Why Incentive Plans Cannot Work - <AUTHOR> https://hbr.org/1993/09/why-incentive-plans-cannot-work <comment><USER2> Relevant...

RSA Animate: The surprising truth about what motivates us

[https://www.youtube.com/watch?v=u6XAPnuFjJc](https://www.youtube.com/watch?v=u6XAPnuFjJc)</comment>


Sublime Text 2: Public Alpha Released - <AUTHOR> http://www.sublimetext.com/blog/articles/sublime-text-2-public-alpha <comment><USER2> As the author of Sublime Text, I'd just like to say thanks for all the kind comments here, it's heartwarming to see so many positive comments.

<comment><USER3> Just playing with it it feels great, one pony request: make it easier to just open a folder. When just trying out an editor I don't care to setup projects and whatnot, I just want the codebrowser to be rooted at some project dir on my system.

<comment> T-R I'm not sure if he's added it to ST2 yet, but in the original there was an option to open a directory as a project. If it's not in yet, it's probably on the to-do list.

<comment><USER4> This is the way I've been using it on the first version. I hope it's coming soon.

</comment></comment></comment></comment><comment><AUTHOR> I've been using Sublime for quite some time on Win7, and I'm in love.

I keep trying to use Linux as my development platform, and I won't use a Mac (I got beaten with a mac as a young man. It's an emotional reponse), but for some reason I really dislike every ___nix text editor I've ever tried (emacs, vi, vim, gedit, kate, etc...) and constantly surprised at how ugly and inelegant the text editing world seems on the_ __nix side. BTW, I'm not trying to flame or argue, this is just IMHO.

I've recently been doing some work with mongrel2, lua and Tir, which means that I have to develop on Linux, but I've been very crabby about using text editors that I really dislike. So, I'm really glad to have a port of sublime that works on linux.

Thanks for all the hard work, and I'm really looking forward to the new changes. Keep up the great work!

<comment><USER5> Literally _beaten_?

<comment><AUTHOR> Metaphorically.

I studies graphics and animation years ago in the days of OS8 and OS9, and I believed all the hype about how much better Macs were than PC's. So, I was extremely excited when the school I was attending got a lab full of G3's and G4's.

Then, I started using them for hours on end and the beating that I received was through the horrors of using hockey puck mice, and mice without a right click. The trauma of the "click of death" on zip drives. Being exhausted and sleepless and helplessly furious after a render that was going to take 22 hours crashed after 21 hrs and 30 minutes. And, finally, the horror of realizing the that the amazing innovation of being able to "write my video files to DVD" was more or less useless because burning 5 minute video file on the g4's super drive took 2 hours.

After being bitterly disillusioned with apple and mac products those years, but feeling that there was something terribly terribly wrong with me because it was so obvious to everyone around me that "Macs are so much better for graphics".

So, I quietly saved up a dollar here and a dollar there until I finally had enough money to put together my first PC build and I installed Win2k on it, and never looked back.

After my first build, I felt so liberated by being able to upgrade my hardware when ever I felt like it, I never went back. My 20 hour renders at the computer lab took 1 hour on my new processor.

I've been doing my own builds, and swapping out parts in my PC's ever since. I've tried OSX repeatedly. I've built a couple of hackintosh's. But, every single time, the trauma and the horror, and the deep deep bitterness and resentment that I have harbored in my heart against Apple has never gone a way.

I loved Apple once. But after those 3 years of using exclusively Apple products, now I only have an Apple shaped scar burned deep in my soul.

I don't expect other people to agree with me. I know they think that I can't code worth a crap because I'm use Windows as my OS. The disdain and contempt that people have of my favorite OS hurts, but nothing will hurt me as much as Apple has. It's an emotional thing I have.

All that to say, I will never trust Apple again.

:) </hahaha but, no, really>

<comment><USER6> _I know they think that I can't code worth a crap because I'm use Windows as my OS._

... what sort of person thinks that? That's just insane.

<comment><AUTHOR> Yeah. I really don't get that, either.

Haskell and Erlang seem to run on Windows just fine when I mess around with them. The Lua environment on Windows is quite a bit better than the environment on Ubuntu. Mongrel2 doesn't, so I'll settle for running on Ubuntu for the time being.

Python runs beautifully, and the installers work quite a bit better than IMHO than the package system on Ubuntu. iPython is the shell that I live on most of the time, and when I need to automate server stuff, I find that Powershell is actually a much better shell than bash for a lot of stuff that I need on a regular basis. Being able to pipe around full objects rather than plain text is quite nice. When I don't have powershell lying around and I have to settle for bach, I find that I quite miss it.

The search engine that I'm building in my spare time doesn't seem to have any problems running on a Windows server, either.

So, no, I really don't get why people have such a chip on their shoulders when it comes to programmers running Win7. All I can think of is that people have some sort of techno-religious myopia. But, then again, there's jerks in all walks of life. I suppose programmers aren't exempt from that.

</comment></comment></comment></comment></comment><comment><USER7> I literally had never heard of this before. I just downloaded it for Ubuntu and HOT DAMN! I am buying this for sure.

For anyone waiting for textmate 2, give this a look. It may very well be just what you are looking for.

Best part is you can completely change all the keybindings (if you want) so you can create your VIM or Emacs setup if you so choose.

Happy day....

<comment><USER8> This is awesome, I too hadn't heard of it before.

Killer features beyond just being so good:

1) Available for every platform (learn once, use everywhere)

2) Licensed per user (buy once, use everywhere)

Loving it already and will purchase imminently.

Edit: Would love it even more if I had a basic vim keymap at hand and could always grab. Looking for most of the basic navigation, editing (yank, delete, paste, etc), search/replace and stuff like that.

<comment><USER9> I'd never heard of it either I use TextMate usually just having a quick look, for an Alpha, it's surprisingly polished:

* Initial theme is great

* Undo isn't character based

* Split screen/pane

* Top-right there is a cool preview of the document

* Cmd-R gives you quick access to methods in the current file

* Everything seems very quick & snappy and for the most part looks good especially for a cross-platform app.

On the less positive side:

* The fuzzy finder could be a little more relaxed (typing a few letters then a space will give you no results)

* Find files in project could do with a bit of UI (and I'm not sure it does replace as well)

* The project drawer looks like the sidebar in Finder rather than a proper file/directory view.

Really impressed though - definitely tempted to give it a go...

<comment><USER10> Every emacs and vi user here just went down your checklist and said to themselves "I can do that" (okay, I'll cede the "initial theme" point)

Seriously folks, just learn one of those two, there is nothing new under the sun when it comes to text editors.

<comment><USER11> Except for the mouse and the graphical user interface

<comment><USER12> Where did you get that idea?

<comment><USER11> emacs and vi are console based editors. I don't understand how anything could get to the point where it could never be made better.

In Sublime you can select text with your mouse and on the right there is a graphical overview of the entire document.

<comment><USER12> >emacs and vi are console based editors.

Don't know about emacs, but vim has an (optional) gui.

>In Sublime you can select text with your mouse

And in vim - even in the console version in fact. It's useful being able to select text, scroll with the mouse wheel, etc in a terminal window, particularly if you're editing a file on a remote machine.

>and on the right there is a graphical overview of the entire document.

Depending on what 'graphical overview' means, it's almost a certainty that vim can do something similar. The only thing I can think of where that would not be the case is if you mean something like a thumbnail view of the whole document (can't see much use for that offhand, but maybe) [edit: I had a second look to see what you meant by that, and yeah it looks like that's one thing vim can't do].

Not sure if you're aware but it also has features like tabs, arbitrarily split screen, colouring (console version is limited to 256 colours unfortunately, not sure about gui [edit: gVim supports proper 24bit colours]) and numerous other features that you might only expect in a dedicated graphical application.

<comment><USER11> Having an (optional) gui is something "new". The parent post I was responding to asserted that there was nothing new in the editor space since emacs and vi.

I just opened vi on my machine and I was unable to select text. Maybe there's a way to get it to work... but in Sublime and other graphical editors it just works.

Thumbnail may have been a better word... Sublime has just that. I've found it useful when working on long files. But regardless, there are other features that a GUI enables, like code folding...

<comment><USER13> Gvim is probably what you're looking for. There's also an easy-to-use version called cream.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Nice plugin API. There might be enough here to write a vim modality/navigation extension without too much pain.

Community page of existing plugins for Sublime Text 1. Hopefully these get ported to 2: [http://sublime-text-community- packages.googlecode.com/svn/tr...](http://sublime-text-community- packages.googlecode.com/svn/trunk/)

<http://www.sublimetext.com/docs/api-reference>

<http://www.sublimetext.com/docs/plugin-basics>

<http://www.sublimetext.com/docs/plugin-examples>

(EDIT: API is for Sublime Text 1 only)

<comment><USER2> Those are for Sublime Text 1, rather than 2, by the way. The API for Sublime Text 2 is very similar, but different enough that plugins won't work without being changed.

