reflect those demographics--which isn't unreasonable, since it's easier to market to one's own general peer group. So it does seem likely that there are startup opportunities that get overlooked because they don't appeal as strongly to the stereotypical programmer demographic.

That said, I'm not sure what manner of confusion would lead to using the term "entrepreneur" for someone who has neither the resources to fund their "big idea" nor the skills to implement it. If you have an idea and want to make it happen, just _go do it_. If you don't know how, _learn_. It's not that hard!

</comment><comment><USER5> _[...] Today non-technical entrepreneurs are just as likely to come up with viable startup concepts as programmers are. Neither the startup system, nor the traditional support system for small, brick-and-mortar businesses reflect this societal change yet, so there is a void that needs to be filled or we'll miss out on opportunities for innovation from unlikely sources._

Non-engineering women, I'd like to meet every non-engineering MBA trying to break into startups. You guys should talk. I think you'll find you have a lot in common.

</comment><comment><USER6> I don't really like this article, in that I know of plenty of successful startups started by women or that had a lot of women involved during the early days.

In short, I reject the idea there is any kind of glass ceiling or whatnot, especially when "the idea" plus 3 knowledgeable people working out of a garage, is all you need.

<comment><USER7> _"... I don't really like this article, in that I know of plenty of successful startups started by women ..."_

Examples? Part of the problem is perception of avoidance and the other problem, Women tech founders are scarce.

<comment><USER8> VMWare.

<comment><USER7> _"VMWare"_

Didn't know about that one. That would be <http://en.wikipedia.org/wiki/Diane_Greene>

</comment></comment></comment></comment><comment><USER7> _"... There are two things happening here. First, the suits are taking over and, second, the pioneers are going gray. Together they make up the startup establishment. But things have changed since the early days, and this establishment hasn't kept up with the times. The current startup system essentially excludes the untapped pool of innovators who aren't developers - for example, women who want to launch Internet startups. ..."_

I see a lot more interest in women wanting to create startup companies but not a tech startup. I'm not entirely sure why? I have a suspicion that it has to do with being seen to be geeky, being seen to stand out. Apart from the fact there are fewer women techies, I've also read articles describing younger women being sensitive to peer signaling. [0] I suspect younger women who choose technical and founder paths have to overcome this. Older women founders have the skills, confidence to not be distracted.

[0] I'll find the article. It was about young women watching for signaling for mate selection as a evolutionary shortcut. I wager this is one factor underestimated. Other females think Startup's are risky, the rest sans a few take notice.

</comment><comment><USER9> watch me.

</comment><comment><USER10> psst: www.makeupalley.com <\-- has been around for at least 10 years. lots of copycats, but i'm pretty sure it was the first of its kind. certainly the first social networking site i joined; makeup alley predates orkut. founded by a woman named hara glick. my point? women are consumers. they will buy stuff. just ask tony hsieh. even make has a craft mag. so put your metrosexual shoes on and find yourself some girl friends.

</comment><comment><USER11> There is more than one right way to start a business. The establishment doesn't need to change, nothing precludes women from figuring out their own way.</comment>


Official Spotify Web Player - <AUTHOR> https://www.spotify.com/uk/blog/archives/2013/03/20/want-to-try-our-new-web-player/

<comment><USER2> Does it work on ChromeOS, too?

<comment><AUTHOR> Looks like they have gone down the flash route - so no.

I assume part of that decision is to make sure it doesn't work on mobile and avoid cannibalising their premium subscriptions where playing on mobile is a big feature.

<comment><USER3> Are there problems with running flash on ChromeOS?</comment></comment></comment>


About backdoors in crypto messengers - <AUTHOR> http://blogs.fsfe.org/larma/2017/signal-backdoors/ <comment><USER3> Some observations, 1\. At this point its extremely hard to use XMPP - <USER2> are too many competing standards that implements encryption (of which a subset has forward secrecy), and if sender server doesn't implement any the other end does, usually falls back to plain text, one can disable it - but this is just too much overhead for a regular user. (food for thought [1])

2\. Again, reminder from countless HN comments - there is a PR in works to make GCM optional[2], as soon as its merged, this will be solved

3\. Maps seems to the real problem here: this could be disabled after 2? (otherwise, whats the point?)

[1] [https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/) [2] [https://github.com/WhisperSystems/Signal- Android/pull/5962](https://github.com/WhisperSystems/Signal-Android/pull/5962)

edit: formatting, forward secrecy not e2e

<comment><USER4> Conversations is a great XMPP client. It works very well, support inline images, stream resumption and everything.

