AngularJS 1.0 released - <AUTHOR> http://googledevelopers.blogspot.com/2012/06/better-web-templating-with-angularjs-10.html <comment><USER3> This kind of reminds me of (my limited exposure to) XAML, in a good way.

Also interesting to note that this project seems thoroughly "de-Googled". Code hosted on github under a non-Google name, site made with bootstrap and not on a Google domain either.

<comment><USER4> I talked with one of the devs at BackboneConf (Vojta) and this project started as a 20% project that became fulltime for 3 devs. Apparently a team had been working on an internal project for 3 months and there was a bet that it could be rewritten in two weeks, which was won. Google uses it for a few internal apps.

Of the KVO frameworks, I consider it closest to Ember in the focus on bidirectional bindings for dom/model isolation. The most unique feature of Angular is the change detection technique.

Most frameworks handle this via extension of a base object and using get/set functions or ES5 accessors. Angular actually walks the entire model graph on demand. This allows it to work with base JS objects (there's no special syntax to learn) and third party libraries at the cost of having an O(n) operation in the system. The assumption is that modern JS engines are fast enough to do 10s of thousands of checks without a noticeable impact and your client side model is most likely under this size.

<comment><USER5> Interesting you mentioned Ember, which I'm a fan of as well as Angular, though I've been using Angular almost exclusively for severa weeks.

One key difference for Angular is that your markup ends up pretty much exactly how you want it. Ember had <script> tags littering my DOM for binding purposes, which made progressively enhancing forms (and leaving the standard submit event) require manual cleanup prior to letting the page change.

To Ember's credit, it is refreshingly opinionated, and solves the very difficult problem of handling complex states and transitions to deep portions of the app.

<comment><USER6> _Ember had <script> tags littering my DOM for binding purposes, which made progressively enhancing forms (and leaving the standard submit event) require manual cleanup prior to letting the page change._

I'm familiar with the <script> tags it dumps for binding, but I don't understand why you needed to manually clean them up.

Could you elaborate a little, please?

</comment></comment></comment></comment><comment><USER7> Well, Spine has fat controllers, and AngularJS has fat views. Whether I bind the data from the controller or the view it is the same amount of work. I don't see the immediate advantage over other frameworks.

The "Reusable Components" section states "This lets you focus either on what the application does or how the application looks separately." However, directly below is a view (template) stuffed in a controller as a string. AngularJS uses a "ng-" namespace for data whereas Knockout and others use the HTML5 "data-" spec. These seem like a step backwards, and behind what is found in Backbone, Spine, Ember, or Knockout.

Angular also includes its own forEach, JSON parsing, isArray, isElement, isFunction, isObject, isUndefined, noop and Promises methods (and more!). Other frameworks instead rely on existing, familiar libraries like jQuery or Underscore. It even has its own Uppercase and Lowercase methods, despite existing already in native JS. Even on the AngularJS website jQuery is included, therefore many of these methods unnecessarily exist twice.

Rather than use the existing event bindings, Angular has recreated them all with an "ng" prefix. Angular also has its own testing suite rather than integrating one of the existing popular JS test frameworks like Jasmine.

Angular doesn't seem to have any serverside equivalent for its proprietary design, so creating a fallback for less rich clients will be difficult.

I am striving to understand the distinct advantage of AngularJS, however mostly what I see is just reinventing the wheel. With so many proprietary methods, the learning curve is steeper than using a popular framework like Spine which is already extensible with common modules. It is a good effort, but against its comparables it has catching up to do.

<comment><USER8> "Angular also has its own testing suite rather than integrating one of the existing popular JS test frameworks like Jasmine."

are you sure about that? pretty sure it uses Jasmine.

From the tutorial: "Angular developers prefer the syntax of Jasmine's Behavior-driven Development (BDD) framework when writing tests. Although Angular does not require you to use Jasmine, we wrote all of the tests in this tutorial in Jasmine. "

<comment><USER7> There are very brief references to Jasmine in the Unit Testing[1] and Testing Services[2] sections, however the complete (proprietary) E2E testing documentation does not mention Jasmine at all.[3]

[1] <http://docs.angularjs.org/guide/dev_guide.unit-testing>

[2] [http://docs.angularjs.org/guide/dev_guide.services.testing_s...](http://docs.angularjs.org/guide/dev_guide.services.testing_services)