Documentation for Sublime Text 2 is extremely thin on the ground at the moment, it's something I'll try to address soon.

<comment><USER15> Really looking forward to this.

</comment></comment></comment><comment><USER16> I've been using Sublime practically from when it was first released (what, 2 years now?). I do ALL of my development in it and I don't have any need to use anything else. The multiple cursor thingy and side-by-side editing are simply amazing. Especially the multiple cursor functionality, I can't say enough praise about it. Plus one awesome "feature" of that is, that anybody watching over your shoulder when you are using it has that dumb "WTF" look on his face. Priceless. Oh, and no f __* icons. That's awesome too. And the built-in spell- checker, and multiple replace, and jump to symbol, and full screen mode, and mini-map, and and and ... really an amazing product (can't believe it's that cheap (and I consider 60 bucks a lot of money)).

Looking forward when v2 gets stable. Thanks Jon, keep up the good work!

</comment><comment><USER17> This is a beautiful piece of work. Any chance you might be able to explain the background architecture that might allow others to replicate some of this?

From what I see: \- extensions are coded in Python, and there is good documentation on the plugin mechanism. \- Each platform seems to use the platform's native window system. There is no use of a common UI like Qt. \- The first version is GPU accelerated but the newer one is entirely software.

Seriously impressive work considering it is a single developer. I like how there animations are subtle, and how the entire UI is incredibly responsive. To me, this does to text editors what Chrome did to web browsers.

</comment><comment><USER18> I downloaded this and tried it out, and it's definitely pretty. I just can't come up with any situation where I'd actually use it to write code.

Try pulling up a source file. Any file, any language. Type in the name of one of your objects, then a period, then hit CTRL+SPACE. What comes up? A list of strings that contain your object name, picked by matching text from the source.

Really? In 2011??? Why are people still using text editors that autocomplete based on text? Why are people still getting _excited_ about them?

Editors have been background compiling and autocompleting based on context for over 10 years now. If you write code for a living, you should be using one. It will make your life easier by an order of magnitude.

I think we've moved past the point where we need to treat code as if it were simply text. Unfortunately for this cool editor, it doesn't really have a place in my world today.

<comment><USER19> What are you using?

</comment></comment><comment><USER19> WJW, this is very cool. A few comments:

\- When you select a file in a project, first it shows some kind of preview and only if you start typing it gets its own tab. Why is that ? Perhaps just keep it simple and always show a tab.

\- Can I change the font?

\- Creating a new project could be a little be easier to understand (perhaps add "New project from folder")

\- The black UI looks great with dark themes, but a gray version would be great for light ones.

\- The minimap was a little bit greater on ST1, overlaying it like this turns it into a distraction (unless it would fade away automatically and fade in activated by "hot corners", or something like that).

\- Any chance you would think of VC integration, or that isn't a good thing to have in the editor for you?

\- Why is this so fast? Can you teach us how to make great looking apps that work on all platforms? :)

Really snappy, "modes" load instantly, great out of the box experience. Congratulations!

<comment><USER2> The preview-on-single click makes a bit more sense if you have the tabs turned off: it exists so the set of open files doesn't get cluttered when browsing a project. I'm planning on making it optional (and likely off by default), as many people aren't a fan of the behavior.

You can change the font, but it involves editing the preference files: Have a browse through "Preferences/Default File Preferences", and then copy the relevant keys into "Preferences/User File Preferences" - font_face and font_size in this case.

</comment></comment><comment><USER20> Wow.. I'm really impressed. Later I'll try it at home to see if it looks this good under KDE to. Although the price is a bit steep for me (given that I live in Argentina, 59$ represents ~7% of my monthly income), any chance the price is going to go down in the future?. How does this product's price compare with similar ones in the market?, maybe I'm a bit disappointed because of my low income.

</comment><comment><USER21> Best editor ever.

I have tried literally every single one over the years. Considering it's made by a single developer development speed is breathtaking and he is always open to suggestions on the Forums.

I was a little wary of the new version after using ST1 for so long, but have finally switched and project management is now a breeze where it used to be a little clunky. Go to anything also rocks.

A++++

<comment><USER22> > I have tried literally every single one over the years.

You have obviously never tried the Zeus editor.

</comment></comment><comment><USER23> Quick question: Are there plans to develop auto-complete for 'X' language, and if not, is it possible to build your own auto-complete feature for 'X' language using the plugin API?

When learning a new language, and especially when learning a new library, I dearly miss auto-complete (e.g. what you get in Eclipse with Java). I'm learning Haskell, and this would be a fantastic way to get more familiar with not only the standard Prelude, but any of the other Haskell libraries.

</comment><comment><USER24> _breathes sigh of release_

 _deletes whole bunch of other editors from hard disk_

Seriously, I can't believe this wasn't recommended to me before now.

</comment><comment><USER25> Any thoughts on what this is written in? How is it cross platform?

<comment><USER26> It's not Python. I ran otool -L on the binary, and on my Mac, it looks like an ObjC++ program.

</comment></comment><comment><USER27> As a front-end jockey, one feature of TextMate that I wound up using a lot in CSS is the native OS X color picker. Anyone know if this can be implemented with the current plugin architecture? I wouldn't have a clue where to start, but if I was nudged w/ the reinforcement that its possible, I'd take a crack at it.

</comment><comment><USER28> I have been using Sublime Text for about a year now and it's my killer app for Windows. I've had to learn to use msysGit and plink/putty/pageant just because I had to have Sublime Text as my environment.

I've already informed my boss he has to buy ST2 as soon as it's available. It is, especially with Zen Coding plugin, one of my favorite programs (design/function/utility) that I've ever installed, and I've tried a bunch of the "programmers" text editors for Windows and Linux.

Thanks Jon!

</comment><comment><USER29> Those who do not understand Emacs are doomed to repeat it.

<comment><USER30> I believe [Yi][] developers had a good understanding of Emacs.

[Yi]: <http://haskell.org/haskellwiki/Yi>

</comment></comment><comment><USER31> Does this have some form of git support?

</comment><comment><USER32> Looks great, but any chance of a static compiled version for Linux 32/64bit?

I'm getting: _./sublime_text: error while loading shared libraries: libpng12.so.0: cannot open shared object file: No such file or directory_

Linking with _ln -s /usr/lib/libpng14.so.14 /usr/lib/libpng12.so.0_ doesn't work: _./sublime_text: /usr/lib/libpng12.so.0: version `PNG12_0' not found (required by ./sublime_text)_

<comment><USER2> Which libraries are you referring to? Statically compiling GTK would seem a step too far.

EDIT: Ah, you've added that now. I'll do some investigation: could you let me (firstname.lastname@example.com) know which distro you're running?

(I'm the author of Sublime Text, btw)

<comment><USER33> I got passed the libpng error by installing libpng12 from AUR. Now when I run ./sublime_text I get these errors: <http://pastebin.com/NYWSaPSe> It's strange because running "python PackageSetup.py" doesn't produce the same errors. My PYTHONHOME and PYTHONPATH are both correct. Using python 2.7.1 on arch.

<comment><USER2> I've just released an updated version of Sublime Text 2 that should address the Python issues, at least.

</comment></comment></comment></comment><comment><USER34> Sublime Text is awesome, the main reason I was being stuck with Windows for a long time. But having to use bash and not wanting to pay a lot of money made me learn Emacs.

How many people are willing to pay 59$ for a pretty simple (yet awesome, but not in the sophisticated feature-rich Java-world way) editor? My bet it isn't public information but maybe someone have similar statistics

<comment><USER35> I don't understand why a programmer who is prepared to switch editors (a really big thing!) would in anyway be swayed one way or the other by $60.

<comment><USER34> well, I pay like only 1.5x times more for my room. just to compare our costs of living

<comment><USER35> I hadn't considered people living in countries with much lower costs of living/wages, my apologies for making assumptions.

</comment></comment></comment></comment><comment><USER36> I'm taking a first look, and I certainly like the appearance. The older I (and my eyes) get, the more I appreciate sufficient contrast WITHOUT a lot of brightness.

One small nit for consideration. I realize it may increase conversions, but I absolutely hate it when an application unexpectedly fires up the browser (and surfs off to an unstated destination). (In Sublime's case, via Help / About.)

Some years ago, TextPad got my money through the same model: Unlimited trial. The unlimited trial wasn't enough to "obligate" me, but its excellent performance and feature set won me over. (In particular, I made heavy, ad hoc use of its regular expression support against relatively ginormous, irregularly structured text files -- and file sets -- at the time; something no competitor seemed to match.)

(Unfortunately, TextPad's update to version 5 -- including moving to a newer Microsoft framework -- mostly just made things worse, and development simultaneously seemed to be tapering off.)

<comment><USER36> BTW I tried the 1.4 version as, initially, at least, I didn't want to tackle an alpha version.

I'm pleased to note that line wrapping carries forward the indent level. That's something else TextPad had/has that many of its competitors do not. I find this makes presentations containing wrapped lines much more legible.

