OpenSSL Security Advisory - <AUTHOR> https://www.openssl.org/news/secadv/20160503.txt <comment><USER3> Memory Issues: Episode III - Revenge Of The Buffer Overflow (2016)

In all seriousness, repeated occurrences such as these should make people consider other languages for new projects. Despite being quite a C fanboy, I have to admit that even I think manual memory management should be a thing of the past now.

<comment><USER4> I too love C.

I'd almost go so far as to say you need to do a security review before you write one line of code. You need to evaluate if C is a requirement or a preference, and if the security of the project can withstand being written in C (e.g. edge code that may be attacked).

The argument that C (and C++) can be written well or flawlessly is tiresome. "Perfect code" is a fallacy that has been proven over and over again to be untrue and dangerously untrue. You should assume the code quality is less than optimal as your starting point.

I am not promoting any specific alternative (Rust, Java, Go, etc) I am just saying that C/C++ are insecure by design and should be avoided unless they're a project requirement.

<comment> robert-wallis This sounds like a witch hunt. Java has horrible security bugs even today.

Bugs can be found in code written in all languages.

<comment><USER5> Most the horrible security bugs in Java show up in the sandbox, where attackers can supply arbitrary code for you to run.

In contrast, Java as a server language has an excellent security record IME. The last public patch panic I can remember was in 2011 with the denial of service bug regarding parsing of floating points. There has been other security bugs regarding cryptography etc, I'm sure, but in general you can feel very secure running Java on your servers.

It is a shame that security bugs for both are bundled together, making every sandbox compromise a "Remote exploitable" vulnerability. The "applet" use case should probably just die, there is no indication that Java sandboxing will ever be secure, the design is unsound.

<comment><USER6> Oracle is deprecating the Java browser plugin in JDK 9, ie. the applet use case. There will still be support for Java Web Start though.

<comment><USER7> I've always wondered why nobody sandboxes Java applets in a LXC/Docker container or in a chrome sandbox the same way flash is contained.

</comment></comment></comment></comment></comment></comment><comment><USER8> One of the two issues was interestingly found using Clang fuzzing capabilities. This is in-process fuzzing, that Clang libFuzzer makes quite easy:

[http://blog.llvm.org/2015/04/fuzz-all- clangs.html](http://blog.llvm.org/2015/04/fuzz-all-clangs.html)

[http://llvm.org/docs/LibFuzzer.html](http://llvm.org/docs/LibFuzzer.html)

<comment><USER9> Another fuzzer, quite amazing one actually (it managed to create PNG/JPEG images from fuzzing).

[http://lcamtuf.coredump.cx/afl/](http://lcamtuf.coredump.cx/afl/)

<comment><USER8> The (truly amazing) lcamtuf blog post you are referring to is this one:

[http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of- thin...](http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin- air.html)

</comment></comment></comment><comment><AUTHOR> Patch: [https://github.com/openssl/openssl/commit/70428eada9bc4cf314...](https://github.com/openssl/openssl/commit/70428eada9bc4cf31424d723d1f992baffeb0dfb)

Advisory mirror: [https://gist.github.com/FiloSottile/99ad6b52688f5a1f0a5fa200...](https://gist.github.com/FiloSottile/99ad6b52688f5a1f0a5fa2009a891490)

Preliminary analysis: [https://news.ycombinator.com/item?id=11621038](https://news.ycombinator.com/item?id=11621038)

<comment><USER10>
        But it no longer
        checked that there was enough data to have both the MAC and padding
        bytes.

... I am beyond words.

<comment><USER11> Just the C usual stuff, but good bone coders use all the warnings and analyzers from gcc and clang and never commit such errors.

<comment><USER12> I'm not sure whether you are sarcastic or not, but to me the seemingly endless amount of this kind of bug in high profile projects like OpenSSL is pretty good proof that nobody can write secure C.

<comment><USER10> What about [https://github.com/jedisct1/libsodium](https://github.com/jedisct1/libsodium) then?

Very high profile, no CVEs found to date.

EDIT: Can't respond to lambda below.

I was responding to THIS assertion, not proposing libsodium as a general purpose openssl replacement: "nobody can write secure C."

To which I said, here's a project that's written in C that's apparently secure.

<comment><USER13> You can generally respond even if you don't have the link by clicking on the timestamp ("1 hour ago" or whatever) to go directly to my comment.

My comment was not meant to point out that libsodium doesn't make a general OpenSSL replacement. It was meant to point out that if you restrict the problem domain enough, of course it's possible for people to write secure C. I can write a secure "Hello, World!" program; even a secure networked "Hello, World!". But being able to write a secure "Hello, World" does not mean that I am capable of writing secure C in general.

Pointing out one small piece of code that is apparently secure isn't what a claim like "nobody can write secure C" is really about. "Nobody can write secure C" means that when programming in the large, implementing standardized network protocols with all of their warts, having codebases that evolve over time, that no one can consistently and reliably write secure C.

So sure, libsodium may, as of now, have no known CVEs. But it's based on NaCL, which is written by djb. He's also written qmail and djbdns, both claimed to be secure. qmail has had exploitable problems on 64 bit platforms with large amounts of virtual memory: [http://www.guninski.com/where_do_you_want_billg_to_go_today_...](http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html) and djbdns has had security problems exploitable on any platform: [http://article.gmane.org/gmane.network.djbdns/13864](http://article.gmane.org/gmane.network.djbdns/13864).

OpenBSD is likewise a minimalist system with a heavy emphasis on security, but even with that approach, they have had to change their slogan to "Only two remote holes in the default install, in a heck of a long time."

Now, of course, this does point out a few things. Minimalism is important for security; and more minimalist approaches and care in writing code can help reduce the frequency and severity of critical vulnerabilities. But even given some of the most careful, security conscious approaches, people still make mistakes.

That's why, when practicing responsible security, you should use defense in depth. In addition to all of the care, review, minimalism, principal of least authority, isolation, etc, you should also use tools that can prevent whole classes of bugs at compile time.

<comment><USER10> > You can generally respond even if you don't have the link by clicking on the > timestamp ("1 hour ago" or whatever) to go directly to my comment.

[https://twitter.com/CiPHPerCoder/status/727530489255485440](https://twitter.com/CiPHPerCoder/status/727530489255485440)

<comment><USER13> Ah, that sucks.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> ASN.1 is so well-understood at this point that Galois even has a high- assurance toolkit for it:

[http://cps-vo.org/node/1577](http://cps-vo.org/node/1577)

Maybe someone should forward that to OpenSSL team and suggest they pay Galois to crank out a bunch of encoders/decoders for them for anything requiring that in OpenSSL. Or LANGSEC people behind HAMMER toolkit. Or even the Cap n Proto guy.

Seriously, the number of preventable failures in this software, esp memory, is a strong indicator of why you should never use it.

<comment><USER15> > Maybe someone should forward that to OpenSSL team and suggest they pay > Galois

Here's where you can donate your money to pay Galois: [https://www.openssl.org/support/donations.html](https://www.openssl.org/support/donations.html)

Once they've received the funds i'm sure they'll get right on it.

<comment><USER14> Lol. I thought they've had money all this time and not spent it on stuff that works. Meanwhile, LibreSSL did more in a few weeks for their code quality than its owners did in a year. Why would I give them money expecting something different?

The right course, if we're talking Galois, is for them to try to ask Galois to donate some time or tooling to improve critical aspects of a widespread- deployed library. They already make money with grants and stuff for code they often open-source. They might even find thr deliverables useful for them. So OpenSSL team can feel free to give them a call.

</comment></comment></comment><comment><USER16> ASN.1 parsing in implementations of several different standards have had this class of issue for well over a decade. ip phone and software stack vulnerabilities in, for example in asterisk, specifically for ASN.1 handling have probably been used by our intelligence community for a long time. The safe implementations are probably ran in virtual machine languages.

<comment><USER17> I think we should all agree to move from ASN.1 as quickly as possible. Many implementations don't include some of the wacky features (like recursive serialisation of structures), because nobody needs them and they cause bugs. But there is so much more weirdness in ASN.1 that it would honestly be much nicer if we used JSON (as an example of the other extreme). Maybe there's a nice binary, typed format which doesn't resemble the 80s we should be using.

<comment><USER18> Thrift/Protobuf/etc. are reasonably nice IME.

<comment><USER17> The cool thing about protobuf is that it allows automated parser generation (that isn't some horrific hack built on bison). The downside is that if there's a bug in someone else's code, it becomes a bug in your code. :D

</comment></comment></comment></comment><comment><USER19> Not working here -- likely hugged to death -- so Google cache:

[https://webcache.googleusercontent.com/search?q=cache:I3M170...](https://webcache.googleusercontent.com/search?q=cache:I3M170FkOTUJ:https://www.openssl.org/news/secadv/20160503.txt+&cd=1&hl=en&ct=clnk&gl=uk)

Edit: spelling.

<comment><USER20> Or the Internet Archive:

[https://web.archive.org/web/20160503160435/https://www.opens...](https://web.archive.org/web/20160503160435/https://www.openssl.org/news/secadv/20160503.txt)

</comment></comment><comment><USER21> Looks like the "negative zeroes" patch (commit in [https://mta.openssl.org/pipermail/openssl- commits/2015-April...](https://mta.openssl.org/pipermail/openssl- commits/2015-April/000906.html)) was never introduced in debian and ubuntu?

<comment><USER21> I was indeed right :( The danger of only backporting security fixes. But it's in the patch now:

[http://www.ubuntu.com/usn/usn-2959-1/](http://www.ubuntu.com/usn/usn-2959-1/)

</comment></comment><comment><USER22> What's the status of this bug for LibreSSL? (LibreSSL is used in OS X 10.11+)

<comment><USER23>
        OpenSSL announced several issues today that also affect LibreSSL.

        - Memory corruption in the ASN.1 encoder (CVE-2016-2108)
        - Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
        - EVP_EncodeUpdate overflow (CVE-2016-2105)
        - EVP_EncryptUpdate overflow (CVE-2016-2106)
        - ASN.1 BIO excessive memory allocation (CVE-2016-2109)

        Thanks to OpenSSL for providing information and patches.

