Don't Store Passwords, Generate Them When Needed - <AUTHOR> http://16s.us/sha1_pass/why/

<comment><USER2> However, this IS a master password only with a salted hash added on top. From the FAQ it uses a phrase like "Tubby loves tacos!facebook" runs it through SHA1 and spits out Facebook's password. Someone who shoulder surfs your keyphrase can now use this technique to generate passwords for any site, whereas using something like Password Safe or the various other password storage methods would need to both shoulder surf your master password as well as obtain your encrypted password file.

<comment><USER3> It's not only been done, "master password with a salted hash" is broken. If I can convince you to log in to face.com ("Tubby loves taco's!face"), I can find the hash of "Tubby loves taco's!facebook". This is because SHA1("Tubby loves taco's!facebook") is just SHA1-sub(SHA1("Tubby loves taco's!face"), "book"). See "length extension attack" for more details.

More generally, hash functions are collision-resistant, but the output is _not_ (pseudo)random.

<comment><USER4> That's easily fixable by using an HMAC, as the author should have done in the first place.

Does this attack actually work, by the way? Don't you need to also be lucky with the padding and have the plaintext be an exact multiple of the bytes in the round?

<comment><USER3> Yes, HMAC is (one of) the right solution(s) here. On the other hand, do you trust the rest of the program if the author gets this wrong?

The attack does work, see e.g. <http://www.vnsecurity.net/t/length-extension- attack/>. This example suggests that any padding should not matter; and even if it does, being able to mount this attack on a substantial part of visitors is bad. (Sorry for being vague here - I don't have the time to look at this properly now.)

</comment></comment></comment></comment><comment><USER5> I've been using HMAC-SHA1 as a basis for my passwords for awhile. I call my algorithm "Passy". It works like this (pseudocode'ish).

        # generate our HMAC
        hash = generate HMAC-SHA1 (facebook.com, passphrase) (String)
        hash += SHA1(hash) # just need the extra length

        # transform hash into a Passy
        passy_chars = "ABCDEFGHabcdefgh23456789#$%*+=@?"
        passy = ""
        foreach octet in hash (starting with MSB)
          passy += passy_chars[octet % 32]

        # figure out the length of this passy
        for i in 16 to passy.length
          if passy.substr(0,i) is "good", return passy.substr(0,i)
            where good means includes at least one from each of [A-H], [a-h], [2-9], and [#$%*+=@?]

I've implemented this in CoffeeScript, and have a minified version up here: <http://dl.dropbox.com/u/11596/passy-tiny.html>

I have evolved this algorithm over the past decade. My requirements:

      1. minimum of 80 bits of entropy (16*32=80)
      2. must include at least one symbol, one uppercase, one lowercase, and one digit
      3. base it on cryptographically secure hash algorithms
      4. avoids confusing similar symbols O and 0, l and 1 and !, etc.

I realize that requirement #2 does nothing to increase entropy. It's simply there to satisfy (idiotic!) password requirements.

With any of these systems, your generates passwords are still only as good as a) the strength of your passphrase, and b) the secrecy of your passphrase. As well as the obvious (physical security, keyboard sniffers, etc.)

<comment><USER6> I use a mnemonic algorithm to generate site specfic passwords instead, but this is _really_ nice. Do you happen to have the source on github, or would you mind putting it up there?

<comment><USER5> Sure, it's here: <https://bitbucket.org/swaits/passyweb>

It's not documented other than with comments, although I think the code is readable. You'll find test vectors in the source.

And, thanks!

</comment></comment></comment><comment><USER7> I use passwordcard (<http://www.passwordcard.org/en>) as my password manager,

1) All my passwords are stored on a piece of paper, in plain text. There is no need to encrypt, because only I know how I use it.

2) I don't need to back it up regularly. Just one backup, in case I lose the card, is enough.

3) Because I have to type in the passwords from it, I actually remember the ones I use regularly, so even if I lose the cards, I can log in to most things.

4) There is no "master password" to be exposed.

5) If I'm stupid enough to read it out loud, or run my finger along it whilst someone is watching, I might expose the parameters of one password, but everything else is still secure.

6) It is a piece of paper, the browser integration goes via my eyes and my fingers.

<comment> loup-vaillant Variation on that theme: <http://blog.jgc.org/2010/12/write-your-passwords- down.html>

I did an implementation of it (<http://www.loup-vaillant.fr/projects/password- generator>)

</comment></comment><comment><USER8> Here is what I do:

      require 'digest/sha1'
      puts "doubly troubly"
      thing = gets.chomp
      base = Digest::SHA1.hexdigest(Digest::SHA1.hexdigest(thing))
      puts base
      puts base[0..3] + "^!!^E" + base[4..-1]
      puts base[0..3] + "^!!^E" + base[4..6]
      puts base[0..3] + "^!!^E"

For any site I input the domain (so "zach.tumblr.com" + my_salt would be inputed) then I copy one of the four outputs based on what security level I think the site deserves. THEN (and most critically) I add a password that rotates key characters based on factor X of the site. Think about this like a normal password, but it changes.

I then expose this little piece of code on every one of my computers as well as on a protected server that lives only on an IP.

I 100% agree with this article, but I have my own system and it works well.

<comment><USER9> You might as well switch that to a proper HMAC. Check out HMAC::SHA1.digest

<comment><USER10> Indeed. I rolled my own UI for doing this with HMAC because everything else seemed to be implemented with cargo-cult voodoo (I just read the SuperGenPass FAQ again to check... MD5 10 times? WTF? If 1 is not enough why are you using it? No personal offense meant to whoever wrote SuperGenPass, but it's not what I wanted. As for the parent comment... I don't know what to say).

Shameless self-promotion link, if interested: [https://chrome.google.com/extensions/detail/mjafhhefmkfchamf...](https://chrome.google.com/extensions/detail/mjafhhefmkfchamfkcegnafkpjohcllp)

</comment></comment></comment><comment><USER11> How is remembering the pass-sentences different from remembering passwords?

<comment><USER12> Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols.

You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".

<comment><USER13> I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute- forcing your passphrase, not the password it generates.

I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, since you're led to believe these SHA1 passwords give you the same security as standard, locally- stored generated passwords.

<comment><USER14> Passwords are not "security by obscurity".

<comment><USER15> The "obscurity" is the idea that an attacker would not know that you were generating your passwords by SHA-1 hashing a passphrase.

If the attacker did not know that, they could only brute-force your account by trying every possible string of characters, which is fine, because there are a lot of those. If, however, they knew what you were doing, then they could generate a list of likely-seeming passphrases, hash those, and try those hashes as passwords. If there are fewer likely passphrases than there are strings of characters, this shrinks their search space. Also, once they know you're using passphrases, they might also know that some phrases are much more likely than others, so they could try those first. This would give them a good chance of finding your password even more quickly.

</comment></comment></comment></comment></comment><comment><USER9> So, basically we've just recreated <http://supergenpass.com/> which has been around for at least a decade. And I'm sure the idea is older than that.

What happens when the generated password doesn't meet the strength requirements for the site (too long/too short, not enough/too many numbers, not enough "special characters")? Or when I'm required to change my password periodically?

<comment><USER16> The way I was going to handle that when I designed my own password generator to replace my encrypted text file of passwords was to store a version number of each site. The version number would be part of the input to the hash. Changing the password for a site then would just require changing the version number.

Requirements and restrictions on the password content could be handled similarly, by storing password formatting information for each site.

I never got around to implementing my system, because I got a fantastic deal on 1Password (via MacHeist) and my system became completely pointless.

</comment></comment><comment><USER17> My solution is to use Keepass. It stores passwords in an encrypted database file which I store in Dropbox - that solves the machine synchronization problem.

The main database is protected by a passphrase and/or keyfile (any file which won't change e.g. ~/Dropbox/Photos/2008/France/Photo5.jpg). One advantage of this is that a simple keylogger will be stumped by the keyfile - even if your passphrase is recorded an attacker still needs Photo5.jpg to decrypt the database.

It's originally a Windows app (<http://www.keepass.info/>), but is open-source and there's a fully featured Linux/OSX port called KeepassX (<http://www.keepassx.org/>)

</comment><comment><USER18> I've tried a technique like this, it works wonders if you are near a computer and can copy/paste. As soon as you have some flash login box where you can't paste or you try to log in from your iPhone it becomes extremely painful.

Better to use the age old technique found in "Unix System Administration" by Evi Nemeth: Choose a well known phrase or poem or song lyrics. Then pick a letter from each word, and interpolate some weird chars. E.g.

Yellow Submarine In the town where I was born, Lived a man who sailed to sea...

First letter of each word: IttwIwbLamwsts then interpolate stuff, e.g. "IttwIwb$beatles1968$Lamwsts"

Still a pain in the ass to type, but not nearly as painful as a SHA1 or base64 string.

</comment><comment><USER19> <http://clipperz.com> rocks in terms of usability, convenience, and a sense of security (which might be false: here is a call for criticism).

It is open source, portable (runs in Javascript), works on and offline and well designed. You can log in using a master passphrase, or a one-time password.

</comment><comment><USER20> I use the same scheme with minor variations. The most annoying thing is "secure password requirements" ("your password must have digits", and it happened that generated one didn't have a single digit) or limits (I'm fine with encoding-agnostic 7-bit-ASCII-only, but "8 chars max" or "may only contain alphanumerics" frustrate me) on some sites, which force me to step away from this scheme.