EDIT: It would be nice, however, to have an option to restrict the current line highlight to the current display line, for times when the user is working with long form text (e.g. paragraphs).

</comment></comment><comment><USER37> Love it. It's awesome. One feedback: make opening Projects easier. I had closed the editor window and the Project menu only showed "Recent Project". It wasn't intuitive to me that I need to have a text window open before the other menu items are visible. Make those menu items available by default and if no window is open, just open one.

</comment><comment><USER38> Shame I didn't know of this editor earlier, although I've been hunting for a perfect editor for quite some time.

(Settled on VIM + boatload of plugins, but its far from elegant)

I love the clean non distracting interface, ctrl-p is also a killer feature with the "@" extension.

Only thing I'm missing so far is the VIM autocomplete from all open buffers feature, saves me lots of typos.

</comment><comment><USER39> I've been using Sublime Text daily for the past months, and I'm really, really happy with it. I've jumped from one text editor to another mostly within a few weeks of usage; most of the editors just didn't _feel that good_ (e.g. cluttered UI). The last text editor I actually enjoyed working with was SciTE (<http://www.scintilla.org/SciTE.html>). But then I somehow managed to find Sublime Text, gave it a try, and since then I've been using it daily and never went back.

The only critic I have is directed to the missing _Print_ function, but it's only a minor problem for me; it's not like I don't have any alternatives to accomplish this task.

Summa summarum it's a very good text editor IMHO, and I'm always learning a new, convenient function by accidentally hitting CTRL + random key (e.g. CTRL + D).

</comment><comment><USER40> I'm running into a few miscellaneous usability issues. Hopefully this public alpha helps shed some light on them and help jskinner polish this app to beta and release. Is there a public forum or site that we can report these to (something like getsatisfaction or tender for customer support)?

<comment><USER41> Especially language support (clojure) for example.

<comment> T-R Sublime Text supports TextMate language files. I've added COBOL syntax highlighting for a friend by just pulling apart someone's tmbundle, the same could probably be done with clojure.

[http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=clojure+tm+language#hl=en&safe=off&q=+site:github.com+clojure+tmbundle&sa=X&ei=wkhDTeW8GIT2swPIluihCg&ved=0CAIQqAQwBA&fp=fca90e9507624f80)

Edit: I hadn't seen your posts below saying that this wasn't working for Clojure

</comment></comment></comment><comment><USER42> Type this:

      import os.

Pressing ctrl+space produced no hint or auto-complete. Does anybody know why ?

Another thing I have tried: executing ./sublime_text /mycode/

doesn't import/open that directory within ST, it just opens up blank.

I'm pointing these out to ask for solutions, not to nit pick.

<comment><USER2> Auto complete only looks in the current buffer for possible completions at the moment.

I'll look into what's going on with the command line handling under Linux.

<comment><USER43> What are the plans for auto complete? Maybe native ctags support? That would make me change to Sublime 100%!!!

</comment></comment></comment><comment><USER44> Quite arguably one of the best text editors that I've used, It's my primary code/ text editor when i work on a windows machine. I just wish the OSX version was just as good. Looking forward to trying out this version.

</comment><comment><USER45> I was going to ask how to get vi bindings, but after looking through the features, it seems I would kill most of their hard work and thoughts doing so. The getting started guide[1] is very helpful. To see if a feature is implemented in this alpha, do: Preferences | Default key bindings, search for the command, eg. "ctrl+shift+k" mentioned in support is not found in alpha.

Just one of the most beautifully designed piece of software I've seen.

[1] <http://sublime.akalias.net/gettingstarted/>

</comment><comment><USER46> UI bug report: Scrollbar behavior is weird. The thumbnail scroller is very cool and stops when the end of the file is visible at the bottom of the view. However, the scrollbar itself scrolls until the end of the file is visible at the _top_ of the view. At least in OSX, this is not standard text editor behavior.

Also, I hope you plan to use form controls for saving preferences instead of json-style dicts.

And the Command-P issue.

Otherwise, awesome editor.

<comment><USER47> > However, the scrollbar itself scrolls until the end of the file is visible > at the top of the view. At least in OSX, this is not standard text editor > behavior.

Good news! You can easily turn off this behavior by editing your preferences. Just add this to Preferences > User File Preferences:

        {
            "scroll_past_end" : false
        }

</comment></comment><comment><USER48> It looks Great. Could this be emacs's missing editor?[1]

[1] "Don't get me wrong: Emacs is a great operating system – it lacks a good editor, though." \--Thomer M. Gil

</comment><comment><USER49> I realize this is still in alpha and I expect bugs (though it looks incredibly polished), but is anyone else having problems changing the font/font size in the Linux 64bit version? I have changed it in the config file and restarted the program, but it seems to have no effect. I'm just wondering if this doesn't yet work or if I'm doing it wrong.

I'd love to use this, but I need to be able to see it first. :/

<comment><USER2> Make sure you're changing it in the User File Preferences, rather than the Default File Preferences. The default preferences get overridden by the platform specific ones.

<comment><USER49> Ah, thanks.

</comment></comment></comment><comment><USER50> Very nice. One thing that I always find myself wanting when exploring new editors is a way to import my Textmate theme.

It's tough to evaluate the editor when the colors are all wrong, and I don't want to spend the time to set them up just right only to find out I don't like the editor. I think a feature like that could help increase adoption.

<comment><USER2> .tmTheme files are supported by Sublime Text: Copy your .tmTheme into ~/Library/Application Support/Sublime Text 2/Packages/User (assuming you're on OS X), restart Sublime Text, and you should be able to select it from the Preferences menu.

</comment></comment><comment><USER51> I've used Sublime for a couple of years now, still evaluating (I will buy it, just not while I'm a student) it and saying "no" to the dialogue every other save or so. Heh.

Anyway, I made a theme that's a mod of Twilight but in my opinion far more readable and pretty.

<https://gist.github.com/800531>

Give it a try!

</comment><comment><USER14> Does _Default Key Mappings_ have every possible command? If not, is there a complete list available somewhere?

<comment><USER2> It has most, but not all. Some commands are in the menu, but have no key binding: you can find these via "Preferences/Browse Packages", and then open up "Default/Main.sublime-menu".

</comment></comment><comment><USER52>
      $ ./sublime_text
      Fatal Python error: Interpreter not initialized (version mismatch?)
      Aborted
      $ python --version
      Python 2.6.6

Is that my python version? Could the error message be more verbose, or is it not coming from sublime? How do I go about fixing that? Wanted to give sublime a try...

<comment><USER2> Should be fixed now: [http://www.sublimetext.com/blog/articles/sublime- text-2-new-...](http://www.sublimetext.com/blog/articles/sublime-text-2-new- version)

</comment></comment><comment><USER53> I'd really like to move to an IDE that understands js code as well as Netbeans does but without the sluggish performance of the editor. I like Sublime Text so far, but I really miss the ability to see out-of-scope variables and catch minor errors.

Anyone know how to accomplish this in Sublime Text ?

<comment><USER54> Take a look at IntelliJ IDEA's little brother WebStorm. Their JavaScript insight is fantastic and it runs quickly at least on my machines.

</comment></comment><comment><USER55> I like it...it's crashed on me a few times (64-bit) but other than that it's nifty. The best part is the minimap (high level view of source on right hand side).

Is anyone aware of a plugin for vim that does this sort of thing?

<comment><USER56> Check the Nov.2007 blog post comments ( [http://www.sublimetext.com/blog/articles/anatomy-of-a- next-g...](http://www.sublimetext.com/blog/articles/anatomy-of-a-next- generation-text-editor), comment by 'drewp' ) for a tool that may help.

</comment></comment><comment><USER57> I'm getting a segmentation fault on 64-bit Ubuntu 10.10. Anyone know what's going on?

Edit: Removing the ~/.Sublime Text 2 folder fixed things. The segmentation fault only started after I restarted my laptop.

</comment><comment><USER58> This looks nice and I will give it a try. But when will coding editors set the tab key to "spaces" by default? It's not just this editor but Eclipse and others.

</comment><comment><USER59> Fast and slick. I like it. Does it support two dimensional copy & paste? ( this is usually done with pressing the left alt key on other editors ).

<comment><USER2> Column select is triggered by Ctrl+Left Mouse on OS X - Alt+Left Mouse will subtract from the selection.

<comment><USER59> Ah! So it's called column select. Oops! I am trying Alt+Left Mouse in Windows XP but it doesn't seem to work. Is it different under Windows?

<comment><USER2> On Windows and Linux you can use Shift+Right Mouse, or Middle Mouse.

Column selection interacts nicely with multiple selections, too: Use Ctrl+Drag (Command+Drag on OSX) to add selections, and Alt+Drag to subtract selections.