[http://marc.info/?l=openbsd- announce&m=146228598930416&w=2](http://marc.info/?l=openbsd- announce&m=146228598930416&w=2)

[https://twitter.com/bob_beck/status/727478594591543296](https://twitter.com/bob_beck/status/727478594591543296)

</comment></comment><comment><AUTHOR> My understanding of the padding oracle vulnerability so far, mainly from the patch [0]: it's possible to make a "valid" message that has the pad length byte higher than maxpad (total_length - digest_length - 1) [1]. If you make it high enough, I think you'll push the offset used in the constant time comparison masks enough below 0 to entirely skip the MAC check [2]. But then your entire plaintext will have to match the pad byte to pass the check, and I think you can use that as a padding oracle.

In other words, constant time programming, which by definition means that you have to behave normally even if your offsets go negative, is HARD. (And when you don't put comments ANYWHERE, it's even harder.)

[0]: [https://github.com/openssl/openssl/commit/70428eada9bc4cf314...](https://github.com/openssl/openssl/commit/70428eada9bc4cf31424d723d1f992baffeb0dfb)

[1]: [https://github.com/openssl/openssl/blob/70428eada9bc4cf31424...](https://github.com/openssl/openssl/blob/70428eada9bc4cf31424d723d1f992baffeb0dfb/crypto/evp/e_aes_cbc_hmac_sha1.c#L583)

[2]: [https://github.com/openssl/openssl/blob/70428eada9bc4cf31424...](https://github.com/openssl/openssl/blob/70428eada9bc4cf31424d723d1f992baffeb0dfb/crypto/evp/e_aes_cbc_hmac_sha1.c#L742-L766)

For the record, there is nothing Go or Rust could have done here. The bug is caused by having to write code that runs in constant time, by employing masks and behaving in exactly the same way irrespective of the pad value. If you want to blame the design of something, blame Mac-then-Encrypt in TLS 1.0.

See also The Cryptographic Doom Principle [3].

[3]: [https://moxie.org/blog/the-cryptographic-doom- principle/](https://moxie.org/blog/the-cryptographic-doom-principle/)

EDIT: Interestingly, this was found with TLS-attacker [4], a new framework to analyze, test and attack TLS libraries. Finding it was probably "just" a matter of sending a plaintext made entirely of the same right byte value, and noticing that the MAC check passes when it should not. However, so far we didn't have any tool or testsuite (which I'm aware of) to perform this kind of checks.

[4]: [https://github.com/RUB-NDS/TLS-Attacker](https://github.com/RUB-NDS/TLS- Attacker)

IMPACT [EDIT]: to sum up, if a client uses AES-CBC to connect to a server with AES-NI support, a MitM can recover at least 16 bytes of anything it can get the client to send repeatedly, together with attacker-controlled data (think Cookies or such, using Javascript cross-origin requests).

<comment><USER24> That's a second-order padding attack, in the same sense that an integer overflow most often creates a second-order buffer overflow: a first bug transitions your program to a state where a second bug --- very exploitable, and one the program tried to guard against --- is revealed.

What's interesting about crypto to me is the prospect that every common crypto flaw has second- and third- order variants that we will not find out about for many years, the same way we've barely now got a grip on the interaction between C integers and buffer counting.

</comment></comment><comment><USER25> Does anyone know if there is an SSL specification somewhere? One could then start to write tests at various levels to ensure compliance with the specification. This test suite could then be considered a compatibility test suite as well.

<comment><USER18> The spec generally only specifies the correct behaviour, not what the program should be doing with e.g. malformed ASN.1.

</comment></comment><comment><USER26> These are all errors that would be impossible in a language with, oh, bounds checking.

There may be ranges of security-critical code that make sense to write in C, for example ensuring that algorithms run in constant time, although with modern compilers I have difficulty trusting that the compiler won't accidentally optimize away the constant-time-ness.

Surely ASN.1 encoding isn't part of that range, however?

<comment><USER11> Hoare quote during Turing award in 1981:

"The first principle was security: The principle that every syntactically incorrect program should be rejected by the compiler and that every syntactically correct program should give a result or an error message that was predictable and comprehensible in terms of the source language program itself. Thus no core dumps should ever be necessary. It was logically impossible for any source language program to cause the computer to run wild, either at compile time or at run time. A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to - <USER2> already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."

\-- C.A.R. Hoare, Communications of the ACM, 1981

<comment><USER27> C.A.R. Hoare was the author of the Quicksort algorithm in 1959.

<comment><USER28> C.A.R. Hoare is both still alive and the author of much more than just Quicksort.

</comment></comment></comment></comment><comment><USER29> Off-topic but given how many programs link against OpenSSL and that in some scenarios statically linked binaries are preferable, I've been wondering if there's a Linux distro that works like OCaml's opam, namely rebuilding everything that depends on something that just got updated. Is there such a distro?

</comment><comment><USER30> It's not a great bug, but I think it would require a very particular set of circumstances to arise:

> ... _only certificates with valid signatures_ trigger ASN.1 re-encoding and > hence the bug. Specifically, since OpenSSL's default TLS X509 chain > verification code verifies the certificate chain from root to leaf, TLS > handshakes could only be targeted with valid certificates issued by trusted > Certification Authorities.

However it does seem like a great exploit method for malware, using legit signed certificates that allow overwriting memory just by parsing the cert.

</comment><comment><USER31> Again? Am I the only one calling this the rule, not the exception at this point?

This is where I want the Rust-guys (or D or whatever) to be. "Hey guys. A drop in Libre/Open-SSL replacement, written in rust. Guaranteed to be free of all those security advisories you keep getting on a monthly basis these days".

That's when people will start taking C-replacements like Rust seriously. Step up your game, guys :)

</comment><comment><USER32> Mirrored here, in case official site collapses: [https://marc.ttias.be/openssl- announce/2016-05/msg00002.php](https://marc.ttias.be/openssl- announce/2016-05/msg00002.php)

</comment><comment><USER33> Sorry for the noob question, but how do you ensure a Debian installation is always updated with the latest security patches? Do you just run `apt-get upgrade` everyday? Isn't there a risk of breaking things?

<comment><USER34> I use Debian.

If you're running stable, you should be able to upgrade every day, and nothing will break. that's the purpose of stable; it really only adds security fixes.</comment></comment>


CIA created code to impersonate Kaspersky Lab: WikiLeaks - <AUTHOR> https://www.itwire.com/government-tech-policy/80740-cia-created-code-to-impersonate-kaspersky-lab-wikileaks.html <comment><USER2> Given that [https://www.scientificamerican.com/article/how-cia-fake- vacc...](https://www.scientificamerican.com/article/how-cia-fake-vaccination- campaign-endangers-us-all/) happened as well, this allegation is sadly unsurprising and probably true.

Can Kaspersky Lab sue the CIA / the US government for hurting their reputation / business in this manner?

<comment><USER3> Sure they can try... Chance of winning in a USA court.. near zero. Chance of winning in a foreign court, high, but they'd never get the payout.

<comment><USER4> Suing the CIA is like trying to get revenge on a table saw for cutting your finger off by punching feeding the rest of your arm into it.

</comment></comment></comment><comment><USER5> How is wikileaks a credible source these days? [https://www.wired.com/2016/07/wikileaks-officially-lost- mora...](https://www.wired.com/2016/07/wikileaks-officially-lost-moral-high- ground/)

<comment><USER6> The fact that you don't like what they do doesn't mean that they don't accurately report on the information that they receive.

<comment><USER7> There seems to be evidence that the Clinton emails released by Wikileaks were edited before release. This would conflict with their stated goals and I think is what's hurting their credibility the most right now.

<comment><USER8> There is absolutely no evidence to suggest that (outside of the Clinton camp and Podesta) and given Wikileaks track record, it's highly unlikely.

<comment><USER9> I think some wires are being crossed here, as there has been recent evidence of modifications to earlier leaks from Guccifer 2.0 of DNC documents. These were not published by WL but they are often grouped with WL due to Guccifer 2.0 claiming to be a WL source

</comment></comment></comment></comment></comment><comment><USER10> What's the actual technical thing that happened here? Did they manage to trick Thawte into issuing real SSL certificates for Kaspersky's internet domains?

<comment><USER9> > Did they manage to trick Thawte into issuing real SSL certificates for > Kaspersky's internet domains?

No, that would be huge news. They just created an invalid self-signed certificate with a Kaspersky domain in the CN. This would allow their implant traffic to hide better, as in a program like Wireshark it would just look like a server downloading some anti-virus updates instead of sticking out as a C2 beacon.

Check out the source bundle - Same can be done to create self-signed certificates for stealth in other scenarios which may require a different domain name (For example, if the target uses another program such as Chrome which periodically contacts a server to fetch automatic updates, it would use the domain of that server).

There is no significance of Thawte, other than being the CA which Kaspersky uses. This is to be expected, as the self-signed certificates are naturally going to need to look like the originals, only differing in keys of course.

</comment></comment><comment><USER11> If this is true, the future will be sad. The next time someone will discover a real problem, people will ignore it.

</comment><comment><USER12> Who trust CIA after all that they lied to us ? \- I dont

</comment><comment><USER13> Good for them?

</comment><comment><USER14> Mere mortals trying to understand the inner workings of intelligence agencies make me cringe.

There are no good boys and bad boys here.

<comment><USER15> I would say there are only bad boys.

</comment></comment><comment><USER16> Here comes Wikileaks to the Russia Rescue again. Their reputation is shot afaik</comment>


Looking for a developer - <AUTHOR>

I'm looking for a developer for a project I'm working on with anticipation of submitting it to  YC. I'd like to work with a developer recommended by YC. I was wondering if you have a list of site developers/coders similar to the list you are creating for your Designer Directory.<p>Thanks! <comment><USER2> <http://hnhackers.com/></comment>


Where Do All The Craigslist Cats Go? - <AUTHOR> http://opensuffer.com

<comment><USER2> Probably to PETA which then euthanizes them and throws the dead animals in other people's dumpsters. PETA was found guilty of littering because of this. They were not found guilty of animal cruelty because there was no law against euthanizing healthy animals which is what PETA was doing.