The OMEMO standard brings the Signal protocol to XMPP and it works great. I use Conversations for my hacker friends who refuse to install Signal (GCM dependency!) and surprisingly, I'm not missing a lot.

Now we only need a desktop client that supports the same features... And iOS (but TextSecure is making progress there)

<comment><USER5> > Now we only need a desktop client that supports the same features... And iOS

For iOS ChatSecure was just released with OMEMO support [https://chatsecure.org/blog/chatsecure-v4-released/](https://chatsecure.org/blog/chatsecure-v4-released/)

Regarding desktop clients, I can recommand Gajim which also has a OMEMO plugin.

</comment></comment></comment><comment><USER6> The backdoor referred to can be applied to any Android app that uses Google Maps. Also mentioned is that using the built-in Google keyboard is a vulnerability, because in theory it gives Google the ability to keylog you.

I supposed this boils down to knowing your adversaries. If you number Google amongst that list, life is going to be really difficult - no matter who you are.

<comment><USER7> I guess it mostly boils down to Moxie and his ridiculous claims of how much more secure Signal is when compared to other solutions (like XMPP and anything based on PGP).

Don't get me wrong, I understand the design and user experience decisions of making Signal depending on GCM but Moxie just loves to bash on XMPP and federated protocols and putting Signal on a pedestal of exemplary security.

I admire the dedication on putting together the Axolotl protocol but I hate when he mixes his business interests with secure crypto solutions, because by the end of the day that is what he wants, to sell Axolotl to companies like Google and WhatsApp. And of course, bashing on XMPP is just a business pitch to those companies.

<comment><USER8> It's not Moxie doing that, it's virtually the entire community of cryptographic engineers. And Open Whisper Systems is a grant-funded nonprofit that until recently could so barely afford developers they were considering withdrawing their iOS version, so the idea that this is all about Moxie's business interests is horseshit.

</comment></comment></comment><comment><USER9> If you're considering Google an adversary, perhaps you shouldn't use stock Android, or any of their software.

If you're considering Google an adversary, and use a version of Android without Google support, you can't use Signal anyway.

<comment><USER10> Actually, it is possible to use Signal on Android without Google using the opensource microG and Xposed framework (setup is a bit involved...but you can google that :P for a guide).

<comment><USER11> This still relies on Google's servers to support push messages FYI.

<comment><USER10> "without Google _proprietary code on your phone_ "

</comment></comment></comment></comment><comment><USER11> >tl;dr: There is a "backdoor" in Signal nobody cares about, only Google can use it.

Speak for yourself. This backdoor is the reason why I don't use Signal.

<comment><USER12> You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware?

Why even use a phone?

<comment><USER11> I don't use Signal because of Google Play Services, which is the backdoor this article refers to.

I'm reasonably confident that my phone's OS is uncompromised and I take the radio problem into consideration as part of my threat model and change my behaviors on my phone accordingly. I have also made some progress on using OsmocomBB as a radio baseband, and on building a custom phone that treats the radio as hostile and isolates it as much as possible.

<comment><USER13> Which device are you using OsmocomBB on? Which custom device are you building?

Neo900 looks pretty good for baseband isolation.

The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though.

Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.

<comment><USER11> >Which device are you using OsmocomBB on?

A Motorola C139.

>Which custom device are you building?

A, uh, custom one.

>The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though.

>Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.

Yeah, I'm keeping both of those things in mind. There won't be any assumption that your phone calls or SMS will be secure, but rather that your mainboard OS is secure _from_ the radio and that you don't have to worry about discussions had near your phone and such.

</comment></comment></comment></comment></comment><comment><USER14> for the record, firefox for android also integrates the google backdoor for the sole purpose of allowing chromecast for videos... which zero users use or want.

<comment><USER15> Speak for yourself, Chromecast is very useful. Though obviously you should be able to turn it off.

<comment><USER14> it is usefull but not in a browser.

firefox will never be better than mx or vlc for video. those apps should have chromecast support.

</comment></comment></comment><comment><USER16> It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised.

Is there open source alternative for Signal?

<comment><USER17> You don't have to look far. The actual Signal client source is licensed under GPLv3.

Edit: And server code under AGPLv3.

<comment><USER10> well LibreSignal was shut down because Moxie didn't like them using WhisperSystem's servers. I guess the libre community could figure out how to setup and fund an alternative server, but since Signal's server code isn't _federated_ , then I don't believe there would be a straightforward way to send messages between the two systems.

[https://github.com/LibreSignal/LibreSignal/issues/37#issueco...](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165)

<comment><USER18> Moxie and Whisper Systems is clearly against decentralization and federation, based on that blog post they wrote. This means it's unlikely that Signal is ever going to have any support for federation.