<comment><USER59> Multiple selections are very cool. I think you have done a great job with this editor. A final question: what is the recommended way to move between recently visited files? For instance in Visual Studio there is a file history stack that makes it very easy to visit previous files with Alt + W + n where n represents the distance in the visitation history. I keep doing Alt + W + 2 to alternate back and forth between two files. Is there a way to this in Sublime?

I am thinking about buying it to use under OSX. The XCode editor is not my favourite to put it lightly.

Keep up great work!

<comment><USER2> Ctrl+Tab/Ctrl+Shift+Tab cycle forwards/backwards through the stack of recently used files, in the same manner as Alt-Tab (Command+Tab on OS X) cycles through applications.

</comment></comment></comment></comment></comment></comment><comment><USER60> This project would be more interesting to me if it could complete C/C++ by using the autocompletion features of the Clang compiler.

</comment><comment><USER61> Beginner programmer here. I could not use any other editor. Does anyone know if you can collapse functions or blocks of code?

<comment> T-R There was a thread about this on the ST forums a while back - I can't seem to find it now. If I recall, block collapsing was a low/non-prority because it was viewed as lending itself to poor code, and mostly compensated for by other features.

My personal opinion - it'd be nice, but I don't miss it enough to switch editors or bug the author - maybe someone will make a plugin for it. I haven't missed it at all in Python or Haskell. Last time I worked on a Java project, I missed it a bit at first, but mostly found that the minimap got rid of that feeling of looking at code through tunnel vision that made me want to collapse it, and by the end of the project I'd shifted to using ST more than Eclipse. I might feel differently if I jumped back in to C#, with #region and all, but I really feel like the C language family lends itself more to IDEs anyway.

</comment></comment><comment><USER62> I am using it on Ubuntu 10.10, looks amazing, is there any way to add syntax highlighting for other languages (Go in my case)

<comment><USER2> It's generally just a matter of getting your hands on a .tmLanguage file (the same format as TextMate), and putting it somewhere in your packages directory (~/.Sublime Text 2/Packages/ on Linux).

The top Go.tmLanguage reported by Google appears to be a work in progress though, I'll see if I can get something sorted for the next version - I'd like to have Go support out of the box.

<comment><USER41> Not able to use one for Clojure (the one for Go works fine) - could you please check [https://github.com/franks42/clojure.tmbundle/blob/d0b6baa893...](https://github.com/franks42/clojure.tmbundle/blob/d0b6baa89307d896b53a8f25736891e3cde2c3ab/Syntaxes/Clojure.tmLanguage)

</comment></comment></comment><comment><USER63> First impression: awesome.

Second impression: The animations are a bit contrived. The hit state on the file browser arrows could be larger.

</comment><comment><USER64> Perhaps I'm using it incorrectly, but the Folders option does not seem to be working for me on 32 bit Ubuntu 10.10

<comment><USER2> It should be just a matter of dragging a folder onto the side bar (or using the Project/Add Folder to Project menu item) - drop me an email (firstname.lastname@example.com) if this isn't working for you.

</comment></comment><comment><USER65> "No libgio so found" when I ran this on a 32 bit Linux (RHEL5).

Would a statically linked Linux executable work for this?

<comment><USER2> libgio is part of GTK, which I'm hesitant to statically link against. I'll test under RHEL5 and see what I can do to make it work out of the box.

<comment><USER65> > libgio is part of GTK

It is not part of the GTK version on RHEL5 (1.2.10). This might be a difficult problem. RHEL5 is full of old packages. I wouldn't worry too much about it, a lot of government and military facilities use it but everyone else moved on. RHEL6 is out but it will be some time before it makes it through the red tape of approvals.

</comment></comment></comment><comment><USER66> Great editor only problem is it doesn't work over remote desktop because it uses 3d accleration.

<comment><USER2> While Sublime Text 1 used the GPU for rendering, Sublime Text 2 is software only, and so should have no problems over remote desktop.

</comment></comment><comment><USER67> Is it possible to set up tab triggers for the snippets?

</comment><comment><USER68> I stopped reading when I saw that CMD+P does "Goto Anything" instead of print. Please use standard keyboard shortcuts... Too bad because it looked awesome!

<comment><USER2> As much as possible, I do try and follow the conventions of the host OS. Cmd+P is the only exception, which I feel I can get away with due to there being no support for printing yet (and a few other historical reasons, where Ctrl+P is used for similar functionality in Sublime Text 1).

<comment><USER68> Thank you for your answer. I'll look into your software, it seems pretty awesome! You should however consider being more strict about host OS standards in my opinion. It would just makes our life a little bit easier.

</comment></comment></comment><comment><USER69> I love the Goto Anything features and the MiniMap. I must have those, somehow, somewhere. I'm playing around with all the Cmd-P and Cmd-R stuff in the Alpha on my Mac right now and love it. Intuitive and very useful in common use cases that come up. I think there's some overlap with what vi can already do, but this might go beyond it. I notice with the Cmd-P stuff it has a stack-like quality as you refine your query, meaning that as you refine your query and jump ahead to see the result, you can incrementally backtrack/unwind your query, to the changes live, and then ultimately you can totally pop back to the file/spot you had been looking at before you entered the Cmd-P query mode. Good stuff. MiniMap is a nice visual hack to help scroll around your code. It feels a little more like chrome than substance, but it's chrome I like, so I don't care. It also gives a birds-eye sense of where the most complex parts of your code are without having to manually look directly at every area at the 1:1 zoom level.

</comment><comment><USER19> This reminds me of the top post yesterday.

<comment><USER19> How does it compare to Kod?

<comment><USER70> Comparing anything to Kod isn't really fair at this point. It is currently at 0.0.3beta and not feature complete (I hope ;)</comment></comment></comment>


Show HN: New Seasons, a little Clojure webapp (open source) - <AUTHOR> http://newseasons.stevelosh.com/

<comment><AUTHOR> New Seasons is a simple Noir (<http://webnoir.org>) site that notifies users when new seasons of TV shows hit iTunes.

I made it partly because I was annoyed at having to check iTunes for new seasons of shows I like all the time, and partly because I wanted to try putting together a small but useful app in Clojure/Noir from start to finish.

I'm mostly a Python programmer and I threw this together in a few hours this week, so I'm sure there are lots of heinous things happening in the code. #Clojure on Freenode helped be clean things up a bit, but feel free to comment on GitHub and tell me if you see something wrong/ugly!

Overall I liked using Clojure and Noir for this. Some things felt clunky compared to what I usually use (Django), like implementing my own user log in and log out. I think for most normal CRUD/CMS-style sites I won't be leaving Django any time soon, but for sites that don't fit into that model as well it's pretty nice.

GitHub: <http://github.com/sjl/newseasons>

BitBucket: <http://bitbucket.org/sjl/newseasons></comment>


'Not a compliance car:' GM says it can produce Chevy Bolts annually - <AUTHOR> http://www.hybridcars.com/not-a-compliance-car-gm-says-2017-chevy-bolt-production-capacity-exceeds-50000-per-year/ <comment><USER2> >In response to the charger network concern, Kelly said GM is one of around a dozen automakers committed to the SAE combo connector. Tesla is the maverick with its own standard, and GM has not said it would collaborate on a shared standard, and neither has Tesla in reverse.

I get that Tesla thinks they can out-connector everyone else, but it seems like a shared connector standard would be a huge bonus for all EV companies.

<comment><USER3> They don't _think_ that, they have already done that. They have supercharger coverage in all of North America and western Europe. The "dozen committed automakers" have nothing.

<comment><USER4> > The "dozen committed automakers" have nothing.

They have installed way more charging stations than Tesla, by several orders of magnitude. Almost every Nissan, GM, BMW, etc dealership has at least one or two charging stations and they're open to the public. I can see 15 stations within 10 miles of my home, most at dealerships, then a few at malls and stores. Tesla has 3 Superchargers in the entire state, only near highways. The highway already has chargers installed at its rest stops, too (including DC quick chargers), and they're not Tesla chargers, they're the standard connector _every other_ EV uses. PlugShare shows over 50,000 public chargers in the US. Tesla's only built 590 stations.

I drive a Nissan Leaf. They're ridiculously cheap (we're talking $10-12K fully loaded for a recent, low mileage certified preowned). I've charged it at public stations. I also look forward to upgrading to a longer range EV as soon as there's one that doesn't cost as much as a house. There are way more than enough non-Tesla charging stations out there to make me comfortable only owning an EV, by any make.

<comment><USER3> These are not useful chargers for long-distance travel. They are barely above a 230V/15A outlet, and pretty much only useful for top-up charging at destinations. And guess what, Tesla has adapters for all of these. As I said, they have won this already.

<comment><USER4> No, looking around me, the Nissan dealers and the highway rest stops have DC quick chargers (480V L3), which are the equivalent of Tesla's superchargers.

<comment><USER5> You're comparing 80% of 80 miles and 80% of 260 miles, and saying that they're equivalent? One is more than 3X faster than the other. One makes it somewhat reasonable to drive long distances, the other does not.

BTW, Tesla sells an adapter for Chademo.