 _Dr. Proctor later added in The Virginian-Pilot: "These were just kittens we were trying to find homes for. PETA said they would do that, but these cats never made it out of the county."_ [0]

[0] [http://www.petakillsanimals.com/trial](http://www.petakillsanimals.com/trial)

Also: [http://www.thisistrue.com/peta.html](http://www.thisistrue.com/peta.html)

<comment><AUTHOR> Death is an act of mercy compared to what researchers will do to them. The in vivo neurological experiments conducted on cats are horrifying.</comment></comment>


Ask HN: Any Inbox UI Alternative App or Gmail Addon? - <AUTHOR> The time has come. What will you do that just love the inbox ui when it is gone? I know gmail has most of the inbox features now but the main focus of UI is very different and I can't stand it. What will (or have done already) you do after April 2nd. <comment><USER2> Commenting because I'm also struggling to find a decent replacement</comment>


Ask HN: What do you as a developer want from a desktop Linux distro in 2017? - <AUTHOR> With Fedora 25 almost out the door, it's time to start planning for our next release, which will be sometime May/June 2017. We'd particularly like Fedora Workstation, our main desktop offering, to be a favorite choice for software developers (from students to freelancers to startups to large organizations). What can we do that would make _you_ excited? What would you like to see in a Linux desktop that you can't easily get today? <comment><USER2> LTS – I don't have time to fool around upgrading and taking my system down. Maybe I can budget time for this yearly, but only if it takes a couple hours max.

Background updates – don't prompt me unless it's a breaking change; do it over night, lunch, any time I'm not actually using the app/library.

1-click backup – give me a brain-dead simple way to configure automatic backups to an external HD, Amazon S3/Glacier, etc; provide built-in support for MySQL/MariaDB backups, and similar sensitive applications.

Actually keep up with patches! For instance, I set up PHP/Apache and PHP is still on patch-level 15 — when p43 is available. Actually keep up. I don't have the time necessary to build my PHP versions from source just to keep them patched.

Sane defaults. Fast boot. Make it work out of the box with _few choices_ , and simple to add on development environments.

Just some scattered thoughts for y'all. (Thanks for asking.)

<comment><AUTHOR> Update: I just upgraded my main workstation, which is heavily customized and has a lot of random stuff installed. Took 26 minutes and 40 seconds from the time I started until I was back in Firefox and able to tweet about it. About 5 minutes of that was downloading and I could keep working, so there was really only about 20 minutes of downtime.

</comment></comment><comment><USER3> Hi, thanks for asking! :)

Some background: I've used Linux since 2004. I think I mostly used Ubuntu, Fedora, and Arch. Recently (2013) I've move to macOS as my primary OS.

* Snapshots. Many of my co-workers are actually afraid to run 'dnf upgrade' (or equivalent) out of fear of it breaking the system. About half wait about a month after a major release, then upgrade to that, get it working, then never touch it. If dnf could take a snapshot and print "if you experience issues, you can revert back by running 'snapshot --revert-to $snapshot_name'". Similar for the GUI.

* App Store style interface for the repos.

* I can't remember if Fedora separated updates into 'new version' vs 'security update' vs 'bugfix'. I would like if security and bugfix installed silently and without intervention (with opt-out provided). I would also like it if new version updates could be marked auto-install on an individual basis and if it would also notify me about what it did. Android does this well, imo.

* Better ability to keep up with the lastest version of package X, particularly when X is related to my dev stack. If the next version has some features you're excited about, it is really unsatisfying to have to wait 4 months because that's when the next Fedora is. Ubuntu has tackled this with PPAs. Chakra (dunno if it is still around) was a semi-rolling release (it updated the base-OS in one go every few months, but everything else would just chase the latest version). Having to setup rvm and the like is just a pita.

* This will be a bigger/long-term thing: separation of my dev stack from the OS. One thing I really like about macOS (homebrew) is that I can chase the latest python/ruby/vim/etc without worrying about that breaking a Gnome app that happens to be written in Python.

* Look nice. A lot of people will write this off as frivolous, but I think it matters. If you are going to be staring at something all day, why not have that thing be nice to look at? Fedora has generally done well here. I don't know how it stands when you throw hi-DPI and mixed-DPI at it though.

* Be able to connect to Cisco VPN and Cisco wifi out of the box.

BTW: What does 'dnf' stand for? How is it pronounced? 'dee-en-eff' or 'dunf' or something else?

<comment><USER4> > What does 'dnf' stand for?

Did not finish, apparently: [https://firstname.lastname@example.com...](https://email@example.com/thread/7ULAG243UNGTOSL6URGNG23GC4B6X5GB/)

<comment><AUTHOR> This isn't really DNF specific — it can happen with any package manager. Whenever I run a DNF update that is going to affect X or my GNOME session, I run it in tmux. There's not really a good solution _other_ than that, which is why the desktop team promotes the reboot-to-apply-updates approach for the general case. It's annoying to have to do that, but it's very reliable. (Or, if you're more tech savvy, the tmux or switch-to-a-VT thing is just fine.)

<comment><USER4> > This isn't really DNF specific — it can happen with any package manager

I don't know about other package managers, but please don't generalize dnf's behavior here to the others, because apt-get and dpkg would be just fine in this case. You can even disconnect from the ssh session and apt-get will continue until it is finished. In the worst case scenario you would call apt- get -f install and it would continue where it's left.

> There's not really a good solution _other_ than that,

Of course offline updates are valuable for the 0.001% scenarios but there are basic resiliency measures one should take while writing the basic building block of the distribution, before throwing in the towel and suggesting running it inside tmux or to use offline updates for everything.

<comment><USER5> > I don't know about other package managers, but please don't generalize dnf's > behavior here to the others, because apt-get and dpkg would be just fine in > this case.

This claim is not matched by my personal experience. Recovery is usually possible, but depending on the particulars may require non-trivial efforts.

<comment><USER4> apt-get -f install is hardly non-trivial.

<comment><USER5> My point is that "apt-get -f" works less than 100% of the time, contrary to the "would be just fine" claim.

<comment><USER4> > works less than 100% of the time

I can't say much about that without seeing some examples. Of course it may not calculate&offer an ideal strategy or even outright choke if the system is put into a manually induced dependency hell, but that's a different scenario than resuming an interrupted process which was otherwise progressing OK.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> It needs to be a better "out of the box" experience than Ubuntu currently is - fonts, available packages, hardware compatibility (wifi and gfx especially), look and feel...

I don't care about free vs non-free I just want everything to work.

I stick to Ubuntu LTS versions, but I'm not sure that's a deal breaker like it is for some other people.

<comment><AUTHOR> Can you be more specific on what "better" might mean to you particularly as a software developer?

Some things like "better look and feel" are not very actionable. :)

<comment><USER6> What is your email? I'd like to give this some fair thought, and in order to do so I want to install Fedora 25 and give it a test drive.

<comment><AUTHOR> [http://mattdm.org/email](http://mattdm.org/email) — but, really, comments in public are more valuable to the project overall.

</comment></comment></comment></comment><comment> ni-hil That the sound, the wifi, the sleep and wakeup, the connection to an external monitor and all those tiny little things just works.

<comment><USER7> Second to this... power management, fonts, hibernation—all the things I take for granted using a mac that I'm suddenly reminded of as soon as I try to use a linux-based notebook. 7 hour battery? Hah—good luck with that when your distro kicks it into performance mode for no apparent reason randomly. These are all the things that keep me using linux on a VM instead of as the host. I could live with it when I was single and had a ton of time on my hands in my 20s. Those days are (sadly!) long gone.

<comment><USER8> The Dell Chromebook 13 (i5) has about 7 hours of battery life under Linux in my usage. It went down a bit when using something heavy like IntelliJ but otherwise it is pretty good.

<comment><USER7> Thanks for the rec, looking at purchasing a new machine in the near future, I'll check that one out.

<comment><USER8> The Linux experience on the Chromebook should be researched before buying it. The best experience comes through removing the write protection on the motherboard and flashing the BIOS. I haven't done that myself yet.

</comment></comment></comment></comment></comment><comment><USER9> Better support for high-DPI/mixed-DPI setups. I.e. I want to connect my external monitor to my laptop and have everything be readable on both monitors.

<comment><AUTHOR> Working on it with Wayland. I think this wish, at least, will come true. :)

</comment></comment><comment><USER10> 1\. Ability to recompile packages with setting some flags. (make.conf from bsd / gentoo). Example use case - I am investigating a hard to track issue and would like to run some system packages with address sanitizer.

2\. Ability to easily patch / hack an installed package. Example use case - lets say I want to change my installed ruby runtime to fix a small bug / add some instrumentation.

3\. Ability to have my local software be available as a package. Example use case - Have automated tooling to take a CMake based library / executable project and have it be built as an installable rpm package.

4\. C++ is changing fairly rapidly currently, having gcc / clang trunk available as a package would allow more users to try out cutting edge features.

5\. Having a performant / good looking GDB frontend. Something like DDD for the modern era.

I fully appreciate that one or more of those might be possible today, but it would be nice if the barrier to entry to do these things would be lowered via some tooling / tutorial style documentation.

<comment><AUTHOR> Like you say, these are all possible today (with the exception of #5, I'm afraid!) but with a lot of hoops. I'm not sure if the recompile/patch of system libraries is a general enough need to make really slick tooling something we can invest in, but better documentation is certainly possible.

</comment></comment><comment><USER11> I'd like cross-distro packaging to become much easier. Most projects that bother to provide Linux binaries at all typically only do Ubuntu packages. That's fine with me, as I use Ubuntu, but it would be great if there was some new packaging format that worked across distros, that would be so ridiculously easy to use (from both developer and user sides), that there would be practically no reason not to do it. I guess this would require some definition of what libraries are included in the system and things like that, but the few popular distros today are quite similar anyway.

<comment><USER12> AppImage [0] solves this in a way similar to macOS apps.

Inkscape and a few others have adopted it.

End User downloads and runs. Its an executable.

As a dev, its easy. They have good docs, and even a jail for sandboxing.

[0] [http://appimage.org](http://appimage.org)

</comment></comment><comment><USER13> Can you make HDMI just work (tm) please? I want to be able to connect my laptop to a tv using HDMI and automatically have all audio being redirected to it. I've been able to use xrandr to get the tv to show the desktop, but sound just does not work. There are a few layers in the Linux sound stack, so knowing which knob to turn isn't easy.

<comment><AUTHOR> For whatever it's worth, I just plugged my F25 laptop into my TV via HDMI, and it basically just worked. Sound didn't automatically switch, but I hit the overview key, typed "sound", hit enter, and built-in speakers vs. HDMI was an easy choice.

We could look at making it switch automatically; I know it does for headphones.

</comment></comment><comment><USER14> Functional package management is the feature of the XXIe century (like guix and nix). Knowing that I can tweak my system and be able to reboot in the previous configuration is very pleasent.