[3] <http://docs.angularjs.org/guide/dev_guide.e2e-testing>

</comment></comment></comment><comment><USER9> The template tag conflicts with Django's. You can easily define a new AngularJS tag like this: "(( ))" tag

var m = angular.module('myApp', []); m.config(function($interpolateProvider) { $interpolateProvider.startSymbol('(('); $interpolateProvider.endSymbol('))'); });

[http://stackoverflow.com/questions/8302928/angularjs-with- dj...](http://stackoverflow.com/questions/8302928/angularjs-with-django- conflicting-template-tags)

<comment><USER10> Django 1.5 will include a verbatim template tag

[https://docs.djangoproject.com/en/dev/releases/1.5/#verbatim...](https://docs.djangoproject.com/en/dev/releases/1.5/#verbatim- template-tag)

</comment></comment><comment><USER11> A little OT but I have often found that when watching hour long videos, esp. conference videos it is best to play it at least 1.5X its original speed. For some reason not only does it save your time but maybe because the video is going faster I get less distracted and grasp more of it (maybe because your thought train isn't interrupted by other thoughts at faster speeds). This is also great for watching video tutorials by Linda, etc.

Youtube had this feature inbuilt too but seems they've discontinued it now. There is an iOS app called Foxtube that thankfully has retained this feature. Or you can just download it and play it in VLC. Thought I'd share this "hack" since the Google video is 2 hrs long.

<comment><USER12> On youtube, if you're part of the HTML5 experiment (check at <http://www.youtube.com/html5>), you can put the following in your address bar, to watch at a higher rate of speed:

      javascript:document.getElementsByTagName('video')[0].playbackRate = 2.0;

This will work even while the video is already playing.

<comment><USER13> I get a button on the video bar that lets me adjust the playback rate to different speeds.

<comment><USER12> That "only" lets you go to 2.0x. I've been listening to podcasts at 2.0x recently, and wishing for 3.0x.

</comment></comment></comment></comment><comment><USER14> I don't understand this JS MVC thingy, what do they bring up to the table?

I read Backbone's documentation and to me is a mess of heavy JS programming to achieve something that I don't know what it is.

EDIT: How does this mix with Ruby on Rails, Grails or even Java MVC frameworks?

<comment><USER15> | I don't understand this JS MVC thingy, what do they bring up to the table?

What MVC brings to any table -- structure and maintainability. This is more geared towards complete client-side applications than your typical jquery plugin.

<comment><USER14> Would that mean that the backend would be only MC and the client side would be the V using one of those?

Does this question make sense?

<comment><USER16> Backbone and its ilk are full MVC themselves. Typically, you'd have models on the backend which are synced to the frontend via XHR/websockets/etc, so that both sides have a representation. Backbone also has controllers (in the Cocoa sense rather than the Rails sense), in the form of collections. Unlike Rails, though, most of the functionality is going to be in your views and your models.

</comment></comment></comment></comment><comment><USER17> Google releasing open source code and not revealing if they've ever used it on any of their sites (see 'built with angularjs <http://builtwith.angularjs.org/> ) is somewhere between silly and suspicious.

<comment><USER18> They posted this about DoubleClick:

[http://blog.angularjs.org/2012/06/doubleclick-super- powered-...](http://blog.angularjs.org/2012/06/doubleclick-super-powered-by- angularjs.html)

<comment><USER19> Does anyone know if the public-facing site is supposed to be using Angular? There are no references to the library anywhere in the source of <http://www.google.com/doubleclick/>.

<comment><USER20> DoubleClick is a public facing app, but you need an account which you can get only through a sales rep (I believe). The target audience are medium and large advertising agencies and not individuals.

</comment></comment></comment></comment><comment><USER21> You can play around with it on Plunker. Check out <http://plunker.no.de/edit/JVl3Jx?live=preview> for an example.

I didn't write the example, but did make Plunker.

<comment><USER22> Only had a quick browse. Curious how Plunker compares to jsFiddle (<http://jsfiddle.net/>)

<comment><USER23> There's a pretty good overview here: <http://plunker.no.de/>

<comment><USER22> Cool. Thanks :)

</comment></comment></comment></comment><comment><USER24> This is indeed interesting! Any googler want to comment how is this different from its cousin Google Closure Library? It looks like it is leaner and more modern. Any other difference?

<comment><USER25> Not a googler, but it has little in common with GCL's approach from what I've seen. Angular and most of the MVC frameworks seem targeted at removing boilerplate data-binding out of common business apps.