In fact, there are way too many exceptions out there in the wild. One still needs a notebook of some sort for such cases.

Also, the last time I've logged into Bitbucket (I [almost] don't use it, but I have the account) I forgot that I logged there using OpenID instead of login- password pair. :)

</comment><comment><USER21> "And by the way, if after reading this you still wish to use a traditional password manager, I suggest that you put your passwords into a plain text file and encrypt it with GPG or use Password Safe."

Having recently had some significant trouble with a lost online banking password, I've been thinking about keeping all my passwords in an encrypted file stored in various places (I don't like the idea of using a password manager, because it's difficult to move it across platforms). Is this sensible from a security POV? Which is the best encryption to use and is there a standard *nix tool for it?

<comment><USER22> You can use keepass which is open source and cross platform.

<http://keepass.info/download.html>

It's much more convenient than a text file you cipher and decipher and it's more secure as well. A text file is prone to error (wrong copy/paste, forgot to cipher the file, etc.)

</comment></comment><comment><USER23> Sometimes I wonder why we don't use certificates more often. Nowadays a lot of people have a laptop or other mobile device so you need only one installation.

Maybe give users a choice: password or certificate.

</comment><comment><USER24> Another alternative is PasswordMaker. Works on hashes and provides local applications as well as browser extensions: <http://passwordmaker.org>

<comment><USER25> The last time I checked, PasswordMaker generated passwords using sites' top two domain labels ("example" and "com"). But for sites' with country code TLDs, PasswordMaker would generate passwords using "co" and "uk", thus sharing the same generated password for _all_ .co.uk sites!

<comment><USER24> You can select which parts of the URL should be used to create the password. Subdomains and even port are possible to select, too.

</comment></comment></comment><comment><USER26> I'm confused. Can I get a real-world example out of this?

<comment><USER27> I think the idea is that you remember a pass phrase, and the encryption type...at which point the program spits out a large hash string. The hash string gets used as your password wherever you need it, but all you need to remember is the pass phrase.

<comment><USER26> Ok, thanks for that. But as a User, why should I care? This would p*ss me right off.

</comment></comment></comment><comment><USER28> I actually do something similar but far simpler that I can do mentally.

I am still screwed by some passwords I rarely use because either

It a password that needs to be changed regularly and I forget where I am in the sequence.

The app had stupid requirements like the password has to be exactly 8 characters. Of course I truncate the generated string but never remember its truncated when I come back.

</comment><comment><AUTHOR> I appreciate all the discussion and opinions. I wanted to mention, too, that the source code is also on github for those interested: <https://github.com/16s/SHA1_Pass>

</comment><comment> M8R-jt5iq1 This is a variant on hashapass.com

</comment><comment><USER29> the encryption used to store passwords is rarely the problem, the strength of passwords and users remembering them is.

</comment><comment><AUTHOR> HMAC-SHA1 has been added to BETA2.

</comment><comment><USER30> SHA-1 is insecure. Use SHA-256 or SHA-512.

<comment><USER30> Wonder why people are downvoting this. SHA-1 being insecure is not something that is up for debate -- it is fact:

"SHA-1 is the most widely used of the existing SHA hash functions, and is employed in several widely-used security applications and protocols. In 2005, security flaws were identified in SHA-1, namely that a mathematical weakness might exist, indicating that a stronger hash function would be desirable."

"Earlier this week, three Chinese cryptographers showed that SHA-1 is not collision-free. That is, they developed an algorithm for finding collisions faster than brute force. SHA-1 produces a 160-bit hash. That is, every message hashes down to a 160-bit number. Given that there are an infinite number of messages that hash to each possible value, there are an infinite number of possible collisions. But because the number of possible hashes is so large, the odds of finding one by chance is negligibly small (one in 280, to be exact). If you hashed 280 random messages, you'd find one pair that hashed to the same value. That's the "brute force" way of finding collisions, and it depends solely on the length of the hash value. "Breaking" the hash function means being able to find collisions faster than that. And that's what the Chinese did. They can find collisions in SHA-1 in 269 calculations, about 2,000 times faster than brute force. Right now, that is just on the far edge of feasibility with current technology. Two comparable massive computations illustrate that point."

"It's time for us all to migrate away from SHA-1. Luckily, there are alternatives. The National Institute of Standards and Technology already has standards for longer -- and harder to break -- hash functions: SHA-224, SHA-256, SHA-384, and SHA-512. They're already government standards, and can already be used. This is a good stopgap, but I'd like to see more."</comment></comment>


Climate Change Is a National Security Issue, Says the Military - <AUTHOR> https://knpr.org/knpr/2017-04/climate-change-national-security-issue-says-military <comment><USER2> Indeed it is a global security issue.</comment>


Learn Regex the Easy Way - <AUTHOR> https://github.com/zeeshanu/learn-regex <comment><USER2> My biggest issue with regular expressions is remembering the exact syntax of each of the different common regex engines. Javascript, Perl, `grep`, `grep -E`, vim, `awk`, `sed`, etc...

Each one seems to have slightly different syntax, require different characters to be escaped, has different defaults (is global search enabled by default? Multiline? What about case sensitivity?), some don't support certain lookarounds, how does grouping work, and so on.

<comment><USER3> There are three types of regex as far as I know: basic (aka GNU), extended and PERL. Grep uses GNU as the name implies. egrep or grep -E uses extended. PERL is used elsewhere like JavaScript. Typically you'll see pcre which is the library for Perl Compatible Regular Expressions.

<comment><USER4> The name "grep" is unrelated to GNU. According to The Jargon File, the etymology is:

 _from the qed /ed editor idiom g/re/p, where re stands for a regular expression, to Globally search for the Regular Expression and Print the lines containing matches to it_

In fact, grep predates the GNU project by almost a decade.

Also, it's the first time I hear about "GNU" regexps.

<comment><USER5> a more accurate term would be "BRE with GNU extensions", e.g. \\(\\)

<comment><USER4> \\(\\) are part of BRE syntax. They are not GNU extensions.

Source: [http://pubs.opengroup.org/onlinepubs/7908799/xbd/re.html#tag...](http://pubs.opengroup.org/onlinepubs/7908799/xbd/re.html#tag_007_003_006)

<comment><USER5> er, I meant \\{\\}.

<comment><USER4> \\{n\\}, \\{n,\\} and \\{n,m\\} are all in POSIX.

\\{,m\\} is a (pretty obscure) GNU extensions.

<comment><USER5> hm, I could've sworn it wasn't. [http://www.regular- expressions.info/gnu.html](http://www.regular-expressions.info/gnu.html) says that \?, \\+, and \| are GNU extensions though.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> For me, the best Regex ressource is still [http://regexr.com](http://regexr.com)

It explains what each character does just by hovering over a regex. Best tool to learn or to fine tune your regular expression (with testing included).

<comment><USER7> This is a paid app, but the debugger on this has been my favorite

[https://www.regexbuddy.com/](https://www.regexbuddy.com/)

You can even step through the matching process and see how your matches are made

<comment> squeaky-clean Love RegexBuddy. That feature along with the "use" tab which generates code for whatever language you select. I don't have to remember the specifics in all the languages I work in. I just select from the dropdowns, for example, "JavaScript (Chrome)" then "Use regex object to get the part of a string matched by a numbered group". Replace the placeholder variable names, and you're good to go!

It will also do things like warn you if you use named groups if your selected language doesn't support them, and the "Use" dropdown won't provide that option.

I really wish it wasn't Windows only.

<comment><USER7> Hah wow... I've had this app for over a decade and never noticed that feature... right next to the Debug button which I have used numerous times on really gnarly regexes

</comment></comment></comment></comment><comment><USER8> I've been teaching regular expressions for years, and offer a free online e-mail course on the subject ([http://RegexpCrashCourse.com/](http://RegexpCrashCourse.com/)).

This site is a very nice summary of regexp syntax and is written well -- _but_ it's missing two crucial pieces that help people learn: Examples and exercises. Without practice, there's no way that people can remember the syntax.

<comment><USER9> It isn't missing those. Every section links to regex101.com prefilled, ready for experimentation.

<comment><USER8> I'll revise my criticism, then: There are some examples, but not enough. And the links to an interactive regexp system is very smart and nice.

</comment></comment></comment><comment><USER10> Good article (didn't realize there were other kinds of lookaround), but maybe the bottom should link to well-tested standards-based regexes instead.

        URL: ^(((http|https|ftp):\/\/)?([[a-zA-Z0-9]\-\.])+(\.)([[a-zA-Z0-9]]){2,4}([[a-zA-Z0-9]\/+=%&_\.~?\-]*))*$

I recently encountered a case where a URL had an underscore at the end of a subdomain name. It seems underscores are okay anywhere else, but while my friend on Windows was able to load the website, I wasn't (on Linux) using Firefox, curl, remote screenshot service which presumably ran Linux etc. According to various RFCs, they should be okay anywhere within the subdomain name.

Has anyone encountered this behavior? Couldn't find anything on the internet; maybe it's just my computer?

<comment><USER11> It seems to mostly come down to differences in how things are defined. DNS itself can handle almost arbitrary data [https://tools.ietf.org/html/rfc2181#section-11](https://tools.ietf.org/html/rfc2181#section-11), while an Internet Hostname was defined to be more strict [https://tools.ietf.org/html/rfc1123#section-2](https://tools.ietf.org/html/rfc1123#section-2). The same issue also exists with dashes at the end of domain components.