<comment><AUTHOR> We're looking at using ostree for something like this. Probably not in F26, but stay tuned.

</comment></comment><comment><USER15> Windows XP (in classic mode) was about the best it got on the power to simplicity ratio, it's been downhill from there:

\- Stop fucking with the GUI, I need a workstation with extensive hotkey support, not a tablet interface. Menus are not to be feared.

\- Finish it---NT 4 had better GUI tools to manage services, while the XP Explorer is still better than file managers on Linux. CLI is great, but nothing wrong with a visual approach when called for.

\- Bulletproof suspend and resume.

I'm guessing these won't be particularly easy or they would have been done by now.

<comment><AUTHOR> Suspend and resume is _particularly_ not easy, as the hardware vendors aren't going to have our needs in mind until we get a much bigger marketshare, making it a gigantic chicken and egg problem.

On the other things: the GUI we have (GNOME, for Fedora Workstation) has really settled down in core design from how it was a few years ago, with more room for the polish you're looking for. (Despite the superficial appearance as a tablet interface, GNOME is actually pretty awesome from the keyboard, and I actually think of it as a keyboard-primary UI, at least for how _I_ use it.)

</comment></comment><comment><USER16> Might not be exciting to everyone, and I understand you might not want to release _only_ this, but I think it would be nice if you could release a free- software-only variant of Fedora:

[https://www.gnu.org/distros/free- distros.html](https://www.gnu.org/distros/free-distros.html)

[https://www.gnu.org/distros/common- distros.html](https://www.gnu.org/distros/common-distros.html)

<comment><AUTHOR> We get a lot more people telling us that this would be nice than people willing to step up and do it. :) If we had the latter, I wouldn't be opposed at all to such a Fedora variant. We also make it very easy to make a Fedora Remix which follows stricter interpretation like this (and some of those on the list above are based on Fedora).

The practical problem is that very little hardware today will even work, making it a kind of academic exercise.

There's also an _academic_ question which I find makes the particular line drawn here somewhat odd. All non-trivial hardware today requires firmware/microcode of some sort. Loading that at runtime vs. having it baked into an EEPROM doesn't seem like a really important distinction to me.

</comment></comment><comment><USER17> Containerization ( and isolation ) of GUI software

This is sort of implemented already by sharing the X socket with the docker container

<comment><AUTHOR> Absolutely in the works — check out [http://flatpak.org/](http://flatpak.org/). The plumbing for this is in F25, although we're not shipping anything that way yet.

</comment></comment><comment><USER18> Better and smoother font experience.

</comment><comment><USER19> My favorite Linux desktop TODO list: [http://itvision.altervista.org/why.linux.is.not.ready.for.th...](http://itvision.altervista.org/why.linux.is.not.ready.for.the.desktop.current.html)

<comment><AUTHOR> This is an interesting list, and in scanning it quickly, I know we have various people interested in and working on various parts. We definitely recognize that developers are people, and all of these general-desktop-user hardships are hard for developers too.

Is there anything you would suggest, either additionally or as specific areas of interest on the list, for the developer desktop use case in specific? Or would you say that "make it work better for the general user" is the overwhelming priority?

<comment><USER20> I think it is worth reading that article in depth after scanning it quickly. It captures my own feelings about the state of the linux desktop very very well.

<comment><USER21> So that's what I just did. It has some very reasonable points but much of it is utter crack. I can't help but feel reminded of dmr's foreword to The UNIX- Haters Handbook:

 _Here is my metaphor: your book is a pudding stuffed with apposite observations, many well-conceived. Like excrement, it contains enough undigested nuggets of nutrition to sustain life for some. But it is not a tasty pie: it reeks too much of contempt and of envy._

 _Bon appetit!_

</comment></comment></comment></comment><comment><USER22> Nice that you solicit this feedback. Thanks! Here is my personal list.

Very, very important:

* LTS - this cannot be overstated

* Ubuntu-level font rendering

* Laptop driver situation improvement - graphics, wi-fi, power management

Important:

* First-class, deep support for KDE

Highly desirable:

* Easy installers for Broadcom wi-fi, nVidia cards, etc.

<comment><AUTHOR> Can you elaborate on LTS? Does my answer below about upgrade pain address your concern?

On font rendering, we are hampered in some areas by patents. We have made some adjustments starting with F24 (changes to the rendering and improvements to the default system font) which you might appreciate. Good news is that higher DPIs make some of those issues irrelevant, and we're working on good hiDPI support, so.... the future is looking up.

I appreciate that you like KDE, but that's a technology / environment rather than a problem/solution. What does KDE give you that you like?

On drivers, like any Linux distro, we're hampered by the difficulty in getting vendors to even care about us. Red Hat's hardware enablement teams _do_ put in a lot of effort here, and that work generally lands upstream in X/Wayland/kernel, and is enabled in Fedora quickly.

For enabling proprietary drivers without too much pain (while still supporting and promoting open source!)... we're working on ideas.

Thanks for your feedback!

<comment><USER22> Thanks for responding! My concerns are (almost) all in the context of use in laptops.

1\. LTS: In my experience, the issue that has caused most trouble is kernel version changes within a Fedora version. Why? Because drivers break. The laptop works fine just before the update. After the update, I get a blank screen. This has happened with different hardware, at least a dozen times in the last six years. CLI tweaking was needed every single time, to restore X or revert to a previous version. At other times, wi-fi no longer works after an update. At yet other times, random wake ups happen from sleep.

Maintaining the same kernel version (and associated stack) throughout a given Fedora release, in my humble opinion, can do wonders.

2\. Font rendering: Yes, I realise that you have some patent issues. Please do the maximum that is legally possible. Fedora's font rendering hurts eyes after a few hours of work.

3\. KDE: Desktop discussions can be subjective, of course! KDE's menu accelerators and accessibility help in minimising the need for trackpad/mouse use. In my laptop, KDE's responsiveness is uniform and smooth; GNOME experiences random freezes (Cinnamon has the same problem; so, I suspect it is GTK-specific). Also, on all of my laptops (HP, Dell), battery lasts noticeably longer under KDE.

4\. Drivers: Yes, this is an Achilles' heel. Convenient installers for proprietary drivers go a long way in making the experience more pleasurable. Particularly, when we need to install, configure and support multiple laptops (including those of family).

Thanks, again, for soliciting feedback! I look forward to improvements on multiple fronts!

<comment><AUTHOR> 1\. We're almost certainly going to keep the aggressive kernel updates. It's very expensive to maintain a long-term kernel fork with bugfixes, and users benefit from the constantly-rolling hardware enablement. That said, we are working on making automated testing of these updates better, so we can block ones with serious regressions. I think the experience you are describing is likely due to proprietary drivers not matching the new kernel; we have some work in flight to keep the old kernel the default if you have proprietary drivers installed and they aren't updated to match. (Except in the event of a critical security bug.)

2\. Have you looked at the font changes in F24? What do you think?

3\. I know the GNOME team is working on battery life. I haven't experienced random freezing, but for subjective responsiveness, I recommend the Impatience extension which shortens animation time [https://extensions.gnome.org/extension/277/impatience/](https://extensions.gnome.org/extension/277/impatience/) (I've jokingly suggested we install this by default with a timer which shortens the animations the longer you have it installed.)

4\. Thanks; I'll definitely consider that.

<comment><USER22> > we have some work in flight to keep the old kernel the default if you have > proprietary drivers installed and they aren't updated to match

That is reasonable, and should reduce the number of such problems.

> Have you looked at the font changes in F24? What do you think?

Certainly better than earlier versions!

> I recommend the Impatience extension

I shall try that; thanks for the pointer.

Thanks, again, for the active conversation!

</comment></comment></comment></comment></comment><comment><USER23> Portage. I can handle everything else from that point forward.

Gentoo or GTFO. :-)

</comment><comment><USER24> LTS.

<comment><AUTHOR> What does LTS mean to you? Is it _support_ you want? Is it interfaces not changing for many years? Is it not having to worry about upgrades? Something else?

<comment><USER24> Specifically, I hate doing upgrades, and when I manage multiple machines, I don't want the headache of continuously breaking the development flow just up update to a "supported" version, after which I have to learn a new interface, etc. Even worse is if I have to ask individuals to update their own machines... there is a day (at least) of lost productivity!

In fact, this is the main reason that I have stuck with Ubuntu despite the fact that I ABSOLUTELY ABHOR Unity. (Yes, I know that I can use a different window manager, and I do, but I also hate having to constantly re-implement the changes when upgrading, so I only use LTS releases.)

<comment><AUTHOR> This is a pain point I hear about a lot, usually with the suggestion that we should do LTS or a rolling release. LTS is very expensive — and I think prohibitively so for our volunteer community. It's also at odds with our desire to get new upstream software to users quickly. You didn't mention rolling release, but I can get into that if someone wants.

In any case, we _definitely_ hear this and our approach is make upgrades as painless as possible. We've put a lot of work into this over the last few releases, and the feedback right now is very positive; I'm seeing a lot of "wow, that only took 10-15 minutes" on twitter from beta upgraders.

From the command line, it's one command to prep the update another to reboot into the offline update itself, and then you boot into the upgraded system. When F25 final is out, users of earlier releases can even launch this from the Software GUI, just like a regular security update.

As for UI changes... I think GNOME 3 has really settled down here, and most changes you see will be minor tweaks and usability improvements. As of Fedora 25, there's no longer version checking for extensions — we expect them to just keep working for the most part. That's both a result of increased stability in the shell interface itself, and a sort of stability feature in itself.</comment></comment></comment></comment>


Cybersecurity: Here's What Really Worries the Pentagon - <AUTHOR> http://www.wired.com/dangerroom/2010/01/cybersecurity-heres-what-really-worries-the-pentagon/

<comment><USER2> The article and its nested link [http://www.progressivefix.com/spooks-in-the- machine-how-the-...](http://www.progressivefix.com/spooks-in-the-machine-how- the-pentagon-should-fight-cyber-spies) recognize the "Sisyphean task" of trying to secure networks. No matter how hard you work at designing a good network, your inside users will somehow screw it up. "'With seven million systems in the DoD, think how many idiots there are bound to be,' one Pentagon cybersecurity official says."

Some security experts believe they can create the perfect firewall around an enterprise or government. It's not foolproof -- the firewall will either become vulnerable at some time or insiders will compromise security measures through idiocy or subterfuge.