Closure is a collection of high performance libraries suitable for very large javascript applications and puts emphasis on reduced code size (post-compile) and performance/memory. It doesn't have any HTML bindings so you'd have to do that manually. After compilation I'd argue Closure would be leaner than the equivalent Angular application. I'm sure Angular can scale well, but probably not like Closure. It's no less modern than Angular and still being actively used (G+, schemer).

I'd say 95% of devs are looking for something like Angular. It looks like it will significantly reduce your JS source code; Closure will do the opposite.

</comment></comment><comment><USER26> I really love this. It's a ton of fun to play with. Seriously considering it on my next project.

<comment><AUTHOR> Yes, it's really become my favorite JS MVC and the doc is amazing. They've also announced that Google built the new version of doubleclick on it [http://blog.angularjs.org/2012/06/doubleclick-super- powered-...](http://blog.angularjs.org/2012/06/doubleclick-super-powered-by- angularjs.html)

Two must watch demos:

* [http://www.youtube.com/watch?feature=player_embedded&v=u...](http://www.youtube.com/watch?feature=player_embedded&v=uFTFsKmkQnQ)

* [http://www.youtube.com/watch?feature=player_embedded&v=W...](http://www.youtube.com/watch?feature=player_embedded&v=WuiHuZq_cg4)

<comment><USER27> The Twitter API demo showing off the Resource library is also great:

* <http://www.youtube.com/watch?v=IRelx4-ISbs>

</comment></comment></comment><comment><USER28> I'm using an older version of Angular (0.9.19) for a medium sized project. The bad part is that they changed it so much for version 1.0 that it's almost another framework. And the worst part is that they introduced a lot of boilerplate. Too bad, Angular 0.9 was IMO better.

</comment><comment><USER29> Can anyone with any ember experience comment on the differences between the two? I've been doing Ember for the past few months and my team is about to convert two Backbone projects into Ember for consistency. Based on what I've read, I'm starting to wish we had gone with AngularJS instead of EmberJS, but I'm sure each has it's pros and cons. At this point in the game, I think it's a bit too late for my team to switch frameworks unless there's a really compelling reason to do so.

<comment><USER30> I don't have much experience but tried to draw some comparisons: [http://tunein.yap.tv/javascript/2012/06/11/javascript- framew...](http://tunein.yap.tv/javascript/2012/06/11/javascript-frameworks- and-data-binding/)

If you can tell, I like Angular's approach better. However, the crucial thing is that Ember still has 2-way data binding. And I think you will have a much easier time porting Backbone to Ember than to AngularJS.

</comment></comment><comment><USER31> I'm not going to complain about options, but to me Knockout.js looks better and more featured.

I'm not going to jump on something new, just because it came out of Google.

<comment><USER32> I thought it was the other way round, that AngularJS had features that most other frameworks didn't. Personally, when I looked at Angular and Knockout (and Backbone, etc.) last year, I liked that Angular didn't require using KO.observable to do binding like Knockout did. Angular isn't new, either; it's been around since 2010, but has mostly flown under the radar while other frameworks got more attention.

Angular's main weakness is probably its marketing. It's made by engineers and not designers, so its web fronts aren't crowd-pleasers. Its API and internals have been changing so rapidly that the documentation only recently caught up. But it's got very solid engineering under the hood, and there are a few blogposts out there by people who compared various JS MVC frameworks and picked Angular for its engineering.

With the advent of client-server frameworks like Derby and Meteor (and the Rails-integrated framework Joosy), the pure client-side frameworks may have to evolve to keep up, but among this slightly more mature crowd, Angular ranks very well IMO.

\---

[edit] A comparison of Angular and Backbone from over a year ago, with a bit about Knockout as well: [http://stackoverflow.com/questions/6548826/angular- js-vs-bac...](http://stackoverflow.com/questions/6548826/angular-js-vs- backbone-js)

<<< Jason - AngularJS is 100% MVVM. The reason the Angular boys call it MVC, is because they are Googlers, not XAML developers. In Angular, Controllers are equivalent to ViewModels. You'll notice - there are no references to the view and zero DOM manipulation in Angular controllers. Knockout uses proxy objects for observable databinding. You will soon get tired of calling ko.observable() & ko.observableArray() to wrap any objects you want to databind. Proxies cause problems. Angular does not use proxy objects, and therefore you can databind directly to any JSON (ie, coming in from a service). – Ryan D. Hatch May 28 at 11:53