I'm not enough of a history boffin to know how Microsoft came to support it differently (perhaps something from the Netbios and NT era). At this point in time though, I don't see either party changing their default validations to agree on a single definition.

Edit: If you're curious, this is the first commit that appears to be the first glibc commit limiting dashes at the end of URLS [https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=fa0bc...](https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=fa0bc87c32d02cd81ec4d0ae00e0d943c683e6e1#patch31). I don't know about BSD libc, or windows however.

<comment><USER12> Wait a second...does this imply that if I put downloads that should only be of interest to our Windows customers on a server named something like downloads_.ourdomain.com, it might keep out all those annoying bots that ignore robots.txt and make a lot of noise in my logs? I'm guessing that most of the bots are not running on Windows.

<comment><USER11> That's a pretty bad idea, you shouldn't rely on this kind of stuff.

If there are people running OSX or Linux that want Windows downloads, or someone is behind a captive portal or proxy (like squid), they probably won't be able to reach it anymore.

If you have a real problem with bots, I'd look at what IPs they are coming from, and how often they try to connect. Something like IP blacklisting, or fail2ban might work for your use case.

</comment></comment></comment></comment><comment><USER13> [https://regexone.com/](https://regexone.com/) helped me finally learn Regex in 2-3 hours.

It's a step-by-step interactive site. One of the best educational programming sites I've been to.

Testing Regex is a lot easier when you have the fundamentals down and there's a million resources to test Regex.

</comment><comment><USER14> I learned regex the "Ambient" way.

i.e. Encountering them here, there and everywhere. Then one day realising you have a good knowledge of the subject without ever having set out to learn it.

</comment><comment><USER15> I spent some time reading some resource or another on how regexes work, but the vast majority of my learning has been trying things in [https://regex101.com/](https://regex101.com/) and seeing if they do what I want. The breakdown on the side of the page is especially helpful.

</comment><comment><USER16> Waiting for the additional "Read someone else's Regex the easy way". I'm not holding my breath :)

Agree with others in that RegexBuddy is indispensable for a windows dev learning this magic stuff.

Some useful and interesting regex developments coming in the next version of JavaScript. Support for international text and (bleh) emoji incoming.

</comment><comment><USER17> And when you think you've learned regex, learn that you haven't: [http://fent.github.io/randexp.js](http://fent.github.io/randexp.js) (a regex "reverser" of sorts) [1]

Seriously. Test _every_ non-trivial regex with something like this, you'll probably be surprised at how permissive most regexes are.

Regexes are great. They're super-concise and perform amazingly well. But they're one of the biggest footguns I know of. Treat them as such and you'll probably do fine.

\---

[1] for instance, the URL regex they use is incorrect, and it's super obvious when you plug it into that site:

        ^(((http|https|ftp):\/\/)?([[a-zA-Z0-9]\-\.])+(\.)([[a-zA-Z0-9]]){2,4}([[a-zA-Z0-9]\/+=%&_\.~?\-]*))*$

`[[a-zA-Z0-9]\\-\\.]` you can't nest character sets like that. So this matches the letters "[]-." as well as all a-z,A-Z,0-9 ranges.

</comment><comment><USER18> I didn't truly understand regular expressions until I saw how they are executed. There are simple algorithms for executing them, so that might not be such a bad way to teach.

<comment><USER19> I learned from the book _The Unix Programming Environment_ but I also didn't truly understand regexp until I read how they were executed, in _Programming in Standard ML_ the first chapter shows how to implement a complete package/parser for regexp [http://www.cs.cmu.edu/~rwh/isml/book.pdf](http://www.cs.cmu.edu/~rwh/isml/book.pdf)

</comment></comment><comment><USER20> The lack of readability of regex makes me wonder if there isn't a better way. I've seen Elm's parser which introduces a few neat concepts like parser pipelines. [https://github.com/elm-tools/parser](https://github.com/elm- tools/parser)

<comment><USER21> Have you looked at Perl 6 at all? Whitespace in regexen is insignificant if not quoted, so not only can you add a little space between sections, you can split a regex over several lines and add comments throughout.

It also has first-class grammars, so you're less tempted to reach for regex when something more powerful would help.

</comment></comment><comment><USER22> For some people Regex Golf [1] might be an interesting way to learn. You are actually building increasingly complex regex as you go, and can just look up bits of syntax you don't know as needed.

[1] [https://alf.nu/RegexGolf](https://alf.nu/RegexGolf)

</comment><comment><USER23> I really enjoy this type of tutorial format, concise and easy to follow. Thanks for take time to produce it.

</comment><comment><USER24> A picture is worth a thousand words. How about a visual regex tester - [http://emailregex.com/regex-visual- tester/#a%5Cbc%5Cd*](http://emailregex.com/regex-visual-tester/#a%5Cbc%5Cd*)

</comment><comment><USER25> Very good post. It has all the important information, provides clear examples, doesn't try to get too fancy or showboat. Well done.

</comment><comment><USER4> Previously: [https://news.ycombinator.com/item?id=14846506](https://news.ycombinator.com/item?id=14846506)

I'm afraid not much has been improved since then.

This is _not_ a good learning source.

</comment><comment><USER26> For an even-more-beginner's guide, see the slides to a session I teach to Econ postgrads once a year[1].

These introduces the metacharacters gradually, using a task-based approach. We start by finding street addresses, per [https://xkcd.com/208/](https://xkcd.com/208/).

[1] [http://mackerron.com/text/text- slides.pdf](http://mackerron.com/text/text-slides.pdf) (page 19 onwards) with supporting resources at [http://mackerron.com/text/](http://mackerron.com/text/)

</comment><comment><USER24> For email, regular expression, there's [http://emailregex.com](http://emailregex.com)

</comment><comment><USER27> Could use some work explaining capture groups

<comment><USER28> Capture groups are where I get 99% of value from regexs. Being able to quickly transform data is where I find regexs perform best. Just matching is not something I have to do all that often.</comment></comment>


Show HN: Job Search Sanity - <AUTHOR> https://jobsearchsanity.com/ <comment><USER2> This looks great! From the screenshots, it looks like a nice, clean, thoughtful design. I would love to use it if I could run it myself. The app needs some pretty private data, and I would hate to lose it all in the middle of a job hunt if you decided to shutter it.

Would you consider making it OSS? I would happily donate toward that end. I can also offer to help package this app for the Sandstorm.io platform (OSS, [https://sandstorm.io](https://sandstorm.io)). Sandstorm enables one-click installs of server apps on self-hosted and managed servers, with great security and privacy out of the box. It will also serve as a marketing platform and channel for future donations for your app. Since Job Search Sanity is basically a private single-user cloud app, packaging it for Sandstorm should be very straightforward.

</comment><comment><USER3> really nice work. for a while i have though how odd is it that no job search engine has implemented something like this--ie the selling point "use our personal, private cms to help you manage your job search" is a great way to keep users.

</comment><comment><USER4> This looks great!

EDIT: Is it on GitHub? What's it build with?

<comment><AUTHOR> It's not on github, but I have some build notes at [http://www.flyingmachinestudios.com/penguins/job-search- sani...](http://www.flyingmachinestudios.com/penguins/job-search-sanity/) :)</comment></comment>


MH370 experts think they've finally solved the mystery of the doomed flight - <AUTHOR> https://www.washingtonpost.com/news/worldviews/wp/2018/05/14/mh370-experts-think-theyve-finally-solved-the-mystery-of-the-doomed-malaysia-airlines-flight/ <comment><USER2> Talk about thin ...

The most plausible explanation is an electrical fire in the cockpit that knocked out the transponder and the rest of the controls and depressurized the main cabin. The pilot turned back towards his most familiar airport but oxygen failed in the cockpit, because of the fire, affected the crew and knocked them out. Best explanation of the left and right banks was that the pilots were trying to get their bearings because they had no radar or GPS.

</comment><comment><USER3> It was well known shortly after the incident (one or two months) that the pilot had taken complex maneuvers that would explicitly avoid radar detection around the Malacca Straight. This was done very soon after the pilot disabled the plane's transponder. At that point it was clear that the pilot had carefully planned to commandeer the plane.</comment>


White House Uses Espionage Act to Pursue Leak Cases - <AUTHOR> http://www.nytimes.com/2012/02/27/business/media/white-house-uses-espionage-act-to-pursue-leak-cases-media-equation.html?hp <comment><USER2> The government seems to be pursuing the right to know everything about you, coupled with the right to hide their business and everything they know about you. The justification is always national security. However, we have no way of knowing that it warrants national security because we don't know the secret.

<comment><USER3> Good old patronizing government. And paternalistic.

"Now child, don't question father's drinking, gambling and violence problems, you wouldn't understand."

</comment></comment><comment><USER4> _Jake Tapper, the White House correspondent for ABC News, pointed out that the administration had lauded brave reporting in distant lands more than once and then asked, "How does that square with the fact that this administration has been so aggressively trying to stop aggressive journalism in the United States by using the Espionage Act to take whistle-blowers to court?"_

 _He then suggested that the administration seemed to believe that "the truth should come out abroad; it shouldn't come out here."_

 _The Obama administration, which promised during its transition to power that it would enhance "whistle-blower laws to protect federal workers," has been more prone than any administration in history in trying to silence and prosecute federal workers._

</comment><comment><USER5> I wonder how much of this is down to policy changes, and how much comes from increased IT fingerprints, monitoring, etc.