<comment><USER19> _> This means it's unlikely that Signal is ever going to have any support for federation._

Signal _had_ support for federation. Their server was federated with Cyanogen's for a while[0]. That being the disaster it was is why that blog post happened and no one seems to be forthcoming with solutions to the problems they had.

[0] [https://whispersystems.org/blog/cyanogen- integration/](https://whispersystems.org/blog/cyanogen-integration/)

</comment></comment></comment></comment></comment><comment><USER20> tl;dr: this is stupid.

People seem to love analyzing security of tiny corners of systems while ignoring the rest of the system, and entirely avoiding figuring out a scope for the security.

The post complains about Signal using a Google service, that Google could utilize (either now or through an update) for malicious activity. A Google service that without a fair share of poking around is only available on _Google_ versions of Android. I mean, _what_.

While this is a more serious problem than the usual whine about GCM (Yes, notifications can give a lot of info, but in case of Signal, the info given is "You received something from some Signal user while you were offline"), it is still amazing how blind the analysis seem to the environment. If you cannot trust Google to provide a "non-evil" Google play services, why the flying fuck do you think the Google-provided (or manufacturer-under-tight-google-control- provided) OS is fine? They could backdoor the process isolation and poke around at Signal memory if they felt like it.

Now, if you are security conscious and willing to let go of the conveniences of selling your soul to Google, you would be running a non-Google'd version of Android without Google services. Your only valid complaint in this case, is that Signal depends on Google services to operate, which makes you unable to use it (without hacking Google back into your Android version, but if you do that you might just as well stick to a Google version).

Oh, and what about the black box binary drivers you are using on your super- secure handset? Baseband? CPU (ME anyone?)? SIM card?

Before you talk about security, figure out what you are trying to protect against, and start from the top. You look like an idiot if you complain about breakable windows but do not notice that the door is open.

<comment><USER21> Your entire comment is based around the "but there are bigger problems" argument.

That's like saying you shouldn't fix your leaking engine, if your brakes don't work.

<comment><USER8> This analogy is basically perfect.

</comment></comment></comment><comment><USER22> Can we please stop calling these types of vulnerabilities "backdoors"?

<comment><USER21> Why? It's a backdoor.

</comment></comment><comment><USER21> >This code is included by calling the createPackageContext-method together with the flags CONTEXT_INCLUDE_CODE and CONTEXT_IGNORE_SECURITY. The latter is a requirement as the android system would deny loading code from untrustworthy sources otherwise (for a good reason). The code is then executed in the Signal process, which includes access to the Signal history database and the crypto keys.

\</comment><comment></comment><comment></comment><comment></comment><comment>---

Glad someone points out the technical details of why many people had doubts about signal. Unfortunately, Moxie will dismiss it, and his following will claim "it affects other apps too" as if that makes it any better. "Other apps do it too" is not the standard a "privacy" app should aim for.

</comment><comment><USER23> Blog seems to be down, and cannot find a cached version in Google :(

<comment><AUTHOR> [http://webcache.googleusercontent.com/search?q=cache:OSLZXIu...](http://webcache.googleusercontent.com/search?q=cache:OSLZXIubGtAJ:blogs.fsfe.org/larma/2017/signal- backdoors/+&cd=1&hl=de&ct=clnk&gl=de) works for me (better use text only version as Google tries to load css from the server apparently)

</comment></comment><comment><USER24> It difficult to see how a service that ties to your phone number can make any claim about privacy halfway seriously. This is reckless.

And worse tie itself to a company whose business model is based on creepily stalking you all over the internet and getting users psychologically accustomed to the fact they are under surveillance. These are serious escalations that go unnoticed because SV has become a magnet for those who want to profit from it.

A half way serious and sincere effort will be open source, not tied in any remote way to known surveillance companies, and based in a country that genuinely respects privacy.

<comment><USER10> The claim is secure transport only. They have never made a claim that adversaries won't be able to detect that you are sending encrypted messages.</comment></comment>


Adi Shamir not permitted to RSA Conference due to lack of visa - <AUTHOR> https://twitter.com/Laura_K_Bate/status/1102991077638717441 <comment><USER2> History repeats itself: [https://fas.org/blogs/secrecy/2013/10/shamir/](https://fas.org/blogs/secrecy/2013/10/shamir/)

For added fun, compare comments on the 2013 version with comments on the 2019 version.

</comment><comment><USER3> The Register article about this discussed on HN here: [https://news.ycombinator.com/item?id=19313698](https://news.ycombinator.com/item?id=19313698)</comment>