Jason (part 2) - Angular is also an HTML compiler... you can create new tags & attributes, just like you could create User Controls & Attached Properties in XAML. So everything becomes modular / you can create your own reusable components / controls. AngularJS supports scope inheritance, which is the equivalent to DataContext inheritance in XAML. AngularJS has a very bright future. Did I mention it has fully support for routes & deep-linking, partial views, services with dependency injection, and an excellent testing story? :) – Ryan D. Hatch May 28 at 11:53

\---

Ryan, thanks for the feedback! You may notice that I wrote this answer almost one year ago. I still really enjoy MVCC, but your prediction is correct. I am getting weary of ko.observable(). – JasonSmith May 29 at 0:21 >>>

</comment></comment><comment> bill-nordwall Why aren't the "ng*" attributes prepended with "data-" to make them valid HTML5 attributes? It's a minor nit, but kind of annoying nonetheless.

<comment><USER33> You can use several binding declarations styles, including data-ng-*: [https://github.com/angular/angular.js/blob/master/CHANGELOG....](https://github.com/angular/angular.js/blob/master/CHANGELOG.md#compile- rewrite)

<comment> bill-nordwall Thanks for the info!

Although, forgoing "data-" prepending by default in the interest of saving a few bytes doesn't seem like a good tradeoff. If you have any HTML5 validation as part of your testing process, not having valid attributes is going to throw a whole mess of errors that you'll have to ignore.

<comment><USER34> Does HTML5 validation really matter when your goal is to build an MVC JavaScript app? I'm not trolling btw, many others in the community have long had validation pegged as a red herring [1] [2].

Validation of your attributes is fairly meaningless, and if you have a decent validator setup as part of your workflow (save-time or build-time - <USER2> personally wouldn't bother with either), then you should be able to customise it to turn off silly errors. You could also pre-process your JS files as part of your build step to replace ng-* with data-ng-* if it really meant that much to you. The byte-saving doesn't matter of course, but it seems like extra typing and more repetition in your templates for zero benefit.

[1] [https://groups.google.com/forum/?fromgroups#!msg/html5boiler...](https://groups.google.com/forum/?fromgroups#!msg/html5boilerplate/bRtrFSrKjtI/AOa44To23nMJ)

[2] [http://www.nczonline.net/blog/2010/08/17/the-value-of- html-v...](http://www.nczonline.net/blog/2010/08/17/the-value-of-html- validation/)

<comment><USER35> The problem is not whether a validator spits several errors or not, HTML validators are tools designed to point out stuff that is not conforming to the specs. It's stuff that you should avoid, not that will necessarily break your application on any web browser.

Why should you avoid it? Because, basically, if it's explicitly forbidden, or not covered by spec, you can't be sure of what will happen in all (or newer) browser implementations. If there's no defined behavior for some code, _any_ behavior is correct.

Also, it's not like you have to go an extra mile in order to follow the specs here.

</comment></comment></comment></comment></comment><comment><USER36> The intro video is interesting, but the suggestion that apps in Angular are going to be "much more like HTML" seems to me to be belied by the fact that the second example has a more or less Backbone-like Model definition.

I can appreciate the desire to have declarative relationships within markup, but if there's going to be Javascript running anyway, what does it gain?

Plus, <html ng-app> is an abomination…

<comment><USER30> Yeah, the point of Angular is not to "program in html", just to have declarative html for dealing with the DOM and otherwise program in JS.

I totally agree for server-side templates that there are limited benefits (designer friendly perhaps) to a template as valid HTML. However, when you want to make your HTML interactive (2-way data binding) in an unobtrusive way, you are forced to understand html.

A good example I went over is how would you bind data to a checkbox automatically? I think you are advocating the Ember.js approach, which uses a function call to represent a checkbox, but a plain tag is actually much easier to understand: [http://tunein.yap.tv/javascript/2012/06/11/javascript- framew...](http://tunein.yap.tv/javascript/2012/06/11/javascript-frameworks- and-data-binding/)

</comment></comment><comment><USER37> I have tried several javascript mvc frameworks: angular, backbone , javascriptmvc (i'm serious, the name is javascriptmvc) but time and time again I'm always drawn back to backbone, as this is a post about angular, one thing that turns me off about angular is the high lock in/dependency towards the framework.