In other words, has the motivation to catch leakers increased, or is it just the capability that has increased?

I think it's probably a mix of the two; I reckon some earlier administrations would have clamped down on leakers as hard, if they could have.

<comment><USER6> From what I read in the article I believe it's a matter of government overreach. Some of the details leaked were trivial and to reporters. It is not espionage to leak information to the media when the government does, or is about to do, something wrong; it is whistle-blowing. But charging them with espionage means the government gets to avoid those pesky whistle-blowing laws we supposedly have to protect such people.

</comment></comment><comment><USER7> SMBC: It cuts both ways[1]

[1]<http://www.smbc-comics.com/index.php?id=2434></comment>


John Conway: A Life in Games (2015) - <AUTHOR> https://www.quantamagazine.org/john-conways-life-in-games-20150828/ <comment><USER2> A great article. Conway's whole approach mirrors his Game of Life in general - scatter various seeds and see what develops organically, without purpose or objective. Evolution-based mathematics, pursued inuitively.</comment>


Hydroxychloroquine and azithromycin as a treatment of Covid-19 - <AUTHOR> https://www.sciencedirect.com/science/article/pii/S0924857920300996 <comment><AUTHOR> This looks like the most promising treatment at the moment, well-known molecules available at low cost.

Expanded results should be available within days.</comment>


Launch: dropify – Make Files Social on Facebook - <AUTHOR> http://dropify.com

<comment><USER2> The UI is absolutely incredible although it wasn't immediately clear to me that I can click on the "How it works" steps to move the slider. You might want to make it more obvious or add another method to move the slider, such as a big arrow to the right with text like "Next Step: Add Basic Info".

Again, fantastic job on the UI. It looks great.

</comment><comment><USER3> How is this 'nice' UI? It is a box with drag to upload written on it. As seen on: every other file hosting site at the moment. The only twist is that to download stuff you have to connect to facebook.

This is literally people charging for the software to do the horrible practice of requiring I advertise your brand in order to get free stuff.

'Like Gating' as they call it is scummy and already widespread enough as it is and they are trying to sell it as a service!

</comment><comment><USER4> <http://dropify.com>

</comment><comment><USER5> Please STOP tagging everything under the sun as social.

</comment><comment><USER6> Really really nice UI and design. Well done there.

</comment><comment><USER7> so what exactly does it do?

<comment><USER8> It wasn't clear to me either. I understand the UI, it looks great, but why do I put a file there in the first place?

<comment><AUTHOR> I think they are testing homepages between that and <http://dropify.com/cases></comment></comment></comment>


CPython to LLVM to Javascript - Python in the browser - <AUTHOR> http://syntensity.com/static/python.html

<comment><USER2> It's kind of fascinating to peruse the generated js, if you are at all familiar with the CPython code:

<http://syntensity.com/static/python.js>

Also geeky fun to try to recognize what constants like 4294967295 correspond to -- it's all over the place!

And lots of literal char* strings encoded as integer sequences:

      >>> s = [111,98,106,101,99,116,46,95,95,102,111,114,109,97,116,95,95,32,119,105,116,104,32,97,32,110,111,110,45,101,109,112,116,121,32,102,111,114,109,97,116,32,115,116,114,105,110,103,32,105,115,32,100,101,112,114,101,99,97,116,101,100,0]
      >>> ''.join(map(chr,s))
      'object.__format__ with a non-empty format string is deprecated\x00'

</comment><comment><USER3> Previously on HN: <http://apps.ycombinator.com/item?id=1941405>

</comment><comment><USER4> It's an interesting proof of concept. I did a quick "benchmark" by calculating the 30th Fibonacci number with a dumb recursive implementation and there was a 60-70x difference in speed. I wonder how much of the speed difference is solvable and how easy it would be to have a DOM API.

<comment><USER5> If one is interested in doing this optimally, it should be better to compile python code to javascript directly. Given similarities between the language, it is a doable proposition. For some constructs, walking the python AST (which python so conveniently exposes) and translating the nodes to corresponding javascript should be quite direct. But a complete coverage of python will not be a trivial undertaking.

Oh wait! pyjamas does exactly that <http://pyjs.org/> This is the first time I came to know about this project. So I have no experience with it whatsoever. [Well, that applies to my experience with javascript too.]

Edit: from a quick look it seems pyjamas will not give you a python REPL, I am not sure. But nevertheless this looks very interesting

<comment><USER6> > If one is interested in doing this optimally, it should be better to compile > python code to javascript directly.

Well no, this is not possible, because python and javascript have very different semantics, notably regarding numeric types. You would have to enclose every python numeral in an object, and that in itself would already cripple the performance quite a bit. It would probably be less than the emscripten approach, but not by that much of a margin.

I started doing a python to lua compiler, and did hit that wall very fast.

Pyjamas python to javascript compiler is basically a toy regarding compliance to python spec. Every number is treated as a float, which means any numeric python library/function may not work correctly in pyjamas.

That's not the only difference in semantics between python and javascript. Just the most performance expensive.

<comment><USER7> Note that pyjs has several compilation options, one of which wraps numbers to distinguish between float and int. However, stuff like correct delegation with multiple inheritance might never work because js can only have one delegate. Currently one of the big problems in practice is that attribute access doesn't behave like getattr, which makes working with @property inconsistent. Also, __call__ doesn't work. Lots of minor details. At least they are checked in the unit tests, in case someone wants to help.

<comment><USER6> Hey, thanks for the precision, i didn't know you could box numbers in pyjs, i wonder how i missed that when i read the source. What is the typical performance hit from doing that ?

<comment><USER7> I really don't remember the exact numbers, anymore. A few times slower. The slowdown certainly is significant enough for number-crunching code, but end- users wouldn't notice the difference for simple calculations. I haven't yet played with per-module compilation flags, but it would be possible to compile performance-critical modules with a higher optimization level. Such a solution might require a little wrapper to convert between the data types, depending on the chosen compilation options, but it's the same when talking to raw JS code.

</comment></comment></comment></comment></comment></comment><comment><USER8> Have you tried it with Firefox pre 4.0? Doesn't seem to work on 3.6.13.

I can select the section of code but not actually edit it. It's just plain, unadorned text in a regular div.

But pressing Execute does nothing anyway, apart from a page refresh.

</comment><comment><USER9> That page causes my FF4b9/OSX to crash, FYI.

<comment><USER10> <https://bugzilla.mozilla.org/show_bug.cgi?id=628170>

</comment></comment><comment><USER11> Can it run NTLK <http://www.nltk.org/> ?

<comment><USER12> Short answer, it depends.

Long answer, it can run some parts of it if you join them (e.g., separating tokens, counting probabilities, some tagging and even some more advanced stuff). You cannot however, run everything (for exemple, modules and functions depending on NumPy) and must deal with how to import/export data.

</comment></comment><comment><USER13> I think this is pretty awesome. Language compilation is a fascinating topic.</comment>


Ten random ideas - <AUTHOR> http://lkozma.net/blog/more-random-ideas/

<comment><USER2> _Random wiki image as wallpaper_

Trivial to do...but er, no. With my luck, that would plop the most hideous images of arachnids, chemical burns, etc. on my monitors.</comment>


Thrangrycat - <AUTHOR> https://thrangrycat.com/ <comment><USER2> "Because one cat ain't enough and two is too low, it's me, [U+1F63E POUTING CAT FACE][U+1F63E POUTING CAT FACE][U+1F63E POUTING CAT FACE]" [edited to replace contextually important emojis]

(Also, I don't think you can meaningfully claim it's properly called when both your HTML <title> and <h1> are both 'thangrycat', and the emoji themselves are relegated to the body text, as well as using the pronoun "this vulnerability" repeatedly to avoid having to put more kitties in your post)

</comment><comment><USER3> > How do you describe the meaning of this vulnerability name?

> We chose to communicate [Thrangrycat] through a visual representation of > symbols, rather than "words." Naming vulnerabilities using emoji sequences > instead of other pronounceable natural languages have several advantages. > First, emoji sequences are universally understood across nearly all natural > languages. Choosing [Thrangrycat] instead of a name rooted in any one > language ensures that the technical contents of our research can be > discussed democratically and without latent cultural or linguistic bias. > Second, emojis are indexical to the digital age. Third, clear communication > is the foundation of friendship, and such a foundation must begin with > proper ontological agreement. Just as the universal language of mathematics > is largely expressed through interlinguistic symbology, so too is > [Thrangrycat]. Fourth, cats are seen as almost paradoxical beings. While > they exist in our lives as the ultimate creatures of leisure, cats are also > fierce predators. "Cats are the most highly specialized of the terrestrial > flesh-eating mammals. They are powerfully built, with a large brain and > strong teeth. The teeth are adapted to three functions: stabbing (canines), > anchoring (canines), and cutting (carnassial molars)."

Ironically, emoji don't work in Hacker News comments; so I had to insert their made up word "Thrangrycat" to convey their remarks on name choice.

</comment><comment><USER4> I'm really hoping that the choice of name here is meant as commentary on the trend of coming up with cute names for vulnerabilities. Using emoji combinations for vulnerability names does seem like the next logical step, even though it's also absurd.