After implementing preliminary security measures, e.g., firewalls, the best step any infrastructure maintainer should next do is to record and archive the massive flow of data through the network, computers, server programs, and applications in any enterprise. While one can't realistically capture all network traffic or every disk write/read, one can capture the "fingerprints" of many of these activities, at hardware-, server/application-, and at end- user levels, including for physical security devices. Once this information is stored and made queryable, an enterprise can pick apart and analyze their information flows and find vulnerabilities, learn to patch them, and find evidence of past misdeeds similar to newly discovered threats. Only with years of queryable archives of 200GB+ daily of log data can enterprises really take this step.

SenSage (<http://www.sensage.com>) realized this and in the early naughties developed the SenSage log data warehouse. The NSA, IRS, U.S. Navy, U.S. Treasury Department, and many health care informatics companies and commercial enterprises use SenSage for this purpose. Check out the "Government" and other sections at <http://www.sensage.com/customers>.

</comment><comment><USER3> from article: "Finally, the NSA has a rich history of monitoring the communications of Americans – sometimes legally, sometimes not."

re: [http://en.wikipedia.org/wiki/Hepting_v._AT&T](http://en.wikipedia.org/wiki/Hepting_v._AT&T)</comment>


React UI Builder - <AUTHOR> https://github.com/ipselon/react-ui-builder <comment><USER2> Some programmers may not immediately see the benefits of having such a UI builder and would never touch the generated code with a ten foot pole.

However I don't think that it's about the code it generates or boilerplate it proposedly saves you from writing. It's way more about the instant feedback and feel you get when dragging UI elements into the canvas, re-arranging them, finding creative ways to (re)structure your app BEFORE you even start coding. This playground will strengthen the concept of the UI in your head, and believe it or not, that greatly enhances your productivity when you do start to code (from scratch or with the generated code).

<comment><USER3> > _Some programmers may not immediately see the benefits of having such a UI > builder_

... expecially those who haven't witnessed the Win16/32 era. VB, Delphi, Centura, ... Everything old is new again.

<comment><USER4> Yes and without going that far in time XAML, WPF or silverlight

<comment><USER3> Some people went mad using XAML.

<comment><USER5> Dad?

</comment></comment></comment></comment></comment><comment><USER6> And over here in the native world we've had drag and drop ui builders for 20+ years. I can't believe how slowly the wheel is being re-invented (over and over and over again) in the web world... when will the DOM and JS die and real innovation starts happening again.

<comment><USER7> Your lament is certainly warranted. It has taken two decades for the desktop to arrive in the browser. However, the journey has been a long one because our browsers has taken a long time to mature, and there are different players with different agendas.

Not to mention that client-server architecture handles majority of people's needs and it has been that way since PHP and RoR until jQuery, ajax suddenly became not enough. We've seen early prototypes of SPA and Flash web applications during this time but the costs were very high. It is lower now since MV* arrived in the browser and we have the tech to replicate a desktop app in the browser but with limitations which is being eroded thanks to thin clients like nw.js, electron, etc (even NPAPI was too thick).

Much as creating a desktop was impossible for early versions of Windows for the average joe, the introduction of a UI/Software builder from MS lowered that barrier of entry significantly but as you know, things moved away from isolated desktop apps to the web and we had to figure it out all over again.

I think the front-end development will eventually be commoditized to the point where somebody could use a tool to generate clean, tested, plumbing code. Back-end is also seeing some of this, particularly with automatic REST api generation tools and write-once-for-both-front-and-backend would be a good catalyst.

Speculation at best but we are in for some interesting times ahead.

<comment><USER6> The formula is: new operating-system/vm/browser > new programming language > new libraries > new ui builder :). Choose any one and re-create everything that comes after. Rinse and repeat en-millennium.

At some point in the next 10 years, a browser vendor will put out a new language that will have revolutionary new features like a 'built in type system' and 'compile time errors', and users will be amazed at how their browser now only uses .1% of their CPU to load a page and wonder why this language wasn't created sooner. And then as developers we will get to live through another golden age of UI Builders as we stoke the bonfire with the tens of thousands of man hours wasted creating JSX, 'components' and javascript/DOM hacks in general.

<comment><USER8> Nah, we will just continue to make more and more meta-compilers for our meta- languages so that they can inevitably become JavaScript just the same.

We will continue to do this until the end of time because we are stubborn developers that need to write our code exactly as only we personally prefer, regardless of the web-destroying and kitten-killing implications.

Seriously though (or are we?) the past 25 years of JavaScripting has amassed one heaping pile of momentum that wont end for at least another 25 years when our programs will be rewritten by our deep-learning quantum neural-net robotrons which will certainly deny us access after erasing any trace of these sacred ancient JavaScripts - leaving us helpless as we wait for our nano-thin clients to render our results in the cloud so that they can be displayed on our nano-thin displays.

It's an abysmal future but someone has to live in it. Me however, I will be surely DEAD. HAHAHAHAHAHAHHA

</comment></comment></comment></comment><comment><USER9> This is great. One big reason that I'm so excited to see more tools like this is that they have the potential to make unit testing less annoying. Build your component and take snapshots of it in different states with different props. Convert that to a Jasmine (or something) spec automatically. This would take care of 90% of the UI unit tests that I write.

<comment><USER8> I plan to add an agnostic generator for code-coverage that can be easily extended to allow generators for a given testing toolkit. I will adapt it as necessary to facilitate unforeseen/esoteric features as new testers get added, but the idea is to make a utility API that generalizes the process of defining contexts and templates for their associated testing code for the generator to use. I plan to support TDD and BDD based systems, and isomorphic module designs.

Once a generator is in place a lot of tests can be fully automated, however some will require minimal input from the developer. That will be the final task, to allow the API to facilitate developer-facing interaction in the build environment, but using a data-driven approach so specialized plugin code does not have to be written by plugins author.

This design will hopefully make the resultant API adaptable for other builder environments such as Google's Polymer Designer (which has recently been rewritten from scratch by the Polymer-dev team, albeit currently unusable).

</comment></comment><comment><USER10> Huge work. Will be very interesting for business users. They often need to build forms quickly and a lot of them.

Please consider to add accessibility attributes (ARIA, [https://developer.mozilla.org/en- US/docs/Web/Accessibility/A...](https://developer.mozilla.org/en- US/docs/Web/Accessibility/ARIA)) - when automated, it can be much more easy to not forget about.

<comment><USER8> I intend to not only add WAI-ARAI conformance but even better, to merge the work of this project: [http://khan.github.io/tota11y/](http://khan.github.io/tota11y/) into the builder itself, so that the developer can benefit from moment to moment conformance feedback as the application is built - instead of the typical process a developer goes through when he builds a successful application and quickly finds out as an afterthought that these things are not only important, but often necessary. If I ever get around to it I want to go the extra miracle mile and allow for an /actually/ usable voice guided process of building software so that blind users can finally leverage their largely underrated skills in abstraction.

It is abysmal how rare it is to ever find any usable software for the blind, even fewer that they actually enjoy using, and I know of not one such tool for development esp. front-end.

</comment></comment><comment><USER11> Have had a huge hankering to build something like this for a while. Excited to try this out!

<comment><USER12> Came here to make this same comment! I've always thought something that combined react with a sweet wysiwyg gui would be the most awesome and powerful tool.

<comment><USER13> Stay in touch guys. Next thing we are going to roll is a fast CSS editing - convenient way to edit CSS for component on the page.

Actually we have a big plans for improvement of the tool. And it will be sooner if you will give us any feedback. Thanks.

<comment><USER14> Hey @ipselon - I'd love to get in touch and chat about this. I can't find your email in your HN profile; any chance you can contact me via vlad [at] webflow [dot] com? Thanks!

<comment><USER13> I added my email, please find it in profile.

</comment></comment></comment></comment></comment><comment><USER15> Having Delphi background (5 years) in another life, and using React for the past year, I was waiting for something like this any day now. Looks really nice.

Not saying it will be easy, bit this should be ported to Electron/Atom.

<comment><USER8> This would be as easy as a easy peaze of Cake. Even easier to bring it to the MUCH MORE SUPERIRIOR NW.JS. Then it would be to react what Intel XDK is to Cordova/Phonegap. And what that greek god guy is to EnyoJS and/or WebOS.

</comment></comment><comment><USER16> Something like this has existed for Polymer.js for a while now called Polymer Designer - [https://polymer-designer.appspot.com/](https://polymer- designer.appspot.com/)

I think as web components start to become standardized we'll see more and more of these types of tools that make it easy to click interface elements together using a GUI.

</comment><comment><USER17> Been wondering when someone would do this. How the community rallies around it rather than relying on the maintainer doing all the work, assuming it's of high quality. Looking forward to giving a try!

</comment><comment><USER18> This thread would be remiss without mentioning the EnyoJS UI builder, Ares2, which has a similar feature set, but also allowed for Dropbox storage (work on your apps anywhere) and Cordova builds from the UI.

All of it runs on node.js with EnyoJS as the frontend framework (MVC, data- binding, responsive panel layouts).

Unfortunately, it seems most development for Ares2 stopped with LG's acquisition of HP's WebOS assets.

Surpringly, there are still a number of developers actively utilizing EnyoJS, and despite its age, has a lot of features you find in more trendy frameworks today...

[https://github.com/enyojs/ares-project](https://github.com/enyojs/ares- project)

[http://enyojs.com/](http://enyojs.com/)

<comment><USER8> Absolutely positutly FALSE.

First of all development of Ares has only recently been reinvigorated by LG devoting assets to the project which HP had taken a dump on when they pretty much gave up on WebOS.

EnyoJS is rock-star tech that rock-stars refuse to look at close enough to realize it is what facebook wants react to be - but 10 years ago, and is now the only truly platform independent JS framework.

Much work has been done by the LG designers as far as UI (I have followed their often ignored progress very closely of late) and the architecture of Enyo.

It is commonly misunderstood due to media sensationalism that LG "aquired" WebOS and it's goodies - NO NO NO - what they did is "aquired" the rights to utilize WebOS, along with the rights to own HP's nifty little office building in San Francisco (to house LG's nifty designers and devs) all under the agreement that they would pay an outrageous amount of money for these nifty items, and furthermore, that LG would slave away at WebOS/Enyo so that HP doesn't have to, all the while so that HP can benefit from the fruits since HP still owns WebOS/Enyo and friends. Phewwwwww

Just don't say things like "too bad LG is murdering WebOS and Enyo" because it makes me feel sad and angry and contributes to the propaganda machine of dis- information regarding the details of the deal between LG/HP (the details which have been hashed out in a secret agreement BTW) - this doesn't help things as the media was left with no choice but to sensationalize it even more, and without the benefit of the facts of the deals terms to at least sprinkle some truth around too.