They have a lot, I mean a lot of functionalities built in, but with that comfot comes the price if you want to use any other jquery/javascript library plugin that's available out there. The only option you have is to "angularize" the plugin before you can use it. This is different from backbone, almost like the name suggest, it's bare bone, there will be more boilerplate code but you get more freedom and most if not all the plugins that are available to you from your js libs can be used as is. My suggestion before going all out to ANY js framework, know how the application would behave beforehand.

<comment><USER32> There are projects to connect Angular to other libraries, e.g.

\-- angular-ui: [http://deansofer.com/posts/view/14/AngularJs-Tips-and- Tricks...](http://deansofer.com/posts/view/14/AngularJs-Tips-and-Tricks- UPDATED) \-- a set of widgets for UI elements, including wrappers for jQuery plugins

\-- jquery-mobile-angular-adapter: <https://groups.google.com/forum/#!topic/angular/at8helGHd_g> \-- for using angular with jQuery Mobile

\-- sencha-touch-angular-adapter: [https://groups.google.com/forum/?fromgroups#!msg/angular/c8s...](https://groups.google.com/forum/?fromgroups#!msg/angular/c8sLSqA4AqQ/qymwooexmgwJ) \-- ditto, for Sencha Touch

I believe mostly any object can be easily wrapped to be accessible by Angular (which is what's happening in angular-ui for jQuery plugins, for example). Right now documentation for these projects is sparse, but their authors tend to be active on the AngularJS Google Group, and people often offer solutions to problems very quickly there.

</comment></comment><comment><USER38> I was juggling between knockout and Angular for my next project, after watching some demo's Angular gets the win.

</comment><comment><USER39> For me it's between Angular.js, Batman.js and <http://joosy.ws>

I would prefer Batman.js, but it's so buggy and the developers seem confused, there is no roadmap and the docs aren't updated as the code is.

<comment><USER40> > I would prefer Batman.js, but it's so buggy and the developers seem confused

So basically you like the name better? :P

<comment><USER39> I like the style of the API better. Unfortunately, the API doesn't do what it says it does :)

I dislike how views are treated in Backbone.

</comment></comment></comment><comment><USER41> Angular, knockout and ember are the contenders I'm now aware of for 2 way data binding. Looks like angular also brings in some of the stuff backbone provides... I might prefer to go more ala cart and stick with knockout for now.

</comment><comment><USER42> The github repository seems to have a lot of open issues for a 1.0 release: <https://github.com/angular/angular.js/issues>

</comment><comment><USER43> There seems to be a lot of magic going on under the hood, which will help you get off the ground quickly but I worry how easy it is to extend this to do unusual things.

Likewise, to provide features like dynamic update when a function's return value changes I assume it has to do either something very clever, or something very dumb (polling?). How performant is this sort of approach?

<comment><USER44> Yes, it polls. Most functions are quite fast, and fine to just poll, and it's quite convenient to be able to bind to functions when needed.

But it's all tradeoffs - in our app we have a few that aren't - for those, we profiled to find them, and added a bit of code to the functions to cache the return value.

<comment><USER45> It doesn't poll, actually.

<comment><USER44> Sorry, what I meant is that when the application rerenders (digesting changes that have been made) it will re-evaluate the function to check if the result has changed.

Polling the function for changes, contrast with how e.g. knockout.js pushes changes. (I could be wrong, please let me know if my understanding's not reality)

<comment><USER45> Ah, yeah I think you've got it right. I thought you meant polling as in it checked every X milliseconds for changes.

</comment></comment></comment></comment></comment><comment><USER46> Does anyone else find it odd that most JavaScript frameworks end up solving half the easy problems of doing frontend heavy web development, and leave the other half unsolved?

Backbone goes so far as to encourage a menagerie of bizarrely constructed HTML strings getting injected into templates, Spine has superfat controllers instead utilizing models more prominently, and AngularJS solves the (relatively easy) problem of databinding and little else.

What the hell? This is why we have to use roll our own solution at my company using jQuery + BackBone + _.template. We end up having most of the state either bound into the DOM (ala Angular, but done ourselves), or stored in a Cache object backed by Backbone.

<comment><USER47> FWIW, check out <https://github.com/politician/outback> for a bidirectional declarative binding solution for Backbone. It'll help you keep all of your DOM manipulation code safely away from your Views.