<comment><USER5> I hope not, because not all terminals support unicode, not all applications do, etc. Also, as the author mentioned, it is hard for the layman to understand how to pronounce it. Why they did not name it "thrangrycat", I do not know. All though, that almost seems worse than the emoticon option.

</comment></comment><comment><USER6> Short discussion on this Cisco vulnerabilities earlier today: [https://news.ycombinator.com/item?id=19902923](https://news.ycombinator.com/item?id=19902923)

</comment><comment><USER7> [https://media.cert.europa.eu/static/SecurityAdvisories/2019/...](https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT- EU-SA2019-012.pdf)

[https://www.cert.ssi.gouv.fr/avis/CERTFR-2019-AVI-205/](https://www.cert.ssi.gouv.fr/avis/CERTFR-2019-AVI-205/)

[https://www.cert-bund.de/advisoryshort/CB-K19-0401](https://www.cert- bund.de/advisoryshort/CB-K19-0401)

[https://www.reddit.com/r/netsec/comments/bo70kw/thrangrycat_...](https://www.reddit.com/r/netsec/comments/bo70kw/thrangrycat_vulnerability_impacting_cisco_products/)

</comment><comment><USER8> Love the emoji domain :)

</comment><comment><USER9> I found it interesting that the section that explains the name of this vulnerability is way more thought-out and verbose than any of the other sections. It's almost like they had a linguist on the team and the emoji name was his prideful contribution.

<comment><USER2> Also, I see zero justification for why _this_ particular array of emoji: is this a particularly angry-making vuln? Particularly carnivorous? It's not even particularly unambiguous, a requirement, I would have thought, for "proper ontological agreement".

Anchor - Spiderweb - Personal Computer would have been a more meaningful name, from a cursory glance.</comment></comment>


Show HN: One Billion Seconds - <AUTHOR> http://cluecode.com/billion/

<comment><USER2> I've always loved the numerical coincidence that, to a fairly crude approximation (a bit better than two decimal places), π billion seconds is a century.

<comment><AUTHOR> That's fascinating! Never thought about that before. π is an amazing number.

</comment></comment><comment><USER3> The odometer has wrapped!

<comment><AUTHOR> Also, if you'd like, I can modify it to track the 2nd and 3rd billion(th) seconds. I know I'll be needing it soon ;)

<comment><USER3> Personally, I wouldn't vote for a change. Less counting of rollovers is fine with me these days.

</comment></comment></comment><comment><USER4> Added to my calendar :)

<comment><AUTHOR> Awesome! Celebrate it vigorously when it comes :)</comment></comment>


Ask HN: Is HN's account creation CAPTCHA broken? - <AUTHOR>

... or is it impossibly hard? I must have tried at least 10 times to complete the CAPTCHA without success. <comment><USER2> I spent more than twenty minutes last night trying to create this throwaway account in order to publish an anonymous "Ask HN" using the TorBrowser, I even tried to "Download Audio" alternative and was completely sure that the numbers were correct but again the captcha reappeared as if the previous answer was invalid. I decided to allow JavaScript globally just in case without much luck. After some time I started to think that I was really a robot so I decided to create the account using my normal browser, very frustrating.

EDIT: [https://www.youtube.com/watch?v=WqnXp6Saa8Y](https://www.youtube.com/watch?v=WqnXp6Saa8Y)

</comment><comment><USER3> Umm, There is no CAPTCHA verification afaik, tried few seconds before.</comment>


Ask HN: Would you join a startup that doesn't test? Are tests impediments? - <AUTHOR>

Met this great team at a startup running a (quite successful) webapp on a cloud hosting provider. They don't test their code at all (and instead run through tests manually before they push to production).
They say it's because they wanted to put something out there rather than focus on testing. Is that legit?
I like them a lot, but it makes me nervous that they don't have any test framework in place.  I think they're open to testing now they are more stable. Thoughts? <comment><USER2> TDD is overrated and overused, with no regard for the cost of developing/maintaining the test suite. You should join them -- you will probably learn something about building correct software, such as "automated regression testing is not the only way". Ironically, tonight I have fired up the RT I use for one subsystem because it needs work. ie, RT has its place, but the TDD crowd thinks every place is that place. btw, the idea that you would not join a group you like because they do not use TDD confirms what I have come to suspect from interviewing more than a few Rails folks: TDD is a bit of a cult, a tail now wagging the dog of how its adherents think about programming. TDD can be great, but it has its place, limits, and cost.

<comment><USER3> You rail about TDD, but the OP is talking about tests in general, quoting, "They don't test their code at all." I personally thing that TDD is totally backwards and braindead, but unit tests... you just have to have them. The only acceptable time to eschew basic unit tests is if you plan to throw the code away SOON (and have a blood pact about killing it for sure).

<comment><USER2> Ha-ha, quote further! "They don't test their code at all (and instead run through tests manually..". Actually, I meant to mention that as another sign of cultdom: the verb "test" now means "automated test". Manually testing does not count, nor do any of the other ways we can get to correctnes without TDD.

<comment><USER4> Your conflation of TDD with automated testing is not helpful.

As software developers, the essence of our profession is to automate repetitive tasks. If you have a rigorous manual testing methodology for your software, it should be a trivial task to turn that test specification into automated tests. The absence of a suite of automated tests is a major red flag in any non-trivial software project - it strongly suggests that either the developers do not care about quality, that they do not understand their work well enough to manage quality in a systematic way, or that they are too haphazard and disorganised to manage their project appropriately.

<comment><USER2> I am just waiting for someone to ask, "How else can one achieve correctness?" :)

But cults do not do that, they just accuse non-believers, in this case, that they do not care about correctness.

That's like saying Messner and Habeler did not care about safety because they climbed extreme pitches unroped where other pairs roped up and moved one at a time. But M&H were very good climbers and got up and down twice as fast as the others, who doubled their risk of the weather turning on them by being "safe". If you know your mountaineering, the latter is usually how folks die on mountains.

</comment></comment></comment></comment></comment><comment><USER5> If they're only starting out, it would be okay if there would be no testing at first, but as the months roll by, they'll need testing sooner than they think.

If they've been working at it for a while, joining them is going to be a lot hard work. For one, it can be a warning sign, in the first place, their code will be hard to test. Dependencies will be out of this world, who knows where they put their business logic, random classes doing random things, random database session handling, god objects, and other elaborate hard-to-maintain hack stacks.

If you still want to join them, introduce testing to them by creating tests for one small part of their stack, it will easily show off the merits of testing:

\- It's not just about putting something out there faster, it's also about failing business assumptions and the capability for your code to iterate/pivot quickly. Testing helps you in that aspect. Spend 10 minutes running the entire stack and tracing where a bug occurred, or just run your tests and find out what went wrong.

\- The great thing about automated tests is that whenever I make huge changes in my code and the tests still run it means I can confidently say I didn't break anything at all. If I did, then I can easily know where and how, and I don't have to run through the entire app. I could easily isolate a single piece of my stack and test directly.

\- Testing forces the team to write maintainable software.

\- Another amazing meta-feature about tests is that, whenever you're debugging, it takes a huge chunk of business logic out from your cognition. You don't need to carry the extra cognitive load that 'x' part of your stack be able to 'y'.

Anyway, join them not for the sake of their code, join them if you just love what they're doing. You'll work through it.

<comment><USER6> Another important argument for tests is that as people like your self join the company they will have 10x a harder time doing any change to the source as they will not now how this might impact the whole project. It might break somewhere that you do not know it will. (first level experience on this). A good test base, will make your live a lot easier as you go along.

</comment></comment><comment><USER3> Hell no. Hacking together a crappy throwaway minimum viable product with no tests is one thing, but if this company is "quite successful" (as you say) it is probably past the time where they should have started writing tests.

In the even slightly long term, tests don't slow things down, they keep things fast. It is MUCH easier to change and maintain code with good tests. Think about it this way: when you write code, you damn well better be testing that it works as you write it. Why not test it with other code, and save that so that other people don't have to do it over again? Manual testing is slow, error prone, and very expensive. Better use it judiciously instead of making people track down stupid programming errors that could have been caught in 7 seconds with a decent unit test suite.

<comment><USER2> Get over it. They are successful without TDD. It is extremely possible, and then one does not have to slave over a hundred lines of tests when one decides to write ten lines of code. TDD has its place, but it is a relatively small place (and then, yes, it is worth its weight in gold -- I do it often).

</comment></comment><comment><USER7> When starting an mvp, you are bleeding (usually) bootstrapped cash. In that scenario the priority is really to get the product out the door, and some stable revenue stream. Testing is often put the wayside just to survive.

In an ideal software development scenario where you have a budget, then yes, testing should be there in the beginning.

But if it is a start-up, I'm tempted to give slack for the lack of a framework. And it seems like if you come in, you might be the person to lead the testing framework which would be a good thing.

</comment><comment><USER8> Facebook didn't have tests for quite a while.

I talked to a very hot startup (100M+ valuation, very solid business model) that everyone here has heard of, and they had no tests at all.

Don't discount a company because of their testing situation. Heck, maybe you'll be the first engineer to start writing tests!

</comment><comment><USER9> With my friends (we are french) we always say: "Tester c'est douter" meaning something like: "If you test it's because you are not sure, you doubt" Or "Si ca compile, ca marche !" = "If this code compile, it works!"