</comment></comment><comment><USER19> The new version of React-UI-Builder is now available! Quick CSS editing panel was added - convenient way to change component's style. Now it's a time to write some tutorials and documentation, any help will be really useful for our team! Thanks everyone for interest!

</comment><comment><USER20> I would love to see a side-by-side of this and those awful "website builder" tools that domain/hosting providers churn out.

I bet this would seem easier to use, and have a much nicer finished product -- as well as being flexible if the user wants to (which of course is almost never the case with users of aforementioned tools).

<comment><USER13> You are absolutely right. But I should confess builder was inspired and some ideas were taken from those builders interfaces. :-)

<comment><USER20> There should be no shame in such a "confession" \-- don't most great things come from deciding something crappy could be better? :)

</comment></comment></comment><comment><USER21> This this really rad man! I love it.

So I tried it out and the UI just doesn't work in Chromium 43.0.2357.130. Cloned one of the example projects but non of the controls respond to anything. Investigating... Will file an issue if I can find out what is going wrong exactly. Anyone else experiencing similar issues?

</comment><comment><USER13> Who doesn't want to install react-ui-builder locally I made on-line demo version. However, demo doesn't allow use it full cycle development.

[http://umyproto.com/react-ui-builder/](http://umyproto.com/react-ui-builder/)

</comment><comment><USER22> This is pretty interesting, I was waiting for something similar to this to happen that looked like Interface Builder in XCode.

That said I'm curious to see how good this can be without static types.

</comment><comment><USER23> Wow, this looks very interesting. With the upcoming releases of Relay and GraphQL, it would be a great addition to be able to specify what data the components need as well.

</comment><comment><USER24> Tried cloning a project and it told me this:

Object #<Object> has no method 'isAbsolute'

Any ideas?

<comment><USER13> Hi,

There is problem with fs lib in node.js. So, please update your local node.js to the current version.

</comment></comment><comment><USER25> How to clone project? Whenever value i input in the "Local directory path", it always say: {"errno":-2, "code: "ENOENT", path: ""}

I don't think it's stupid at handling common situations like that for someone to try the first time.

<comment><USER26> I think the issue is permissions. Since the browser is creating and writing to files. I was having this problem and changing the permissions on the target directory to 777 fixed the problem.

<comment><USER27> Yes, and more obviously, the project directory needs to exist.

</comment></comment></comment><comment><USER28> It even create reflux stores and actions. Like +1

</comment><comment><USER29> So this requires bootstrap? :(

<comment><USER30> It has the concept of boilerplate projects that you can start from. Right now, its bootstrap or material or a blank canvas.. But there is nothing preventing you from creating a new boilerplate project for foundation or semantic-ui if you choose to ( and he is asking us to basically contribute such boilerplate projects ).

<comment><USER29> Ahhh that's really cool! Thanks for clearing that up.

Not sure why I got down voted.

</comment></comment></comment><comment><USER7> This has _huge_ potential. I just saw the tutorial video and super excited. I don't know why I didn't think of this before, this could be the 'missing' piece of the front-end application puzzle. What I mean by that is that there are so much fragmentation in this landscape and a tool like this could eventually consolidate all the heterogeneous attempts by forcing others to adopt the same UI builder, and compete on that front.

The tool is shockingly reminiscent of early 2000s, where anyone could make software using VB. Recall that VB had everything done under the sun, somebody had built a component on VB, you could use that or you could hack it for your need. Another example is Google's Java Swing UI builder (as horrible Swing is), allowing data binding with the form. These never caught on but we now have this technology in the browser. Whoever owns the UI builder tool market will emerge as the victor, Facebook should hire you immediately.

There are several appealing points about the React UI builder which I think will help me:

\- WYSIWYG editor to drop bootstrap component allows me to easily build from my mockup wireframes and save me from typing everything out.

\- ability to edit the code directly for each component. Would be nice if I double clicked a button it would create a click event (just like visual studios or netbeans)

\- ability to use html directly in the code (okay, feature of react which is a bit controversial but for me it definitely beats using + everywhere)

\- generates clean, easy to understand plumbing code (this is what I spent a lot of time on when I used to build my swing tool [https://github.com/jjk3/scrape-it-screen- scraper](https://github.com/jjk3/scrape-it-screen-scraper))

I been putting off learning react.js,flux and such but this actually entices me to use it for my next project ([https://github.com/whatsdis/hedgehog](https://github.com/whatsdis/hedgehog)). I will write up a follow up experience using the React UI builder, hopefully my feedback will be helpful to improve it.

You got something here. Keep at it!

<comment><USER31> Yeah, same here - I was exploring this area last year in a few different ways [0]. I think it was still early then, but with GraphQL, DataScript, React Native, etc. I think we're really getting close to some very, very powerful tools for UI. A lot of the backend can be removed, and focus can go into the frontend (to some extent, obviously).

[0] [https://dl.dropboxusercontent.com/u/412963/zenrise/zenrise_p...](https://dl.dropboxusercontent.com/u/412963/zenrise/zenrise_preview_intro1.mov)

<comment><USER32> Something similar (in terms of interface) [https://vimeo.com/128038818](https://vimeo.com/128038818) [https://vimeo.com/128038770](https://vimeo.com/128038770)

<comment><USER13> There are a lot of such tools which allow to create a layout of your pages. In case of builder you should consider page as a desk for combining components into some composition which you will reuse as a component itself. So, there is very small similarity - only because you can copy/paste/delete some components.

<comment><USER32> Your tool looks awesome! Yes there are lots of such tools.I should have worded mine as 'something along the lines of ...' instead of saying that its similar.</comment></comment></comment></comment></comment>


Too Fast to Match? This 401(k) Misstep Could Hurt Retirement Savings - <AUTHOR> https://www.finra.org/investors/too-fast-match-401k-misstep-could-hurt-retirement-savings <comment><USER2> On the flip side, if your employee will let you match as fast as possible, you can grab entire extra year's match by blasting away in January and quitting in February, etc.

<comment><USER3> In general, for job hopping tech workers, it's smart to:

1\. Start the year at the lowest contribution amount sufficient to get the highest possible match in each pay period.

2\. Stop contributing once you hit your annual maximum match.

3\. If you get a new job, return to #1.

4\. Near the end of the year, increase your contribution to hit the annual contribution max.

You don't want to lose out on your new employer's match by maxing out contributions early in the year.

<comment><USER2> Agree, though readers need to parse that advice carefully.

(Also, be careful that you don't go over the IRS limits.)

</comment></comment></comment><comment><USER4> Another take on this. If the market is going up at 10-12% and you get your money up front ASAP. You can stand to make more than ~$180. 10% of 18000 is $1800.

<comment><USER5> > If the market is

This assumes you can effectively time the market. Most people cannot. Conversely, if you dump $18000 in up front ASAP and the market goes down 10%, you've just 'lost' $1800.

If you are in for the long run (as most retirement accounts are), it's probably better to contribute more capital (i.e. take advice of this article) than to try and roll the market timing dice and rely on capital gains windfalls to increase the value of your retirement account.

<comment><USER6> The entire premise behind buy-and-hold investing is that you expect your investments to grow by ~7-11% per year, over the long run. If you're expecting your investments to stay flat over the long run, there's no reason to invest in the first place.

Given that you expect some growth every year on average, it makes sense to take into account the opportunity-costs of delaying your investments.

Or to put it in more obvious terms: Investing $18k today, is better than investing $18.2k in 2019, which is better than investing $20k in 2028.</comment></comment></comment>


Go Execution Tracer - <AUTHOR> https://docs.google.com/document/d/1FP5apqzBgr7ahCCgFO-yoVhk4YZrNIDNf9RybngBc14/pub

<comment><USER2> This look really promising! It will probably help paving the way towards a proper Go debugger?</comment>


The world's first demonstration of spintronics-based artificial intelligence - <AUTHOR> http://sciencebulletin.org/archives/8515.html <comment><USER2> Since when AI became a hardware problem then an algorithmic problem?</comment>


The Matasano Crypto Challenges - <AUTHOR> http://cryptopals.com/ <comment><USER2> Out of context, but I couldn´t resist.

"Matasano" is one of my favorite words in Spanish, not for its meaning, but for how it sounds. Anyway, here is the meaning:

mata=kill

sano=healthy

So, literally it means to "kill the healthy" and it is used to refer to doctors, usually in colloquially, rather than pejorative, terms.

Sorry for the interlude.

<comment><USER3> [https://news.ycombinator.com/item?id=4684599#up_4684845](https://news.ycombinator.com/item?id=4684599#up_4684845)

<comment><USER2> Thinking about this, Matasano turns out to be a rather good name for your company. After all, your services are about trying to "kill the healthy" system, so to speak.

<comment><USER3> That's how we rationalized it. :)

</comment></comment></comment></comment><comment><USER4> Also by Matasano, and tons of fun: [https://microcorruption.com](https://microcorruption.com)

In-browser reverse engineering game.

<comment><USER3> Thank you! That was Hans, me, Daniel, Andy, and (especially) Nicholas the intern. The followup we're planning to it is going to be pretty intense.

<comment><USER5> Oh dear.

I already wrote an emulator for the MSP430 from scratch just to try out an approach for the current challenge's final level.

And now you tell me the _next one_ is going to be pretty intense.

</comment></comment></comment><comment><USER6> Incredibly good news! I emailed earlier this year and got no response, and I was afraid the whole thing had gone away. It's like Christmas in August!

<comment><USER7> I think they were massively overwhelmed with the response to the challenges. They were handling all the responses manually. It's great to see that they have made things more scalable and just put them up for everyone.

It gives me a lot of faith in humanity when people share their knowledge and expertise so altruistically. Really looking forward to going through these.

Thanks guys.

</comment></comment><comment><USER8> A good complement to this set of challenges is Dan Boneh's Crypto class on Coursera. The coursera class is more theory-driven, whereas these challenges are more practical... they mix well. [https://www.coursera.org/course/crypto](https://www.coursera.org/course/crypto)

<comment><USER9> I just finished Cryto I and immediately signed up for Cryto II. Very well done online class.