<comment><USER4> The Chademo standard supports up to 100 kW of output, while Tesla Superchargers are up to 120 kW. Most of the L3 chargers out there are hooked up to 125A and put out 62.5 kW, but they can be upgraded with no change to cars, and provide comparable recharge times to Tesla's chargers. There are relatively few EVs on the road, and none that have the range of a Tesla, so no customer base to necessitate those upgrades just yet. It's awesome what Tesla has done, but there's really nothing wrong with how the infrastructure is growing for all the other EVs and the standards they've all chosen to support. If the Chevy Bolt flops, it won't be because it takes early adopters 45 minutes at the rest stop instead of 30 to make an occasional long-distance road trip.

<comment><USER6> Yeah, it'll be because the Bolt's fast chargers are in inconvenient locations and are hard to count on since they're installed in single units.

The way the infrastructure is growing for other EVs sucks. If you had a Tesla equivalent car today that couldn't use Tesla superchargers, it would be terrible for long distance travel. It would be slow, painful, and run a substantial risk of stranding when it turns out the one charger you were really counting on has been broken for weeks and the dealer is too busy selling house-sized SUVs to care about repairing it.

This could change quickly if the big car makers cared to. So far there's no indication that they do, though.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Is there some secret law forcing GM to only hire the absolute worst designers for their cars' aesthetics? Body shape, interior, and especially GM's user interfaces and industrial design are just god-awful. Compare _any_ dashboard GM produces to a BMW dashboard or other tasteful European makes.

I get that GM's cars are cheaper, but for instance, it's not that expensive to just stop using that fucking plastic-orange design for _all_ gauges. If you can't figure it out, just copy someone else who knows how to do it.

And for God's sake, hire someone who knows how to display numbers and data intelligently.

<comment><USER8> I present to you, possibly one of the ugliest cars to go into production since the Aztec, the BMW i3 [1]

They're pretty common around where I live (as are Teslas, Leafs and other electric cars) and the nicest thing I've ever heard about them is "at least the interior is pretty nice".

1 - [http://assets.inhabitat.com/wp- content/blogs.dir/1/files/201...](http://assets.inhabitat.com/wp- content/blogs.dir/1/files/2011/11/i3-corner-view-537x357.jpg)

<comment><USER9> The one pictured has "concept" written on it, did this ever go into production ?

<comment><USER10> [https://en.wikipedia.org/wiki/File:BMW_i3_01.jpg](https://en.wikipedia.org/wiki/File:BMW_i3_01.jpg) is the production version.

</comment></comment></comment></comment><comment><USER11> OT: I'm curious about something with electric cars.

In a gasoline car, if you run out of gas at night on a country road in an area with no cell coverage and so need to wait a few hours for someone to come across you, you can at least listen to the radio and use the interior lights and still use the emergency blinkers, because those are powered by the battery.

Suppose you run out of power in a similar situation in an electric. Do the interior accessories and emergency blinkers and the motors run off the same power pool, so everything dies together, or do they have a separate power pool for the interior accessories and emergency blinkers so they keep working after the car can no longer move?

<comment><USER12> The Tesla has a 12V battery just like regular ICE cars that is used to power blinkers, etc.

[http://insideevs.com/a-peek-under-the-hood-of-a-tesla- model-...](http://insideevs.com/a-peek-under-the-hood-of-a-tesla-model- s-p85d/)

</comment></comment><comment><USER13> Meanwhile in certain parts of the USA, SUV and F150 sales are starting to spike because of $1.80 gas since 15mpg "doesn't matter"

EV sales are going to be difficult in some parts of the country until gas is back at $3+

</comment><comment><USER14> It might not be a 'compliance car' but why is it that all of the 'hard work' is being done by LG? The whole drive-train plus the batteries and ancillaries are entirely LG, albeit to GM's spec.

What happens if LG decide they don't need GM any more?

<comment><USER15> They said they have a contract with GM, so I suspect LG needs to meet production for the entire duration of this generation Bolt plus a certain number of years afterwards for service parts. I've worked in Automotive supply and this is how it typically works.</comment></comment>


In Recession, Japanese Lay Off Robots  - <AUTHOR> http://www.nytimes.com/2009/07/13/technology/13robot.html?_r=1 <comment><USER2> This is just a subset of "capital investment goes down in economic downturns, and up in boom times". The local robot manufacturers are doing poorly because the local automobile industry (which is the largest driver of _every_ industry in central Japan) is doing poorly.

After the economy recovers and A Certain Automobile Manufacturer starts selling its Ridiculously Popular Hybrid to Americans by the container ship again, the factories around here will get spun back up again. Until then everybody is just waiting it out, with a lot of belts being tightened and budgets being squeezed. The companies who are in a position to concentrate on things other than survival are doing R&D to have something to attract the inevitable tidal wave of cash that will accompany a recovery.

<comment><USER3> _After the economy recovers and [Toyota] starts selling its [Prius] to Americans by the container ship again_

I would not so casually assume that this will happen. The current downturn is in many respects unprecedented, and all of the long-term trend lines are bad.

People tend to look at a limited set of examples that show the US recovering first and leading the world out of the bust. But this is a bit like flipping a coin, seeing four heads in a row, and calling a 'trend.'

The government spending problems in the US are catastrophically bad, getting worse, and there is zero political will to meaningfully address them at the federal level. Demographics is working against us, and we no longer live in that post-WWII world where the US wins by default -- that is to say, for at least a couple of decades after 1950, much of the rest of the world was still 1) recovering from being bombed back into the stone age, 2) had never really gotten out of the stone age to begin with, or 3) was crawling slowly back towards the stone age by virtue of Soviet-style communism.

If the US is going to rise above this time, we're going to have to do it fair and square. We'll need to actually work to be the best place in the world to invest long-term capital.

(That is, unless the rest of the world decides it wants to continue shipping us stuff for free indefinitely. If foreign governments double-down on America, then all (short-term) bets are off.)

</comment></comment><comment><USER4> "At a large Yaskawa Electric factory on the southern Japanese island of Kyushu, where robots once churned out more robots..."

The singularity has arrived!

</comment><comment><USER5> As long as keepon keeps on keeping on

<http://www.youtube.com/watch?v=nPdP1jBfxzo>

<comment><USER6> I Love Keepon!

<comment><USER6> Twat a bunch of crabs.

Keepon is a sophisticated multi-axis robot that incorporates extremely complex kinematics with pseudo-emotional responses and rhythm recognition all bundled up in a painfully cute package.

FTW</comment></comment></comment>


Wilson's Algorithm - <AUTHOR> https://bl.ocks.org/mbostock/11357811 <comment><USER2> This is part of a very nice larger article by the same author on visualizing algorithms [0]. It covers sampling, shuffling, sorting, and maze generation.

[0]: [https://bost.ocks.org/mike/algorithms/](https://bost.ocks.org/mike/algorithms/)

</comment><comment><USER3> > an unbiased sample of all possible spanning trees

this also makes the mazes generated by the algorithm the most annoying to solve without a computer, but they are the most resistant to be searched in reverse of all the forward building algorithms (without explicit honeypots for trapping reversers)

<comment><USER4> >> this also makes the mazes generated by the algorithm the most annoying to solve without a computer

Came to say that. I see a lot of what looks like the letter E in there. Many tiny dead ends. Really hard to visually follow a path through, and I can only imagine how not-fun it would be to play a first person game in there.

<comment><USER3> given the complexity I an see them being useful for decorative garden mazes (as in, very very tiny) - lot of complexity but actually small could give an interesting run without being overwhelming.

</comment></comment></comment><comment><USER5> Ah, this is very similar to some old maze generation toys I was working on a few years back. I was experimenting with adding a little extra stochasticity to the mix. E.g. selecting from the last ~30 neighbors added creates interesting mazes with "multiple growth fronts" rather than one tendril or a uniform expansion at the edge. You can see a GIF example here: [https://raw.githubusercontent.com/j-s-n/mazes/master/example...](https://raw.githubusercontent.com/j-s-n/mazes/master/examples/algorithm3-thickness4-128x128.gif)

(My code uses toroidal topology, which is why you can see things going off the edge and coming back on the other side.)

And things like varying whether new neighbors are added to the head or tail of the list adds a little perceptible chaos. It's too bad it looks like my demo site is down right now.

There's a (old, badly documented) JS demo here with about 6 variant algorithms: [https://github.com/j-s-n/mazes- js](https://github.com/j-s-n/mazes-js)

And a better documented but still out of date Python example (that hand- encodes an animated gif here): [https://github.com/j-s-n/mazes](https://github.com/j-s-n/mazes)

</comment><comment><USER6> Even Richard Stallman doesn't agree with releasing such small snippets of code under the GPL. See his essays in "Free Software, Free Society."

</comment><comment><USER7> Aside: The text doesn't show up without JavaScript. I wouldn't expect to see the animation, but why can't I read the text?