<comment><AUTHOR> unless you use a dynamic language :P

</comment></comment><comment><USER10> no. Huge red flag.</comment>


What Tesla's Model 3 UI Reveals About Its Vision for the Future - <AUTHOR> https://blog.figma.com/what-teslas-model-3-ui-reveals-about-its-vision-for-the-future-eb01a75ae979 <comment><USER2> > They weren't even trying to hide it, the middle screen was basically a giant > middle finger to the rest of the car-building world; a not-so-subtle "F-you" > to the naysayers, the disbelievers, and the other car companies who insisted > on playing it safe.

I don't know if I would call it that.

>I don't think Tesla did this simply to be edgy, dangerous or different. They did this to prepare people for a world without drivers.

In a world without drivers, a handle to open up the glove compartment, physically-controlled air conditioning vents, and physical HVAC knobs still makes sense.

> Instead, the Model 3 has a 8:5 aspect ratio and a resolution of about > 1920x1200px. ... suggests that Tesla made their center console for watching > things, not for driving the car.

8:5 is 16:10. What I really think happened is that Tesla took the cheapest available off-the-shelf 16:10 LCDs. Because what the Model 3 really is is about cutting costs to get the cheapest electric car on the market, and ultimately I think that's what informs the Model 3's design the most. A cheap electric car is in itself a noble goal. I think that it's wishful thinking to think otherwise.

This seems to be kind of an ad for Figma. That's fine, but it's a poor ad. It suggests that Figma is a tool that embodies a myopic vision of UI design where only the screen matters.

<comment><USER3> > Because what the Model 3 really is is about cutting costs to get the > cheapest electric car on the market

I thought that was the case, but having seen a few in-depth video reviews there still seems to be plenty of fat that they easily could have trimmed without anyone caring. E.g. the charge port cover can be opened electronically; why? It seems pointless to me, since you have to get out of the car to plug the charger in anyway.

<comment><USER4> Self promotion. It's on the outside of the car and may prompt others to glance/notice it and be intrigued by it.

A pretty low cost for the amount of 'increased' perception of value.

</comment></comment></comment><comment><USER5> To be honest, that dampened my excitement for the model 3 a notch.

In order for that design to make sense in today's model 3, it would mean that very car is just a software update away from autonomy at "we are all watching netflix instead of looking outside" level. And that software update is coming very soon, in a matter of maximum 2-3 years.

I'm skeptical. I can very well see the next Model S, or the refreshed model 3 in 5 years achieve that [1], but really that's sacrificing today Model 3 user for something that's going to never be delivered to them. Not sure I like the approach of "this is a glimpse of the future that is not for you".

I don't think that there is much need for a lot of button, don't get me wrong. To me, just somewhat more feature full lever around the wheel - nothing fancy, just the same you get on most cars and a hud so that the rest of the family can indeed watch Netflix while the driver does not lose completely every driving information. Job done, a taste of the future, but not completely compromised experience for the poor sod that has to drive in the present.

[1] A lot of people that know more than me are skeptical this is even possible short term, but with no money at stake I'm happy to dream.

<comment><USER6> I think this article overstates things a bit. I have a Model S which has a bit more in the way of levers and buttons, but is still really minimal compared to most cars, and it's fine.

The Model 3 is lacking two main physical controls compared to the Model S.

One is the windshield wiper speed control. Both cars have a button to trigger the wipers manually. The S also has five speed settings physically accessible: off, auto-low, auto-high, continuous-low, and continuous-high. The auto wipers are pretty good (this is the old Autopilot hardware, the new Autopilot hardware still doesn't have the software for it) and so I hardly ever have to fiddle with it. I bet a bit of software and hardware improvement can take that "hardly ever" to "not ever" so I don't think the Model 3 will suffer here... once the auto-wipers are actually enabled!

The other is cruise control. The Model S has a separate stalk for that, which you can use to engage, disengage, adjust following distance, and adjust speed. The Model 3 has it on the PRND stalk and it's just on/off. I don't think following distance is a big deal. It's pretty much set it and forget it on my Model S. Speed adjustments are often handy, but a lot of that is because the car isn't totally reliable at figuring out the current speed limit. When it does, manual speed adjustments will be needed rarely.

The Model 3 controls are designed around intelligent driver assist features, but I don't think they're designed around anything close to full autonomy. They're really just designed around good automatic wipers and intelligent cruise control, both of which will probably be ready before most of us mere mortals can obtain one of these cars.

<comment><USER7> I have a Model S too, and my one irritation with it is that I don't have a physical button or dial to turn off the headlights. Whenever I drive onto a Washington State Ferry at night, it gets me into a bit of trouble.

If you haven't done it; you're required to turn off your headlights the second you board the ferry, there are signs posted, and the ferry operators will often check as you board. One reason is that sometimes car owners leave their lights on, drain their battery, and delay the ferry unloading at the other end. But even as you debark the ferry, you're required to keep your lights off until just off the boat. I think glare and operator safety might be factors too.

But in either direction, if it's night then you need your lights on just before, or just after the boat, and you'll be driving across a narrow little articulated loading dock at the time. Trying to drive in those conditions, and get through 3 taps or however many it is on the console, just isn't going to happen. So twice now, I've had a boat worker stop my car, yell at me, and have everyone wait while I go through the LCD to do it.

<comment><USER6> That's an interesting problem. I've only had to manually fiddle with my lights once or twice so I hadn't really thought about it.

One thing I think they could really improve would be to enable voice commands for these things. It's still no substitute for a physical control when you really need it, but it would help, and it ought to be something they could add in an update without much trouble.

</comment></comment></comment></comment><comment><USER8> Opening the glovebox with the touchscreen is the epitome of bad design, IMO. After watching Doug demuros review of all of the motorized components of the model 3 (the doors opening, the gas cap, the glove box, the ventilation direction, and probably more I've missed) I see a car that's going to break often. keep it simple stupid.

<comment><USER9> Not only will things break, but they'll also be a pain to use. People will hate doing simple things in their car, and this will make them like the car much less.

</comment></comment><comment><USER10> One thing that strikes me about this is the lack of tactile feedback. Even Apple is working hard to fix that aspect of the buttonless phone, but with cars it's even more important. I don't really want to be fussing with a touchscreen while operating anything moving fast enough to kill someone (or cause $$$ in damages). Don't get me wrong I love touchscreens, but they aren't perfect (sweaty hands, gloves, etc...)

<comment><USER11> The idea that I would have to locate and press a graphical button to turn up the fan is pretty much a nightmare. I can do it without looking now. Even a quality voice-recognition interface would be lousy.

<comment><USER12> Not on a Model S you can't. Which is really annoying when you're in one as a driver _or_ a passenger.

<comment><USER13> The steering wheel controls on Model S can control the fan.

I've noticed that passengers don't seem to have any problem using the touch screen.

</comment></comment></comment></comment><comment><USER14> During my internship on automotive cost engineering, I quickly learned that motorized anything on a car costs and weighs leagues more than its mechanical- only cousin. I am curious why Model 3 went down the path of total motorization, when it is marketed as a more affordable car.

Also, while I am becoming more open-minded towards touchscreen for non- realtime controls, E-brakes does NOT seem like one of them --- sure you don't need it that often, but when you do need it, you'd better pull it RIGHT NOW. Wiper is also questionable. If full autonomy works then sure I don't really need a clear view on the road, except it likely won't work as well when it pours and you need to blast the wiper to max RIGHT NOW.

<comment><USER15> _During my internship on automotive cost engineering, I quickly learned that motorized anything on a car costs and weighs leagues more than its mechanical- only cousin. I am curious why Model 3 went down the path of total motorization, when it is marketed as a more affordable car._

Would it be more costly or less costly for Tesla to have just one set of underlying mechanisms for all of their cars at all luxury levels, or have different sets of mechanisms depending on luxury level? The motorized mechanism could be adapted to all levels of luxury by simply changing the controls.

</comment></comment><comment><USER16> Here's a reddit post [1] of a Model 3 owner locked out of his car because the 12v battery was not functioning properly. _There is no physical key for the car._ The Model 3 appears to be full of these questionable design decisions.

[1] [https://www.reddit.com/r/teslamotors/comments/79rp5w/model_3...](https://www.reddit.com/r/teslamotors/comments/79rp5w/model_3_dead_in_a_parking_lot_trying_to_jump_the/)

<comment><USER17> A lot of cars are keyless.

[https://en.wikipedia.org/wiki/Smart_key#Nomenclature](https://en.wikipedia.org/wiki/Smart_key#Nomenclature)

<comment><USER16> They [almost] all have a physical key. It typically slides out of the fob. I don't know of a single [non-Tesla] production car that lacks a manual way to enter. If my "keyless" Audi is completely and truly dead (batteries removed!), I can unlock it.

Update: changed to reference this is a Tesla rant, not specifically Model 3.

<comment><USER13> ... Model S and Model X don't have keys, either. You're 5 years late making this complaint.

<comment><USER18> Sure, but that doesn't make it an invalid criticism of Tesla's design choices. Plus, every component in the Model 3 is far more centered around budgetary concerns and will simply be driven by far more people, so this problem is entirely likely to be worse on the 3 than previous vehicles. Any other car at this price point (or really most any other car) would have some physical key, and it's not automatically a reason to hail the car as visionary design.