</comment></comment><comment><USER48> Finally! A simple way to re-implement the <blink> tag!!!!! My life is complete.

<comment><USER48> I was just kidding...

</comment></comment><comment><USER49> Please, if you're going to use a default Bootstrap layout, at least add a background image. Something as minor as:

      background-image: url(http://subtlepatterns.com/patterns/brillant.png)

will make a difference. (And please don't hotlink like I did.)

<comment><USER50> Why? Who benefits from a subtle dot pattern on the back of these developer docs?

<comment><USER49> It makes the page look mildly nicer with almost no effort.</comment></comment></comment>


Ask HN: Why use GitHub rather than a Wiki? - <AUTHOR> I've noticed that many people are using Github for 'living' documents.  Isn't this what Wiki's are good for?  Why the preference to use Github rather than a wiki?  It is just because Github is considered "stable and persistent"?
This is the post that started my wondering: https://news.ycombinator.com/item?id=10880726
You can see it here: https://github.com/jlevy/og-equity-compensation
It is a great looking project with lots of good data, but reading it on Github leaves much to be desired.
Thoughts or opinions? <comment><USER2> I think a big driver here is "ecosystem of tools" and "simplicity of forks". Git tools are increasingly ubiquitous and easy to find. While a good Wiki engine has a concept of document versioning it can vary from Wiki system to Wiki system, whereas the git repository history logs and annotation tools are well standardized and provide multiple choices of options of tools to browse such things (both programmer-centric and some more "friendlier" tools). You can edit the git repository online in Github and the tooling isn't all that different in experience from a Wiki to a less technical contributor, whereas a technical contributor can also grab the git repository using a tool of their choice, edit in a friendly environment (IDE/emacs/vim/etc) of their choice.

Simplicity to fork can also be important, and beyond just the Github-provide "fork" option, but in general of push/pull communication between "wikis". Wikis typically are stored in bespoke database schemas and import/export from and between them can be a pain. Git is entirely built around (programmer) collaboration and has protocols for pushing/pulling between repositories. This can make it easy to fork repositories, of course. (Compare to, for example, the Wikipedia world where when sections are "shut down" just about the only well clustered option to preserve them is often Wikia with its somewhat complicated import process of the peculiar MediaWiki XML format and some use of mostly documented public APIs. For smaller Wiki engines than MediaWiki sometimes the only way to migrate data is a raw database dump.)

Further more, at the intersection of "ecosystem of tools" and "simplicity to fork", a wiki like this on Github is "just a folder with a bunch of Markdown files". Push it to Github and Github builds all your Markdown for you and displays it (and allows you to edit it) in a nice, easy way. Push it to Bitbucket or Visual Studio Team Services or Gitlab or any number of other providers and you get much the same web-based view. You get some choice there between definite competitors. You could add a table of contents and turn it into a Gitbook or Leanpub book (and other less well known competitors in the book from a git-backed folder of Markdown files space). Furthermore, you can always just grab the git repository locally and build the Markdown yourself (again, using any number of command line tool options or IDEs that you prefer to use).</comment>


GAW Miners founder owes nearly $10M to SEC over Bitcoin fraud - <AUTHOR> https://arstechnica.com/tech-policy/2017/10/bitcoin-fraudster-hit-with-9-1m-civil-judgment-on-top-of-criminal-guilty-plea/ <comment><USER2> inb4 "it's all a pyramid scheme"

I welcome the SEC's enforcement of established rules on ICOs and going after scams. It will make the whole space healthier.

Puzzling why some obvious scams are going strong, though, such as this: [https://mastercoinplus.com/](https://mastercoinplus.com/)

I mean, just read that FAQ! It's like a textbook case of identifying a pyramid scheme.

<comment><USER3> From the website: "Who is the founder? The founder is a master trading group and a team of marketing professionals guiding the company."

Not exactly inspiring confidence

</comment></comment><comment><USER4> Oh, the Paycoin guy. That was clearly a scam.

<comment><USER5> And this isn't even about Paycoin, but about his previous scam! I'm not sure Paycoin has come to regulatory attention yet ...</comment></comment>


Show HN: I built a syllable dictionary using Python and web scraping - <AUTHOR> https://zacs.site/blog/building-a-syllable-dictionary-with-python.html <comment><USER2> Did you try to contact 'www.howmanysyllables.com' before? To see if they would give you the informations. So you don't have to scrape their website.