</comment></comment><comment><USER10> Great that the challenges are up!

Feel free to join #cryptopals on Freenode :)

</comment><comment><USER11> Glad to see that this was not dropped! I did notice that matasano.com/articles/crypto-challenges/ has been returning a 404 for the past month or two.

Will there be a way to automatically submit / advance, for those of us that would like to do them without encountering spoilers?

</comment><comment><USER12> I'm stuck on set 1 challenge 4, detecting single-character XOR. I know how the cipher works, having solved challenge 3, but when I brute-forced all 327 hex strings in their challenge data with each of the 256 possible one-byte keys, none of them deciphered to anything like English. I suspect a typo in their data, since one line -- 1c3df1135321a8e9241a5607f8305d571aa546001e3254555a11511924 -- actually has 58 hex digits, not 60. Has anyone else run into this problem?

Edit: Of course I would solve this right after a post saying I can't. I was only looking at the (string, key) pairs which deciphered to all-printable plain text, but forgot that \r, \n, and \t count as printable ASCII characters.

</comment><comment><USER13> What textbook would be recommended for someone wanting not only to accept the challenge, but also to get some theory under their belt at the same time?

<comment><USER14> If you want to learn the math, check out [http://www.amazon.com/Introduction- Mathematical-Cryptography...](http://www.amazon.com/Introduction-Mathematical- Cryptography-Undergraduate-Mathematics/dp/0387779930).

<comment><USER3> I like this book a lot, but you won't need any of this math until set 8. I spent a lot of term learning things like lattice basis reduction algorithms (I used Strang's linear algebra book and MIT lectures) only to discover that there really isn't a whole lot that requires you to break out linear algebra in day-to-day cryptography.

In particular: virtually all of block cipher crypto and message authentication relies on straightforward math. (It would be different if our challenges covered poly MACs, but we don't have good examples of common flaws in poly MAC implementations).

<comment><USER15> Nonce reuse? It usually gets you at least forgeries, and in GCM's case it even gets you key recovery.

I agree that the published sets of challenges don't really need much theory.

<comment><USER3> Are you referring to Joux here? Is the math for that really complicated? (I haven't tried to implement it.)

 _Later: I just read Ferguson, with the linear algebra._

<comment><USER15> Yeah. Joux's attack is conceptually simple. You have 2 tags T_0, T_1, obtained with distinct messages and the same IV. This means T_0 = S_0 ^ X and T_1 = S_1 ^ X, where X is the same value for both. So you have T_0 ^ T_1 = S_0 ^ S_1. S_0 and S_1 are the polynomial evaluation of the ciphertext at H, the authentication key (which is also the same).

Now, via a simple polynomial evaluation property, you have f(x) + g(x) = (f + g)(x). We know f and g --- those are the two ciphertexts being authenticated here, interpreted as polynomials --- and we know that the polynomial f + g - S_0 - S_1 must be 0 at H. From there it's a matter of finding the roots of this polynomial, one of which is H, and this is the mathematically complicated part of the attack. Though you can treat root-finding as a black-box, the keywords here are Berlekamp or Cantor-Zassenhaus.

(Hopefully I didn't get this too wrong, I'm handwaving here)

<comment><USER3> Can you imagine how much more insufferable I'm going to be once I have worked examples of these attacks? ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I only did the first two, which I hear are pretty trivial in comparison to the later ones, but I still had a great time and learned a hell of a lot in the process. Definitely highly recommended even if it's just for fun or out of idle curiosity, and no prior knowledge required. Looking forward to reading some 'proper' solutions now...

</comment><comment><USER17> I'll probably always regret not getting further into these than I did (life intruded, and then the psychic debt of being late disincentivised me from returning to them). One of these days I really do intend to finish 'em.

Thanks for crafting them, and thanks for posing them. Hopefully you guys got some great new hires out of it!

</comment><comment><USER18> On [http://cryptopals.com/sets/4/challenges/31](http://cryptopals.com/sets/4/challenges/31) , I'd just make it return the offset of the first byte that don't match to simulate the information that a timing leak would reveal.

<comment><USER19> Oh, I made it return the whole thing since the timing attack would have leaked it anyway.

</comment></comment><comment><AUTHOR> These are great challenges for learning crypto. They've provided solutions in 10 different languages.

<comment><USER20> It was a really nice adventure to complete all the 6 sets. Learned lots of useful stuff. My great thanks to tptacek and the team who prepared such a nice hands-on crypto class. P.S. 7th set is insane (in a good way).

<comment><USER3> The 8th set ends in an elliptic curve attack that (a) is useful in the real world and (b) only one person I know has been able to implement. It is amazing.

</comment></comment></comment><comment><USER21> Will it be some more than implement & compare with the provided solution?

<comment><USER22> A more comprehensive test data would be awesome.

</comment></comment><comment><USER23> Would like to see real-world-ish _Clojure_ crypto concerns.

<comment><USER3> You mean solutions in Clojure? We got 'em. Or do you mean "crypto issues specific to Clojure"? What would those be?

<comment><USER23> > You mean solutions in Clojure? We got 'em.

Great, I'm interested.

> Or do you mean "crypto issues specific to Clojure"? What would those be?

Ah, I see now that these challenges are more of the _language-agnostic_ type, rather than a demo of platform quirks. I suppose that negates my previous comment. Thanks for posting the challenges!

</comment></comment></comment><comment><USER24> Something isn't right.

Not Found

[http://cryptopals.com/sets/1/challenges/1/ruby](http://cryptopals.com/sets/1/challenges/1/ruby)

<comment><USER3> The solutions aren't up yet, so you have a very little bit of time in which to solve them before they're spoiled for you.

Ruby should go up Wednesday. Tomorrow I know Python and C++ go up, and hopefully Haskell.

<comment><USER25> Random meditation: I worked through a lot of the early exercises in Haskell, and partly to learn Haskell. I did a lot of things a "silly" way - didn't use the Vector libraries at all, for example. I learned a lot from doing that, and I wonder if a shiny set of Haskell examples using half of Hackage would provide the same learning experience.

Also: do you have a set of Perl examples? If not, I'd be happy to put them together.

</comment></comment></comment><comment><USER26> Once solutions are up, will there a be a way to test your answer against solution without actually viewing the solution, as there is on project euler?

<comment><USER27> I would expect probably not, but my experience with these is that it's generally pretty obvious when one has a correct solution.

(except for the one problem in set 5 where they computed the hash of the ascii string representing the solution and I computed the hash of the actual number)

</comment></comment><comment><USER28> Thanks for bringing this back! I've been wanting to study crypto, and I usually enjoy @tpacek's comments on this site.

<comment><USER23> This is cool, but it's one of those things I sign up for and then I never 'have time'; the emails fade away in the deep abyss of gmail account.

<comment><USER23> ... just realized they are posting the challenges on the site this year, rather than via email.

</comment></comment></comment><comment><USER29> Got through the first 4 of set 1. This was emailed challenges though from a while ago. I'll check this out now.

</comment><comment><USER30> Easter egg spooked me: "I'm killing your brain like a poisonous mushroom"

<comment><USER31> That's a line from the song "Ice, Ice, Baby" by Vanilla Ice. So it is no wonder it spooked you.

I did a couple of the matasano challenges in the past and there were a lot of music lyrics strewn all over the place.

</comment></comment><comment><USER32> I still havent finished the first email

</comment><comment><USER33> All cryptography is broken before implementation so, it really only looks like a compression mechanism for now.

</comment><comment><USER34> 404 on [http://cryptopals.com/sets/1/challenges/1/python](http://cryptopals.com/sets/1/challenges/1/python)

<comment><USER35> If you actually read the big red warning on the main page, it notes that many pages are incomplete and some stuff isn't up yet.</comment></comment>


Why Apple built Final Cut Pro X - <AUTHOR> http://sachin.posterous.com/why-apple-built-final-cut-pro-x <comment><USER2> My guess is that they don't really _want_ to be in the pro apps business. Their pro apps were built or acquired for platform-strategic reasons during a time that the company's future was a fraction as stable as it is now and they don't really fit with the focus of the company.

But it'd be tough on a number of levels to outright cancel such a successful product as Final Cut Pro. And it's beneficial for them to have a stable of very capable media app developers that help drive design of and exercise system frameworks like AVFoundation and GCD and provide code/expertise that trickles down into media apps that are more aligned with the company's focus and main customers.

And I think they _do_ think there's more profit to be made from a much larger audience of prosumer/pro-but-non-top-10-blockbuster-movie-editors. Bet they're right, too.

<comment><USER3> You don't get the "prosumer/pro-but-non-top-10-blockbuster-movie-editors" without being in the pro apps business. Moreover their pro apps fit the focus of the company, a high end creative company. It's hard to market pro apps to aspiring professionals and prosumers if pros are not using it. Part of Apple's marketing campaign for their pro apps is to show how pros are using their software.

<comment><USER4> Apple is no longer a "high end creative company". Their business now is making pretty, easy-to-use devices for non-techie consumers. They just happen to still have this vestigial organ hanging off the side.

<comment><USER5> I don't quite understand why they don't spin their pro apps off into their own company.

<comment><USER6> Exactly! If they had done this before killing off Shake, I bet we'd still have a half decent competitor to Nuke in the high end compositing space, instead of nothing.

Instead, Apple killed Shake and let big studios buy the source code from them so they could continue to use it.

<http://en.wikipedia.org/wiki/Shake_(software)#History>

<comment><USER7> Apple used the Shake team to build Motion, an application which a much larger user base.

<comment><USER8> What? Shake was THE node based compositing app!

There is a massive difference to Motion and the highend compositing apps like Shake, Nuke, Fusion, Softimage(Illusion+Matador=FXTree), Houdini(COPS), Flame, Toxik(Autodesk Composite). After Effects and Combustion are time-line based like Motion, but Motion doesn't begin to compare to them. Even Blender has fantastic compositing tools.

Shake was serious business. It's last well known big project was 'The Dark Knight' which Framestore CFC mangled a 64bit wrapper around it to better manage the 8k-frame workload. Shake was ported to Intel, then killed off, with no intention to take it to 64bit. I don't think you can buy the source code anymore.