<comment><USER13> I've gotten non-Tesla rental cars that didn't have a physical key, so there's that.

<comment><USER16> What did they give you to start the car?

<comment><USER18> Lots of car fobs are just wireless transponders to authorize the remote start now, it's how those hacks to steal a BMW with a laptop work. But those fobs usually still have a real key inside.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> So, can one of you Steve Jobs clone-prophets hurry up and advocate for some nice big rotary knobs and flip switches and try to get us over this 'no- physical' fetish?

Just wait a few years until everything is touch-screen'd, and then reveal it like it's a new idea.

"Wow! That knob has ten indents! One for every level of setting! I don't even need to look at the screen!"

Sell it as a UX feature, like everyone is selling this trend.

</comment><comment><USER20> A 16 * 9 display is not even a suggestion of anything more than economy in action. That is the format flat panels are made in for an obvious reason.

<comment><USER21> Except that this isn't a standard 1920x1080. As the article mentions, it's slightly taller than that, leaving 1920x1080 after space is reserved along the bottom for the control strip. So it's a custom panel pretending a standard virtual height.

<comment><USER22> 16:10 is probably the second-most common aspect ratio after 16:9, so not really what I'd consider "custom".

</comment></comment></comment><comment><USER23> This is exactly the sort of broken design thinking that will make cars unsafe.

<comment><USER23> In one of the talks at Google I/O last year a VP from Audi (or Volvo?) spoke in a thick and lofty German accent about how "ve haf completely oferhauled ze driver exzperienze". He played a sexy video clip showcasing their new Android infotainment system (something like [https://youtu.be/h_7_fKJ0PNs](https://youtu.be/h_7_fKJ0PNs)), and the first thing I noticed is how they'd taken away my traditional temperature knobs and replaced them with digital touchscreen ones. They looked _just like physical ones_ , and were in the _exact same place_ you would expect ([https://9to5google.com/2017/05/15/android-cars- audi/](https://9to5google.com/2017/05/15/android-cars-audi/)).

So, I've gained absolutely nothing, and now I have to take my eyes off the road and look down at the stupid console just to change the temperature.

 __TLDR: Tacticle feedback is a Good Thing(tm) and designers should cultivate - not fight - muscle memory. __

</comment></comment><comment><USER15> _I don't think Tesla did this simply to be edgy, dangerous or different. They did this to prepare people for a world without drivers._

 _This car was designed for the riding experience_

One thing I've seen in certain very successful companies, is a pattern of proactively preparing the customers for the future. Apple, Amazon, and Tesla all exhibit this pattern. Microsoft has also tried to do this, though I'd say that Microsoft has erred on the side of annoying people too much while doing so. Come to think of it, Apple has erred on this side as well lately.

Most companies just react to customer demands. Certain companies actually have the foresight to lead what the customer will demand in the future.

</comment><comment> nv-vn I think this is a really interesting move from Tesla and it is making a good commentary on what the automotive industry has become. There's a lot of clutter in the modern car's UI, and I do agree that it could be slimmed down a lot. But the thing here is that Tesla is sacrificing usability for simplicity -- having to go through menus on the touch screen to access commonly used features like windshield wiper speed, relying on the screen in the middle to know whether your turn signal is on, or having to browse through menus to enable your parking break. You can't even see the speed your car is going on the dashboard, and instead have to move your focus to the thing that's basically an iPad mounted in the center console. The thing is, these are solved issues. Tesla could use a HUD to show even a simplified dashboard view. They could integrate the screen into the entire front seat/dashboard location/center console rather than just a rectangle in the middle. The only real answer to what they are doing is given in the article: they are trying to ditch the normal driving experience because they believe in the self-driving car as their end goal. This car is almost more of a commentary on this idea than a product (though I'm sure sales will be through the roof because Tesla has built itself as a trendy company the same way Apple did). The Model 3 is not for somebody who enjoys driving their car 24/7, and until self-driving cars become the norm it pretty much just exists to be edgy.

<comment><USER24> > You can't even see the speed your car is going on the dashboard, and instead > have to move your focus to the thing that's basically an iPad mounted in the > center console.

Center dashes have been a thing for a long time, my Saturn Ion had one and once I adjusted to it I preferred it since it was along the same axis as my side mirrors as opposed to having to look down.

</comment></comment><comment><USER25> this is a pretty weak analysis. His core notion that because the central UI is a 16:9 horizontal aspect ratio that differs from the model S, then it MUST be a passenger oriented design perspective as opposed to a driver specific one.

Well the same can be said that a horizontally oriented UI experience reduces the need for your FOV from looking further down and thus decrease time spend peering away from the windshield.

Design is so subjective. There are so many ways to interpret.. These articles proclaiming X instead of Y is hardly convincing at all.

<comment><USER16> > His core notion that because the central UI is a 16:9 horizontal aspect > ratio that differs from the model S, then it MUST be a passenger oriented > design perspective as opposed to a driver specific one.

Well, that and the fact the Model 3 gives the driver almost no controls.

</comment></comment><comment><USER26> I'm not sure if the model 3 has any voice-control, but a decent voice system might be a good way to augment the touch screen for some tasks like 'wipers faster', for example.

The voice control in the model is ok - it's good at recognition, but limited in function.

They can at least enable this type of function later with software updates. This is a key differentiator with other auto makers, who rarely issue software updates after the car has shipped, and if they do, never include new features, and often charge you for things like map updates.</comment>


Introduction to Flat-File CMS - <AUTHOR> https://buttercms.com/blog/introduction-to-flat-file-cms-deciding-whether-they-are-right-for-you <comment><USER2> My company does a lot of CMS work for clients. Everything from static site generators up to giant enterprise tools. One thing I've determined is that the giant enterprise tools are nearly worthless even for the enterprises they're designed to serve. They add giant layers of complexity to service features that look great in a demo and serve no business purpose. Then they become a technical ghetto full of proprietary plugin code that require product expertise and are inaccessible to the rest of the dev team. That and they cost $100K-$1MM and more for licenses. It's possible to implement them well, but only by applying the same kind of design principles you would to simpler systems. Even when I'm working with a client that doesn't blink at the price tag, I'm 100% onboard with headless or flat files.

<comment><USER3> I'm reminded of the now-vanished JWZ post about "groupware". Enterprise software is nearly always awful in lots of ways that the purchaser insists on. They don't want a cheap, general solution that empowers users. They want an expensive, high-profile, highly customised solution that railroads users into workflows. Often it's less important what the specific railroad is, just that it can be imposed.

Proprietary plugin code serves the need of the purchaser to feel special by getting something customised for them. They can then pretend it's a secret sauce for their business, despite it actually impairing employee productivity compared to, say, stock Wordpress.

<comment><USER4> > _I 'm reminded of the now-vanished JWZ post about "groupware"._

It's not vanished; here it is: [redacted]/doc/groupware.html

<comment><USER2> You should delete that link. It looks like whoever owns that site left an, uh, easter egg, for HN visitors. A rather inappropriate one.

<comment><USER4> It seems that the moderators have silently edited my post to remove the link. I have "referer" headers restricted in my web browser, so I did not see the redirect.

It seems that the so-called "vanished" article would be more appropriately named the "disappeared" article.

</comment></comment></comment></comment></comment><comment><USER5> I started out re-writing the core of Wordpress to Elixir around last year. Once of the decisions I had to make was with databases. I started out with flat files as well and realized they can quickly grow complex when you have more than a handful articles. Eg. If you want to add some new attributes to the flat files, they can't be backported to the older articles if the number of articles is quite large.

Guess what? That's the problem that the SQL databases already solve.

So, to circumvent this, I searched for a database that can be version controlled but doesn't require a separate database server. And I found one - SQLITE.

It's been amazing so far. It can be inside my GitHub repo, while giving me access to normal SQL queries via my ORM. With a static file solution built on just flat files, complex querying is definitely not possible. With now over 30,000 posts in the SQLITE database, my static file generator is still absolutely fast.

I now use my solution for a high traffic client with 3-4 million visitors a month and it works really well for them.

One downside of SQLITE is multiple concurrent writes, but so far it hasn't been much of a problem yet.

<comment><USER6> > With now over 30,000 posts in the SQLITE database, my static file generator > is still absolutely fast.

Don't you then miss out on human readable Git diffs when posts are changed? And now you can't edit posts with a standard editor or e.g. the GitHub web UI?

Also, what language are you using? Shouldn't reading in 30,000 posts and building some stats/relationships/lookups on them be pretty fast?

<comment><USER7> > Don't you then miss out on human readable Git diffs when posts are changed? > And now you can't edit posts with a standard editor or e.g. the GitHub web > UI?

You never got those with wordpress either. Seems like they're going for some kind of hybrid. Trading some of the simplicity of standard static file generators for some of the power of a tool like wordpress.

I quite like the idea.

Nothing to stop them from storing historical versions in the DB, then it wouldn't be much more logic for the site generator to spit out the site at X point in time, or a diff. Whether that's a feature you'd want is another thing.

> what language are you using?

"re-writing the core of Wordpress to Elixir"

</comment></comment></comment><comment><USER8> I've been an API-based CMS fan for a while but at the end of the day it's a huge bet on the viability of the vendor, because good luck migrating away from an API-based CMS.

No way all of the myriad vendors in the headless-CMS world survive this downturn.

I think that needs to inform any CMS decision.