<comment><USER8> It's being pulled as a gist from github

</comment></comment><comment> d--b Ah, it's been a long time since we heard from Mike. I wonder how d3.express is coming along...

</comment><comment><USER9> Very nice. I see the "entrance" but where is the "exit" to the maze? Doesn't it need one?

<comment><USER10> wondering the same

<comment><USER11> Perhaps exit == entrance.</comment></comment></comment>


Ask HN: If you wanted to 'hardware jailbreak' a device, how might you do this? - <AUTHOR> Most rootings/jailbreaks that have been widely released use software vulnerabilities to escalate privilege.
If instead you had access to the hardware of a device, and could make any reasonable modification or intervention, how would you approach this? What techniques are used for this class of attacks?
(Reasonable modifications might be things like soldering extra components, removing ICs, using oscilloscopes and data loggers - but not, say, decapping chips and imaging them in an electron microscope as presumably those resources are a lot more limited.)
More practically, how might you do this on recent devices such as latest, flagship iOS, Android, or Windows Phone handsets? Are there any good, educational examples of this? <comment><USER2> One of the best approachable writeups I've found on getting started in reversing embedded devices is an old gem from Matasano. Retsaot is Toaster, Reversed: Quick 'n Dirty Firmware Reversing - [http://www.woodmann.com/forum/archive/index.php/t-11707.html](http://www.woodmann.com/forum/archive/index.php/t-11707.html)

That should give you a little bit of a feel for it. Its a fun rabbit hole to spend a few years down.

</comment><comment><USER3> Most commonly you can find either a RS232 port (not the regular one, a 3.3v one!) or a JTAG port through which you might be able to influence the software running on it.

For example, I managed to flash OpenWRT on my otherwise unflashable router that way.

Another (even more hardware-y) approach is to dump flash chips containing ROMs. With those roms in hand you might be able to find a vulnerability to exploit, or you could replace the rom chip with a socket in which you can place your own modified roms.

Bunnie famously broke the Xbox classic security by building his own hardware to sniff the (until then thought to be unsniffable) HyperTransport bus. He wrote a very interesting book about it and it's free nowadays: [http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf](http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf)

<comment><USER4> You can get a lot off rom chips, it's always the second thing I go for after serial ports- and if you run into a password on the serial port, than it's probably (often hardcoded) in the rom.

Sometimes they don't include headers and the like, so looking up a pinout and soldering to the IC helps in that case too- tapping into the serial connections between chips can reveal a lot too.

</comment></comment><comment><USER5> Here's a good start for chip level stuff

"Fault attacks on secure chips: from glitch to flash" [https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf](https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf)

</comment><comment><USER6> Video game consoles used to do this with modchips and sometimes design flaws, this might be a good starting point for your research.</comment>


Collaborative calendars for social media content - <AUTHOR> I'm have been working on this web-application to help digital marketing agencies create social-media calendars for their clients. Integrations will first include Instagram, Facebook & Twitter. Think of it as Invision for calendars.
Currently, most work is done on spreadsheets with this flow:
 1) Copywriter comes up with the social-media scripts, puts them on a spreadsheet.
 2) Designer produces images that match the scripts.
 3) Copywriter places the matching images next to the scripts ("compiling").
The spreadsheet (could be multiple copies) is then sent to the client for approval - This is where most time is lost due to the back-and-forth between the client and the team during the approval process and where the most number of mistakes happen due to multiple spreadsheets.
Problems I'm solving:
 1) Eliminate the mistakes that occur between matching the scripts and the images once the client gives feedback
 2) Provide a central place to track and review the calendars instead of using emails and multiple spreadsheets
 3) Minimise the time for approval of social-media posts
Questions:
 1) Do you see the value of such an application in your business?
 2) What much would you pay for a monthly subscription as a business owner? 3) Does a mobile/tablet app make sense in addition to the web-app? <comment><USER2> Showing the prototype will probably provide better feedback. Identifying good prospects and showing it to them will probably provide the best feedback. Most people on Hacker News do not run digital marketing agencies.

Good luck.

<comment><AUTHOR> Thank you so much for the feedback! I'm almost through with the building and I will do as you've advised. Thanks once again.</comment></comment>


Show HN: Cyph – Encrypted chat in 30 seconds - <AUTHOR> https://www.cyph.com <comment><USER2> Yeah... this is a really dangerous and fundamentally flawed idea. Anyone with a basic grasp of cryptography will realize how obviously broken this is:

1\. It uses JS encryption, which is essentially useless as you could modify it any time to intercept the messages.

2\. You claim to be using 'OTR' but there is no key verification, which means it is trivial to intercept. Therefore there is no point at all to using OTR. In addition the point of OTR is to prevent server operators from intercepting communications, which you are still able to do.

3\. You've rolled your own crypto library, which hasn't been audited and isn't even known to work correctly or interoperate (i.e: with XMPP OTR clients) with verified implementations.

4\. You're using cloudflare which means cloudflare also holds a copy of your TLS key, which means they could also intercept the messages.

If you get hacked, if your TLS key gets broken or if one of your employees wakes up on the wrong side of the bed, it's game over. In a nutshell, this is marginally more secure than logging into facebook or gmail over HTTPS and sending each other. In fact in some aspects it's probably less secure because Facebook or Google have strong security teams to monitor intrusions into their servers.

<comment><AUTHOR> Sorry about the confusion; should have some details up on the site soon!

1 and 2) See [https://news.ycombinator.com/item?id=8660233](https://news.ycombinator.com/item?id=8660233) — acknowledged that it's not _perfect_ or 100% trustless yet, but we have some ideas to address that in the future, and for now it's still better than nothing (which is important in cases where you'd have otherwise used nothing).

3) We haven't rolled our own crypto. We're using the JS OTR implementation recommended by cypherpunks.ca (which hasn't been formally audited as far as I know, but is understood to be pretty good).

4) Not using CloudFlare for SSL or CDN, only for DNS management. Our CA is DigiCert (same CA as Facebook and GitHub) and we're running on Google App Engine; it'd be a pretty big deal if either one of those were hacked.

<comment><USER2> 1\. This is not about being perfect, this is about being trustworthy or secure. Right now this is very dangerous to be promoting as even remotely private, as you claim on both your website and twitter. This is no more secure than chatting over facebook. There is no 'clever solution' to get around crypto in the browser, it's always bad.

2\. There is absolutely no point to using end-to-end crypto in this setup because it can all be intercepted. Not to mention there is no key verification, so even if you're JS wasn't interceptable it's still trivial to intercept messages. It's a red herring at best and at worst deceptive .

3\. I stand corrected, although JS (regardless of whether it's in the browser or not) is usually considered terrible for crypto implementations because of it's math bugs.

4\. You might want to check yourself, [https://www.ssllabs.com/ssltest/analyze.html?d=www.cyph.com&...](https://www.ssllabs.com/ssltest/analyze.html?d=www.cyph.com&s=220.127.116.11) you're pointed to cloudflare's SNI server.

I think what you fail to understand is you're relying entirely on TLS for all of your security, which means a LOT of different people are able to read these messages. It's not just your CA that could be compromised to hack you, its ANY CA. So for example the chinese government decides they want to read everyone's messages, all they need to do is publish a cert with your domain. Or any of your staff. Or anyone at cloudflare. Or anyone with access to your server. Or access to your home computers which have login credentials.

<comment><AUTHOR> 4) We're using CloudFlare to redirect our naked domain to www.cyph.com.

Re: the rest, assuming the user trusts that we haven't served up malicious code (which, again, I acknowledge isn't _completely_ trustless for now), I disagree that JS crypto is bad/useless. It definitely _was_ bad/useless at one point in time, but with the introduction of the Web Crypto API I haven't seen a convincing argument that it's still strictly inferior to C/C++ crypto. (And, to be clear, Cyph will refuse to run in a browser without Web Crypto API support, e.g. any version of IE before 11.)

I'd argue that a safe language like JavaScript running in as well-vetted a sandbox as in modern browsers has a lot of pretty favourable security properties (entire classes of exploits are impossible here, as opposed to in Pidgin/OTR whose implementation is known to be less than ideal for security[1]).

1: [http://motherboard.vice.com/en_ca/read/secure-messaging- migh...](http://motherboard.vice.com/en_ca/read/secure-messaging-might-not-be- so-secure-otr-libpurple)

<comment><USER2> 4) So they can redirect all users to a non-HTTPS site. That's interesting.

What youre saying is ridiculous, it's nothing to do with "completely" trustless, you're not trustworthy at all. The "we promise we wont serve malicious code" is the same securi

Basically your users have to trust: -You -Your staff -Cloudflare -Google -Any computer used to design, build or login to your web app -Anyone with access to any of these computers -Every single CA in existence (including the US and Chinese government) -Anyone with resources to spoof a CA SHA-1 signature (anyone with ~$700,000 [0]) -The authors of the JS OTR library and any other code you use

Do you see the problem here? There are literally millions of people in your trust chain.