<comment><USER6> The Foundry is absolutely kicking everyone else's ass with Nuke. They have an interesting business model as well: don't do much research in house, instead work with studios with big R&D budgets and license their tools when they're mature, bringing it to a wider audience.

They've done it with Digital Domain and Nuke (compositing), Weta and Mari (3d paint), and now Sony and Katana (lighting).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> If this is Apple's thinking, I think they're in serious trouble. It sounds to me they're taking how they build the iPhone and iPad and applying it to FCP, and it doesn't work.

There are two types of people: People who pay for video editing software and those that don't. I actually paid for Adobe Elements a few years back. It was painful, but I needed it for a specific reason. But I seriously doubt I will ever pay again (unless it's $2.99 or something). Most people will be fine with iMovie or Windows Live Movie Maker. It does 99% of what you need and braindead simple.

My wife (and her friends) regularly record GBs of video each week. The problem is that nothing in FCPX fixes their core issues -- most revolve around video management, and not actual editing.

There are amateur video editors out there, but I don't think its a growing market. It's not small, but I think Apple is making a poor bet if they think the millions of ppl creating video with their phones and cameras is going to buy this product.

<comment><USER10> _there are amateur video editors out there, but I don't think its a growing market. It's not small, but I think Apple is making a poor bet if they think the millions of ppl creating video with their phones and cameras is going to buy this product._

This is quite possibly the most wrong comment I've ever read on hacker news. every kid on earth with a skateboard or snowboard or BMX bike will be buying this software as soon as they can afford it.

<comment><USER9> Funny you say that because my neighbor has a half-pipe (apparently, that's how it's spelled) in his backyard and I've never heard his son talk about editing video with FCP. And he actually does have a fair bit of video, as he uses a helmet cam.

But again, for him its usually management (I actually recommended something I saw called Project Odessa to him -- not sure if he's using it though). He does super simple titling, and on occassion a soundtrack. But he doesn't need something like FCPX. And if he did use it, he wouldn't buy it. Give him a copy, and I'm sure he'd use it (if he had a Mac), but free does everything he needs.

This isn't to say that some won't buy it (clearly the singular of anecdote isn't data), but I think its like non-free and non-pro music mixing software. Sure there is a market for it, but its just not huge.

<comment><USER10> It's a half-PIPE, gramps.

<comment><USER9> Thanks. The way the kids talk nowadays, you can't really tell what they're saying. :-)

<comment><USER10> No problem. I don't see how you can think amateur video editing is not a growing market. Vimeo/Youtube seem to contain a lot of evidence to the contrary...

<comment><USER9> That last sentence of mine wasn't clear. There are tons of people who will edit video and put it on YouTube. That I don't doubt. And most will use free or nearly free software to do so (in a huge number of cases, no SW at all, beyond editing on the actual capture device itself).

$300 is a lot of money to spend on any piece of SW, much less something as niche as video editing. Especially if you were to ask people what feature they want -- all of them are available in free programs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> My problem with the change in FCP is that it's following an unpleasant downgrade pattern on their platform. QT 7 was far more useful than QTX. 10.6 & earlier Mail is far more robust than 10.7 will be. And it goes on.

Apple's really pushing a premium consumer biz model, leaving professionals in the uncomfortable position of not having a professional platform.

<comment><USER12> What's your problem with QTX and Mail? The new Mail is awesomely awesome (the old is rubbish in comparison) and QTX is a player like QT7 was. Not much to do wrong.

<comment><USER13> And more importantly QT7 is still available in 10.6 and QTKit automatically invokes QT7 instead of QTX when necessary.

<comment><USER11> QT7 is available if you know about it and either download it or install it from disk.

QTX / QTKit don't provide a way to:

\- save in formats other than H.264 for iPhone or computer

\- select datarates other than 2x for iPhone or 1x computer

\- export just the audio

\- export a still / image from your video

\- do simple in/out copy/paste editing

</comment></comment></comment></comment><comment><USER14> I used to work in the post-production industry here in Chicago, specifically as an editor. I can't think of any well known commercial post-houses that abandoned Avid for Final Cut Pro completely. I know plenty of shops that USE FCP along with Avid, but the risk was always too great to fully abandon a platform that was proven to work (most of the time).

I can't speak for feature film editors, but virtually all of the commercial film editors I know still, to this day, use Avid for most of their projects. Editors are a finicky bunch, and I can certainly see Apple realizing that to truly compete in that market, it's all or nothing. The problem with FCP was always the uncertainty of it, hence the reason Avid is still in use at most shops, despite the fact that editors love to bash it.

As time marches on, I can see where FCP might, yet again, be at the forefront of innovation. The problem is, busy editors don't REALLY want innovation. They want proven systems that work. I think Apple made the right choice.

</comment><comment><USER15> The article doesn't say much beyond the speculation already running rampant in the blogosphere. "Apple doesn't care about the pros", "They are a hardware company so they just want to sell boxes" and so forth.

What I think the article did miss is the recent FAQ announcement by Apple detailing where they intend to take the software from here. I'm not a video editor, nor do I play one on TV, so I can't speak to how that addresses the wants of the pro audience, but they are at least making an attempt to explain how they will be incorporating pro needs into future patches. How that turns out, is a completely different question.

<comment><USER16> you miss the overall trend: Apple phased out the XSAN hardware, XServe, they terminated Shake, one of the most advanced fx creator in the industry. That's consistent over the years. What's obvious is that Apple cares about creatives (design consultants, video freelancers etc.) but do not care about corporate video producers.

</comment></comment><comment><USER17> I have to ask. When a newbie goes to the Appstore looking for video editing software and they see the bad rating, who is actually going to buy the software. Plain and simple, I think that Apple just blew this one.

</comment><comment><USER18> It makes sense. With all the great competitors why would Apple throw money after aging software.

With Adobe you can work in any of Photoshop, Illustrator, After Effects and Premiere. With FCP it's just that little bit harder. So if you can't match the features of your competitors, make one that will outperform everyone.

Essentially: Speed, simplicity, beauty, and most importantly the illusion that the software is doing your work for you.

</comment><comment><USER19> The author left Apple in 2008 while the FCP X project just started, I don't think he is the best person to know 'Why Apple built FCP X'.

</comment><comment><USER20> Can someone write about what's going on? Is it the same type of stuff that happened to the XServe line?

<comment><USER21> The latest version of Final Cut dropped a bunch of features that are vital to pros and focused more on features that are useful advanced amateurs. Basically if you used Final Cut to edit home movies and amateur film productions then the new version is vastly improved. If on the other hand you used Final Cut to earn a living editing feature length movies and television productions, then the new version is a bit of a complete disaster. I guess Apple figured that there wasn't enough money in the pro market, and decided to double down on the enthusiast and advanced amateur market.

<comment><USER22> Also, they've been working on FCPX for two years, and needed to ship. Even if it wasn't quite ready for pro usage.

<comment><USER23> Why ship a product that doesn't meet the needs of your customers?

<comment><USER24> Isn't that the general philosophy of HN? Fail fast and iterate until you hit customer fit.

</comment></comment></comment></comment></comment><comment><USER25> It seems to me that the ascendancy of the Mac in the last ten years has a lot to do with them being in the "pro space" -- specifically software and web development pro space -- and being one of the best.

The geeks, that is, the mavens and influencers, folks whom others when to for advice about what computer to buy, were buying Macs because it really was such a nice environment. It still is.

Their strategy for ipod too reflects this as well: target the well-heeled, early adopters, people who like to chatter about their toys. Make the brand desirable through organic PR -- that is, build a truly desirable product even if it's not quite at a mass-consumer price point, and let the pent up desire sell the lower end, targeting various price points with well-vetted technology and UI.

I don't use Final Cut Pro, but it sounds like they're taking a different tack than usual. I don't understand it. This article didn't help.

</comment><comment><USER26> Interesting, looks just like Cyberlink's PowerDirector.

</comment><comment><USER27> Seem to be ðe same idea behind Gnome.

</comment><comment><USER28> Makes me wonder about the future of Logic Pro. Most of the Logic team has been occupied working on Garageband for iOS.

</comment><comment><USER29> That post is very obnoxious. it mentions why apple won't do several things, and make it seems cool while not doing it, but fail to tell one thing it bothers to actually do.

At the end of the read all i know is it doesn't have features, it doesn't support any format... but it does it well so because of that I should buy apple.

I don't buy it.</comment>


9 Rules for Clear and Intuitive Icons - <AUTHOR> http://uxmovement.com/buttons/9-rules-to-make-your-icons-clear-and-intuitive/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+uxmovement+%28ux+movement%29

<comment><USER2> I'm not sure I agree with all of these. I would never have guessed that a paper plane could represent sending an e-mail.

Similarly, I would never associate an underlined, blue L with a link. Maybe I'm too far into the web development rabbit hole, but I thought most people these days associated a chain link with an internet hyperlink.

</comment><comment><USER3> Who is writing these "rules"? They sound more like opinions, which is fine if they're coming from a reputed source like Tufte or Nielsen. But who is "anthony"?

<comment><USER4> I'm continually disappointed to see uxmovement.com posts feature here.

</comment></comment><comment><USER5> The other reason to label buttons with icons is so that they become larger and are easier to target.

Also, I'm sure I've seen that row of house icons before. Anyone know the original source?

<comment><USER3> I think Lukas Mathis created it for his post "Realism in UI Design" [1].

[1] [http://ignorethecode.net/blog/2010/01/21/realism_in_ui_desig...](http://ignorethecode.net/blog/2010/01/21/realism_in_ui_design/)

</comment></comment><comment><USER6> One rule for clear and intuitive icons:

1\. Google Image Search for name + "icon". Match most prominent design to your style.

This solves almost all of your icon needs.

</comment><comment><USER7> Icons should be iconic, a paperplane is not iconic of email. Icons take time to establish, you can't just create an icon, something becomes an icon as it becomes recognizable through repeated use.

As for the "Home" icon example I can clearly see the Home icon from OS X. The home icon from OSX is a better icon because more people are familiar with it.

Should the Save icon in Google docs be a floppy disk or a cloud? The floppy makes no sense when you think about it, but it's a better icon because for 20 years people have been clicking that to save their files. I'd even argue the same thing for the link icon, it's on enough interfaces that people who want to link things know to click that button.

You should only really create new icons when there isn't something existing. Buy an icon pack and be done with it. People will be more familiar with them because they are used around the web.

edit: My bad, there is no save icon in Google Docs, but if there was...</comment>