Ultimately I suspect there will be vertical integration at play with the companies raising money to be the Wordpress of the 21st century. Wordpress is a CMS after all.

<comment><USER9> I company I worked at had 20 or so sites on a headless API based CMS. Basically you'd enter structured data in their proprietary backend, and the site would request that data as JSON via the API. The marketing department hated it with a passion, because there was no way to do "one-off" things without involving IT, and IT hated it because marketing needed permanent handholding for the simplest of things.

After about a year of paying €8000 a month for hosting they replaced it with one really good 100% custom WordPress theme.

<comment><AUTHOR> How did this remove the need of using IT to do one-off things?

<comment><USER10> WordPress has a publish button, post scheduling and revision history all out of the box with no plugins. That right there eliminates most of the need of IT in day to day publishing.

<comment><USER11> I don't follow. Everything you've listed is a feature of most headless CMSs I've investigated.

<comment><USER10> Headless CMS may have that feature but then you have to deal with a more complicated deployment pipeline that a marketer might not be as comfortable with as WP.

<comment><USER11> There might be a misunderstanding here. Headless CMSes don't mandate deploys, that's only if they're used in conjunction with static-site generators. A headless CMS is just a CMS that provides content as structured data over an API rather then pre-bound to a rendering layer. You can use WP as a headless CMS if you use its content API.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> The thing with flat-file cms is, they are often represented as a category of cms, but they are actually not all the same.

There is the type that just saves its data in file form, just like you would in a db. And I never get why this would be desirable. You loose all the benefits of a db system without gaining much.

The other type, the interesting one, is the one where you can work directly on those flat files, not needing some kind of admin interface. Now this can be great!

But it often seems more flat-file cms belong to the former category. I do not know why one would prefer these if you still need a server with a dynamic language and a web interface to edit content. Just use a db!

I never heard of headless API CMS Systems before, but it honestly sound really silly. If you write a front end that consumes JSON, you could just as well write a front end that made db calls. And if you must have JSON, write a wrapper around your db. Having that stuff hosted by someone else is just peak cloud nonsense.

<comment><USER13> > The other type, the interesting one, is the one where you can work directly > on those flat files, not needing some kind of admin interface. Now this can > be great!

I am not sure I understand; could you please explain? That sounds like working directly on flat html files; or are you talking about working directly with a DB that then writes to flat files?

Thanks!

<comment><USER12> I was thinking about something like grav cms.

You put markdown files in a folder and it creates html for you when the page is requested. When you use their web based admin tools, they also just change the markdown files. Easy to use from web and local.

I guess many static site generators work the same and we had good success teaching our content creators some markdown. For many, it is often easier than navigating something like drupal and working with the kinks of whatever WYSIWYG editor.

</comment></comment></comment><comment><USER14> very interesting how these things come and go. one day we talk about flat-file frameworks and, for a long period of time, we forget about them. i remember when joomla, wordpress, and the other bazillion php frameworks were all coming about and we debated flat-files vs database-backed frameworks.

one that stood out at the time among flat-filers was textpattern -- not sure if the very yellowish branding was the reason.

databases won over flat-files though. primarily because the web needed to scale. it is also worth mentioning sqlite which at the time was, and still is, a perfect middle ground.

<comment><USER15> I am not so sure the scale is main reason. Most wordpress sites are static content and run db+site on same server. They are scaled using caching which sort of makes it like static website.

The same approach is used with big flat file sites. Editing on dynamic portion and viewers see cashed site.

Many big sites actualy use cmses as static site generators. But cashing is not that different.

</comment></comment><comment><USER16> Hugo is a great flat-file CMS, although it doesn't come with an admin interface or editor built in. Would love to see something as fast as Hugo that I can just point at a directory of Markdown files with front-matter/data that can edit/commit files from a UI using Git that runs locally.

<comment><USER17> I've been using Hugo, but the template syntax is a pain to learn/get right...

<comment><USER18> The template syntax is actually from go[0] which you can find some guides[1] for. While the Hugo website now mentions this, I'm not sure it always made it clear the syntax is not its own (it just seems to be frustratingly light on some use-cases). Once you understand the syntax though, it applies to more than just Hugo.

[0]: [https://golang.org/pkg/text/template/](https://golang.org/pkg/text/template/) [1]: [https://gowebexamples.com/templates/](https://gowebexamples.com/templates/)

</comment></comment></comment><comment><USER19> I'd like to see someone create a CMS that uses HTML files to store data and let's you query and copy data between the files using CSS selectors. This, to me, would be the simplest CMS.

You could just do:

And that would go into your about page, copy the content from there, and insert it into the current page.

If you built it out well enough, you could do everything using just static HTML and CSS files and just syncing the content whenever it changes.

I've been thinking about this idea for a while. I even started my own framework to try to make something like this work. I'd love to know what other people think.

<comment> raving-richard Check out Server Side Includes. They used to be all the rage.

You don't need to reinvent anything. Just use what used to exist.

(Also, you start doing SSI, and then you want a bit more power, so you switch to PHP, then before you know it, you go all out with PHP and MySQL. Finally, you say, "MySQL sucks, SQLite is much better and easier" (see also the other comment about SQLite).

In the end you realize that nothing matters. We all die alone in the end.

<comment><USER19> Yes, I've been down this rabbit hole before :)

I'm not just looking for static includes, but dynamic, real-time, editable includes built in to a framework that uses a single syntax to describe a full web app. I'm tired of using full programming languages for describing app data — and how it can be edited — when so much of what a web app can do has already been implemented a billion times.

PHP is great for that, but, in my opinion, is 500% more powerful in areas that don't count (low-level language constructs that make it Turing complete, but not ideal for building real-time, editable web apps) and 10% as powerful as it should be in areas that do count (i.e. performing higher level tasks automatically, like structuring data, syncing data between pages, moving data around, rendering data to the page easily, etc.).

</comment></comment></comment><comment><USER20> What are good headless CMS engines? There are so many flavors and no real community or indication of which ones will survive, is there an open-source equivalent to Wordpress for headless CMS?

<comment><USER21> I've been pretty happy with [https://getcockpit.com/](https://getcockpit.com/) for smaller sites. It's flexible and reasonably robust. Not perfect but if you know some PHP and JS the code is fairly easy to follow if you do need to tweak stuff.

</comment></comment><comment> rob-olmos Somewhat related, I've been fond of flat-file or file-based configs as well. Such as Nagios/Icinga has configuration files, but now seem to suggest a database & UI/API.

File-based config made scripting the generation of the configs pretty easy and updating for changes by just overwriting the files and reloading the daemon.

IIRC, similarly TWiki also uses individual files for the pages and configs with RCS (Revision Control System) per-file to track changes.

<comment><USER22> Especially since Puppet/Salt/Ansible does that part for you.

Apply the "web server" class to a node and there is nothing to forget as the relevant config templates are applied both to the monitoring system, the backup runner, and anything else.

Configurations that live in a database somewhere is much harder to manage as they have to be set by a config running which needs to be written and maintained.

</comment></comment><comment><USER23> I've made a PHP flat-file CMS to manage my own website and for a while it was the very first result when searching for "fuck wordpress"

</comment><comment><USER24> Using a flat-file based system appeals to me, but one question I've never had a good answer for is at what sort of scale does a certain database make sense?

Aside from questions of ACID, I get the idea that a lot of people jump to databases because they're uncomfortable with file operations, frankly. But obviously they make sense for other use cases - what is the decision matrix? Just a gut feeling?

<comment><USER25> If you're strictly asking about scale and not features, the breakpoint is just a question of whether the data fits comfortably in RAM and whether the front- end fits on the same machine. Once the dataset is too big for RAM or once you need multiple front-ends, you're reimplementing ordinary database features in whatever home-grown system you have.

<comment><USER24> That's helpful, thank you.

</comment></comment></comment><comment><USER26> I used few "hybrid" CMSs from this point of view:

\- dynamic wiki backed by a folder of markdown files

\- dynamic CMS backed by single SQlite file

\- classic dynamic CMS which dumps pages as files while editing, effectively making them static on reading

<comment><USER27> I've been looking for a folder based wiki - was this a custom tool you made?

<comment><USER15> Dokuwiki is working well but its pretty oldschool. Meaning not fun to develop for.

<comment><USER27> Ah, was hoping for something where I could simply add markdown files to folders and it would do all the routing for me. I have a setup that works like this with Flask flatpages[0], but it seems like there has to be a simpler solution out there somewhere. I've been unable to find it though. :-)

[0] [https://flask-flatpages.readthedocs.io/en/latest/](https://flask- flatpages.readthedocs.io/en/latest/)

<comment><USER15> Well by "wiki" it means to me that it saves history of changes and manage user access etc. That probably requires more complicated file setup than just markdown files.

If you want just markdown > website with some administration to edit you can use pretty much any flat file CMS. Kirby CMS is highend but you need buy license. Grav is ok open-source option but i don't like the admin part too much but its atleast active. You can find many more [https://github.com/ahadb/flat-file-cms](https://github.com/ahadb/flat-file- cms) but flatfile cms often becomes pet project that people stop maintain so watch out for activity.

</comment></comment></comment></comment></comment><comment><USER28> it's not perfect, but I had a positive experience recently creating a small web site with Publii:

[https://getpublii.com/](https://getpublii.com/)

</comment><comment><USER29> add (2019)

outdated article/spammy</comment>