Libpurple sucks, but browsers are the #1 target for exploit writers, not to mention the HUGE attack surface they pose. There are just so many angles of attack for your service. Anything hosted on a shared server is not secure. The word cloud and security should not be in the same sentence. No offense, but you guys really do not seem like cryptography experts and there are so many pitfalls here that I would not recommend trying to promote this until you completely re-design everything.

As far as WebCrypto.. I'm just going to leave this here: [http://tonyarcieri.com/whats-wrong-with- webcrypto](http://tonyarcieri.com/whats-wrong-with-webcrypto) [http://matasano.com/articles/javascript- cryptography/](http://matasano.com/articles/javascript-cryptography/)

[0] [https://www.schneier.com/blog/archives/2012/10/when_will_we_...](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)

<comment><USER3> Explain to me the trust chain of a crypto messaging app that you DO think is safe and secure. Seriously, pick one, let's talk about it. Let's compare and contrast.

Or would you prefer to parrot the same tired old arguments that pop up on the HN comments every time the concepts "web browser" and "cryptography" are used together?

<comment><USER3> Here, I'll speed it up for you with this conclusion:

Unless people are downloading from source, verifying signed checksums, and building their crypto applications from source they are just as susceptible to any of the issues that browser crypto is.

Prebuilt executable? Can't be trusted. A modified version could have been substituted at download time for a particular user.

Web site where signed checksums are published? Can't be trusted. It could have been hacked or altered.

Checksum embedded in executable which checks itself at run time? Can't be done.

Trust is the issue. Trust NEVER goes away. The only way to know for sure is if you compile all your own code. But wait, remember Ken Thompson on Trusting Trust? You had better be building your own compilers as well...

So basically you're saying that no one but computer experts who build their entire toolchain from scratch should be using any sort of application that uses cryptography.

<comment><USER2> Actually that's not what I'm saying at all. I'm critiquing the implementation of this for several reasons:

-The JS crypto can be trivially MiTMed. Your approach of checksumming the JS you outlined in another comment using external servers is laughably terrible

-The OTR is pointless. The keys aren't being verified so, again anyone could MiTM the key exchange and trivially intercept messages, even if there was no JS. This is the main point of the app, and it's completely broken.

-The entire application is relying on the security of the TLS PKI, which is horribly, horribly broken. This opens it up to attack by a huge number of people.

-It's being run on a shared server, with access to the keys by the real owners. Not to mention VM memory-leaking attacks by other residents, etc. Having your entire application logic hosted online and delivered to your users every time they access the service has security ramifications, whether you'd like to believe it or not.

So basically what YOU'RE saying is trusting 1 developer and trusting millions of people is the same because at some point you cannot verify every bit in the executable. Using browser crypto is worse than executables for the same reason PFS is better than non-PFS, you can't retro-actively hack or MiTM something. If both parties already have the executables stored locally (or delivered securely by an offline medium like USB stick and verified) the only way to intercept the data is compromise both end-points.

TL;DR your hyperbolic "trust as slippery slope" argument is dumb

<comment><USER3> All I'm doing is defending use cases for the Web Crypto API.

Your arguments are just as hyperbolic, BTW. Meeting up in person with USB sticks for software updates? And questioning the security of TLS?

And is JS checksumming more or less laughably terrible than publishing a checksum of an executable on a web site?

And does your JS MiTMed scenario depend on broken TLS?

You're going to need to do more than just call something "laughably terrible".

I'd prefer if you took the conversation about JS checksumming to the specific thread so as to not complicate things.

Software will always have updates and they happen automatically with increasing frequency on consumer computing environments like iOS, Mac and Windows.

BTW, just who are you anyways and why are you so intent on making me look like a fool for attempting to discuss viable web-based cryptography? I see that your user account is brand new.

Why would anyone be pursuing the Web Crypto API? Have you broached these issues with the W3C working groups? Don't you think they'd like to know that their work is futile? Shouldn't some manager on the Chrome team have stopped them from implementing such a pointless protocol?

And no, I don't think "trust as slippery slope" is a stupid argument because we have to deal with that issue every day with every aspect of consumer computing. With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things. There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for.

Wanna talk about trust? I don't trust you and I don't trust your approach to these arguments. I don't trust your faux-elite sounding hacker nickname. Maybe you or who you work for is threatened by the average person having end-to-end encryption in web applications? Maybe you're a marketer who needs that data. Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is... "trust as slippery slope" indeed...

<comment><USER2> I find it hilarious you're still fixated on the idea of the trust chain and haven't addressed any of my actual points about the crypto, besides making a lot of hand-waving and saying "well it's not secure, BUT NOTHING'S SECURE SO THAT MEANS IT'S GOOD ENOUGH". This is not end-to-end, the OTR is broken and doesn't verify keys, end of discussion. The JS can be MiTMed, end of discussion.

>And questioning the security of TLS?

No, I'm questioning the TLS PKI which is what this is dependant on, please learn the difference. Currently any CA or anyone who hacks a CA will be able to make a fake cert, which has happened many many times. Everyone from Bruche Schneier and Moxie Marlinspike condemn the CA PKI, in fact according to Schneier it will cost only ~$700,000 by 2015 to make a SHA-1 collision and produce a fake certificate without any hacking at all. This is why real security solutions use pinned certificates.

Blindly putting your faith in SSL/TLS to accomplish all your goals is really, really dumb. There have been several MAJOR (CRIME, BREACH, POODLE, Heartbleed, CCS) attacks against it in the last 3 years alone.

>You're going to need to do more than just call something "laughably terrible"

There's a reason no one else does this, because it's insecure and unsustainable. Someone could just detect your monitoring servers requests and serve it a 'good' version. Or better yet, only serve a 'bad' version to the people it wants to target. Or just DDoS your monitoring server. If they have the capabilities to intercept the TLS requests to Cyph then what's stopping them from intercepting the requests to your extrnal server? I think what you fail to understand is the interception would probably be client-side, not server-side. Not to mention every time your code actually changes you have to go manually verify that it's correct and not an attack. You're essentially hand-rolling your own signature scheme based on extremely shaky ground. You're going to need to do more than just conjuring up your own amateur solutions and dismissing all security concerns out of hand because "doesn't have to be perfect".

>There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for.

Where did I do that exactly? You're also implying something can either be secure or useable. I acknowledged there is a spectrum of security, like I said earlier this is marginally better than talking over Facebook. In fact Facebook might be a little more secure because it has a dedicated security team that monitors intrusions. Ignoring the JS problems and the hosting problems, the end-to-end crypto doesn't verify keys, which makes it useless. It's like using a self-signed cert for your message encryption. If that's your line in the sand for "secure enough" than go right ahead and use this, but marketing it as private is irresponsible and deceptive.

>With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things

Yes, because they were lucky or oblivious to the fact they got owned. This is like saying "I leave my car doors unlocked all the time and it hasn't been stolen yet"

>Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is.

Ad hominem mixed with a little tinfoil, I like it. Maybe you and Cyph are the NSA and are in collaboration to promote broken crypto to the masses? Or does the fact that you self-aggrandize by using your real name on HN make you legitimate? Maybe you're a design-centric know-nothing who thinks that WebCrypto means "insta presto! the cloud is secure now! web 4.0 everything because 'it just works'" ?

<comment><USER3> Again, let me repeat this because you seem to be totally deaf: All I'm doing is defending use cases for the Web Crypto API.

I'm not and have never defended this specific app. All I'm doing is pointing out that your wholesale dismissal of browser crypto is unwarranted.

You're clearly just trolling me now because you've refused to answer any of my questions specific to the valid use cases of browser crypto and how ANY software that is updated or updates itself is susceptible to issues you've levied at browser crypto.

I've been reading infosec arguments on the net since the 90s. I've heard everything there is about the dangers of creating your own crypto systems and every one of your snide remarks. tptacek has made a career off of the same 15 things you've said over and over and over again. I get it.

I also completely disagree with tptacek and every other dude who outright dismisses browser crypto. I also thing that there are a lot of important benefits from attempting the very difficult task of creating secure browser crypto environments.

Your general approach to the issue is to turn in to a raging asshole and attempt to make anyone who is exploring these issues look like a fool. You engage in an incredible amount of personal attacks and you attempt to justify the means by harping on about the importance of the ends.

I fundamentally disagree that the means can and ever will justify the ends for anything. When you do that what we're left with is assholes like you who make the world of crpyto and security an environment that is incredibly toxic to creativity.

<comment><USER4> No, saying snarky things about crypto is my _hobby_ , not my career. My career is actually breaking these stupid systems.

<comment><USER3> Sorry, I was actually referring to your career as all-time HN karma leader! I have a lot of respect for your ACTUAL career, don't get me wrong.