<comment><AUTHOR> No, didn't think to do that. Part of the reason I went to all this trouble, though, was to go through the process of building something myself, that I could run myself--and that, by extension, anyone else could do, too.</comment></comment>


Fed Reserve Not Yet Tapering Bond Buying or MBS - <AUTHOR> http://www.federalreserve.gov/newsevents/press/monetary/20130918a.htm

<comment><AUTHOR> Watch Bernanke's comments here live at 2:30 EDT: [http://www.c-span.org/Events/Fed-Chair-Briefs-on-Economic- Ou...](http://www.c-span.org/Events/Fed-Chair-Briefs-on-Economic- Outlook/10737441504/)</comment>


Revisiting Paul Graham's "High Resolution" Financing - <AUTHOR> http://www.bothsidesofthetable.com/2010/09/25/revisiting-paul-grahams-high-resolution-financing/ <comment><USER2> I enjoy Mark's blog. But there is something strange in his proposal to carve out $10,000 for five early investors and offer them an immediate 10x ROI on paper just for jumping first.

First of all, $10,000 is not enough money to justify giving away equity in any company with reasonable prospects, especially since issuing the equity costs money over time. This is the same problem with the Twilio fund (they should just offer free service to pre-revenue start-ups).

Second, assuming the major value of social proof is the assurance it provides later investors that people they respect see the risk-return ratio as favorable enough to risk their own capital, this will accomplish nothing but shift the equilibrium towards smaller rounds for entrepreneurs while demands for social proof will shift correspondingly ("But who else has invested $50,000....").

I respect Mark's investing in small business. But as a single founder with a bootstrapped business (outside SV), I'd chalk up someone who even suggested this as just trying to exploit me. I do think it's a good idea for investors to get compensation for effort put into organizing rounds. But the founder- friendly arrangement is performance based though, not "giving a good deal to investors [who founders] expect to help them [sometime in the future]".

<comment><USER3> I think you might be misunderstanding his proposal. He suggested raising $50k from 5 investors at a $500k post-money valuation, implying that you're selling 10% of your company to the investors in return for $50k -- and not that you're somehow giving them a free 10x.

<comment><USER2> If you get five investors and have a product making zero in revenue then it makes sense as a first round of sorts. If you already have revenue it's not a good valuation. I guess it depends on what sort of people they expect to be dealing with at this level.</comment></comment></comment>


All-Nighters: Miles to Go - <AUTHOR> http://opinionator.blogs.nytimes.com/2010/05/02/miles-to-go/

<comment><USER2> The worst part of insomnia (for me) is that I'm too tired to do anything productive and that time is completely wasted.

</comment><comment><USER3> "But anyone who has run a marathon knows that it's not all science. There is a huge mental component in the last six miles. Humans aren't designed to run that far."?

I think she should visit the Tarahumara <http://en.wikipedia.org/wiki/Tarahumara>

<comment><USER4> Humans aren't designed to run that far. But if you start running before you can walk, I'd say your body could adapt pretty well.

<comment><USER5> It's silly to argue over whether humans were "designed" to run that far. There are some things we definitely _can't_ do, like jump fifty feet in the air or outrun a cheetah or stay underwater for two hours. But running a marathon is nowhere near the limits of human capability -- pretty much any able-bodied human being under the age of fifty can get there with sufficient training. I've never run a marathon but I've done a half and I'm planning a full one in the next few years. Of course the mental component is a lot easier for the happy-just-to-finish crowd like me than it is for anyone hoping to actually finish at the front.

<comment><USER6> > [...] or outrun a cheetah [...]

Outrunning a cheetah is actually pretty easy for a human over all but the shortest distances.

<comment><USER5> Unfortunately the typical running race between a human and a cheetah lasts about five seconds and ends with a lot of teeth and claws.

<comment><USER6> Not if you happen to have a big, pointy stick and know how to use it.

</comment></comment></comment></comment></comment></comment><comment><USER7> Because of insomnia, bedtime turns into a stressful event for me.

<comment><USER8> I experienced the exact same problem and have it mostly cured.