While I have your attention, could you take a look at this: [http://substack.net/offline_decentralized_single_sign_on_in_...](http://substack.net/offline_decentralized_single_sign_on_in_the_browser)

BTW, there's enough of us idiots out there that we're not going to stop until we've figured this out! Being able to ship a decentralized version of say Facebook or Twitter that runs in the browser and allows people to manage their own private keys (aka, manage their own digital identity) is incredibly motivating. I don't trust platforms like iOS or Android to not shut down certain kinds of apps and I don't think my mother will ever be running an open-source OS on her tablet.

I have to say that I definitely lost my shit in this thread... and I'm sorry. I have a tendency to get emotional about this kind of stuff because the politics are a big part of what motivates me to build these kinds of things. I take these hard-lined stances against browser javascript as an assault on my principles for digital identity but also as a creative individual who strives for a positive and constructive environment.

That doesn't justify me calling people names. Especially if I'm going to be talking about the means not justifying the ends... ugh...

However, I do think that articles like this are very close to being out of date: [http://matasano.com/articles/javascript- cryptography/](http://matasano.com/articles/javascript-cryptography/)

The Web Crypto API alleviates a number of these issues and novel uses of application caching manifests seem to solve the issue for good.

Check out this article, especially Gotcha #4. [http://alistapart.com/article/application-cache-is-a- doucheb...](http://alistapart.com/article/application-cache-is-a-douchebag)

So in this case we've got an authoritative article that says "never ever far- future cache the manifest". And we've got an authoritative article that says "never ever do crypto in the browser".

Both articles take a pretty heavy handed approach and don't really set out to explore the deeper possibilities. They both kind of set out to create an environment where readers will also not question these principles for fear of being made look like a fool in front of their peers.

But the fundamental hacker ethos is to read articles like this and say "the intent of the APIs and authors be damned, I have other considerations!".

Anyways, I'd really appreciate your thoughts on this stuff... all of, including what I and a number of other people perceive as a toxic environment for creativity related to cryptography and infosec.

<comment><USER4> If you want to be creative with cryptography, put in your time first actually breaking systems. The world is full of poorly-implemented crypto code. Go search Github for Python, Ruby, and PHP crypto. File bugs. Every crypto primitive available to you has misuse cases that you can find in actual deployed software. If you can't exploit them, you're not ready to use those primitives yourself.

One place I have put my own time in is in teaching people how to do this. This site:

[http://cryptopals.com/](http://cryptopals.com/)

... was preceded by more than a year of individual person-to-person email- based tech support in which thousands of people got several sets through these challenges, and almost a hundred finished.

I have zero sympathy for the people who are unwilling to put that time in, have their feelings hurt when they stumble trying to get their own systems working, and then complain of a "toxic culture" in cryptography. That "toxic culture" takes its place alongside the toxic cultures of nuclear controls system engineering, gastroenterological surgery, and appellate court law.

I have no idea whether this describes you or not, because your comment started out by asking me to look at a technical problem, then attempting to rebut a statement I didn't make, then invoking the fiasco that is the Web Crypto API, before finally complaining about toxic cultures. I don't know where to start, and so I'm hitting the eject button.

<comment><USER3> I apologize for the lack of focus in my comment.

What do you think about that appcache solution to controlled updates?

<comment><USER3> Wow.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> This looks cool really cool! I like the site, however it can be hard to read the text with the flashy background. Perhaps have the flashy background scroll up with the first "panel"?

On the crypto side of things, are there any plans to create native clients? While I don't doubt that you guys are trustworthy, it would be nice if I didn't have to trust that the javascript I was being served didn't change between visits.

All in all it looks good, albeit with some trust issues...

<comment><AUTHOR> Thanks!

We have some ideas about solving the trust issue — [https://news.ycombinator.com/item?id=8660233](https://news.ycombinator.com/item?id=8660233) — but yep, native apps are definitely on the way.

Still playing around with the site, I'll set aside some time to dig into readability issues (I was noticing the same effect at certain parts of the video).

</comment></comment><comment><USER6> I would like to share the link on an iPad. But I guess you were too smart. When I tap on the link to select and copy it, some JS code autoselects the whole link. This is a nice idea and should save me some work. But the copy mode on the ipad breaks. So I cannot copy the link and share it.

<comment><AUTHOR> Well that sucks; thanks for letting us know!

Chrome and Android have definitely gotten the most attention so far, though this is the first I'd heard of iOS having issues with that. I had run into a similar issue on Windows Phone (and successfully fixed it), but I'll have to revisit iOS.

As a temporary workaround, does it work when you try a second time? On mobile it should stop trying to grab the link for you after the first time.

</comment></comment><comment><USER7> I don't now how secure this is, but the look&feel of the site is awesome. If you happen to fail in this project, I encourage you to try another one, since you clearly have talent to make really cool web apps.

<comment><AUTHOR> lol, thanks! We're definitely trying to make Cyph the dopest chat app out there ("dopest encrypted chat" just doesn't sound like a terribly high bar to me).

</comment></comment><comment><USER8> Could the designers indicate what would be the class of entities that this is supposed to protect my chats from ? the guy on the same wifi ? isp ? routers on the way ? govt entities ?

In a number of threads it was claimed that this is better than nothing or better than https, could you (all) elaborate on why that would be so. If I am just locking one door of my car leaving the rest open, I sure would like to know and at the moment this is what it sounds like but I am quite the ignoramus so please correct my misapprehensions.

EDIT

@buu700 Thanks for replying.

<comment><AUTHOR> Sure, we can clarify that on the site. (Thanks for the feedback! It's become pretty clear that our supporting content/documentation needs a lot of work.)

The intent isn't to protect from certain classes of entities, so much as to absolutely protect with a certain degree of confidence. That is to say, Cyph is a convenient tool that _probably_ keeps your secrets from, say, China; but if you're in a life and death situation you should consider carefully whether you have better options.

That being said, now that I think about it, there isn't an obviously better alternative in such a circumstance that I could recommend. Pidgin OTR is probably what I would have chosen a few years ago, and for now it's maybe still what I'd pick, but based on what I've been seeing in the OTR mailing lists and the Vice article I linked in another comment, it's really not a great option. TextSecure might be a good alternative if using it on a phone isn't too big a problem. There's always tried and true PGP, though where applicable the OTR protocol has much more interesting security properties IMO.

tl;dr: There's really no silver bullet, but Cyph has as good a chance as just about any alternative of protecting your secrets. I wouldn't stake my life on it quite yet, but I wouldn't stake my life on any existing alternative either. If things go as planned and we execute well on the next steps, it shouldn't be _too_ long before I'd consider Cyph strictly better than any alternative.

</comment></comment><comment><USER9> Really cool execution. Love the cyphertext view. The key exchange seems a little non-secure given the length of the sharing URL?

How does it work?

<comment><AUTHOR> Thanks!

As far as the crypto, right now it's just straight OTR ([https://arlolra.github.io/otr/](https://arlolra.github.io/otr/)), but we have some cooler stuff in the works for non-intrusive non-ephemeral encryption.

I think the way we handle the URL mitigates a lot of potential issues (the design goal there was to make it as resistant to someone brute forcing the address space as possible, within reason):

* It expires after 10 minutes, at which point it's immediately recycled

* It's also immediately recycled the second the other guy connects to the cyph (meaning that, hypothetically, two unrelated pairs of people could be cyphing each other at the same URL)

That isn't perfect on its own, but it's good enough for almost any use case.

That said, in a few weeks we're also rolling out a two-factor auth feature to verify your friend via her phone number or email address, for when you really need to be sure. (We'll flesh this out a bit more later on, e.g. possibly integrating with Google Authenticator.)

<comment><USER10> People can't trust that the site is actually serving the right JS crypto implementation. It can be broken at any time, which would allow the site to intercept communications.

It needs client-side code to do it correctly, for example, something like the e2e Chrome extension.

<comment><AUTHOR> Agreed that it's not a _perfect_ solution (you still have to trust that I'm not brazenly serving up backdoored crypto), but it's a lot better than nothing.

(And practically speaking, before building Cyph, Josh and I pretty much avoided having to use encryption except in cases where there was no alternative.)

But I definitely agree that we'll have to come up with a clever solution to this problem. Off the top of my head (haven't thought this through — could be totally stupid), we may be able to do something clever with html5 appcache and notifying users when the hash of the code changes (and giving them the option to stay on their known good version).

Of course, once we have our native app out this issue will be trivial to avoid for people who really need to.

Edit: To clarify, I should correct you on that we are definitely performing the end-to-end encryption from the client — anything else would kinda defeat the purpose of Cyph...

</comment></comment></comment></comment><comment><USER11> [https://www.cyph.com/privacypolicy](https://www.cyph.com/privacypolicy) Your second to last bullet point is not really possible.

<comment><AUTHOR> Ignoring the semantics of the phrasing (that's just a temporary placeholder), the intent is to say that we won't ever willfully send a decrypted copy of our users' encrypted data to our servers.

<comment><USER11> A court order is a simple thing, are you implying that the operators of the site are willing to go to jail for denying a legitimate order on a free service?</comment></comment></comment>