<http://www.zacharyburt.com/2010/02/how-i-conquered-insomnia/>

</comment></comment><comment><USER9> written by an olympic hopeful marathoner - 2:32:59 best marathon time - wow! - <http://en.wikipedia.org/wiki/Tera_Moody>

</comment><comment><USER10> Sounds awful, but I assume that it is rest that the body needs more than sleep.</comment>


Show HN: Open Source Constellation T-Shirts - <AUTHOR> https://github.com/teonite/t-shirts/ <comment><USER3> It would be nice if the star positions had been taken from real star positions, picking an optimal set to match the desired shape (a fun data project for someone with more time than me), rather than just plonked down any old how.

<comment><USER4> Yeah, I initially got excited by the link for this reason too. You might be able to do something with Astrometry.net ([http://astrometry.net/gallery.html](http://astrometry.net/gallery.html)), by first converting the logo to a set of points. But they might just reject non- star images (or images where the points don't exactly match).

<comment><USER5> Since it's open source, why not create just a PR with proposed changes?

</comment></comment></comment><comment><USER6> I've always been interested in doing ACTUAL open-source clothing. Cuts, stitches, production process, etc. Let's make the best tshirt ever!

<comment><USER7> Have a look at freesewing.org, it's an open source platform for made-to- measure sewing patterns.

Full disclosure: I'm the maintainer

<comment><USER8> Very, very, _very_ cool. You may just get me into some serious sewing.

</comment></comment></comment><comment><USER9> I do the same with laptop stickers: [https://github.com/mikemaccana/stickers](https://github.com/mikemaccana/stickers)

<comment><USER10> Hi Nailer, how do you use these? I can't seem to open a .sketch file on my Linux machine. Would you be willing to share a cross-platform version of your stickers?

<comment><USER9> Figma can open .sketch files and runs on Linux.

<comment><USER10> Thank you, for some reason I didn't come across that in my search. Much appreciated.

<comment><USER9> It's cool. People dowmmod you for asking about Linux but its a legit question, I moved to Windows a couple of years ago and having them in .sketch has always been a pain.

</comment></comment></comment></comment></comment><comment><USER11> Note: Clothing designs _are not copyrightable_. Illustrations on a T-shirt may well be, though.

<comment><USER12> > Clothing designs are not copyrightable.

In a number of (non-US, currently, though there are recurrant efforts in the US, too) jurisdictions, there is shorter-term, copyright-like protection for clothing design.

<comment><USER9> Yeah, I know in some markets it's like '7 points of differentiation' that have to be proven at court to be considered an original design.

</comment></comment></comment><comment><USER13> Can patches be applied to my t-shirt after it's been printed? ;)

(Sorry but I almost never make puns but I had to make this one.)

<comment><USER14> You can actually use diluted bleach to modify dark shirts pretty easily - <USER2> yes!

</comment></comment><comment><USER15> Can you put a copyright on constellations? You might be able to put a license on the code that produces the lines, but I don't think the final results should be copyrighted.

<comment><USER16> INAL but from my limited understanding of copyright law you can't copyright facts. However original works in any medium are protected, so the code and also the images themselves would be copyrighted at the time of creation. But anyone could create another set of similar yet original code which could output similar images and not be in violation. Subsequently these new works would also be copywrited at the time of creation... Ad nauseam

</comment></comment><comment><USER8> I don't really find this to fit the name "Open Source". It's simply a project with published assets. A cool idea, yes, but even the process isn't even documented that well.

> Ultimately, we decided on a full-print T-shirt printed on both sides, which > was made for us by a local, friendly printing house.

The one interesting part, where to acquire fully printed t-shirts in Europe, was left out.

</comment><comment><USER5> I think it's a nice start to see "Open Source" term used not only for developing purposes, but also for things we use every day. Nice job!

<comment><USER8> I love that it introduces people to it and gives them positive associations, however I think we risk watering down the term, not always being clear what "open source" means in a given context. This project itself is a good example in my opinion.

Refer to my top-level comment: [https://news.ycombinator.com/item?id=16386307](https://news.ycombinator.com/item?id=16386307)

</comment></comment><comment><USER17> Heads up to anyone else following the "just buy the shirt" link, it won't work unless you prefix with [https://](https://).

Working link is: [https://teonite.cupsell.com/](https://teonite.cupsell.com/)

</comment><comment><USER18> This statement doesn't apply to this project but remember organizations still have trademarks. See [https://www.python.org/psf/trademarks/](https://www.python.org/psf/trademarks/) for an example.

<comment><USER5> yes, but they're not using the logo itself, it's just like an inspiration for creating constelations which are open source

</comment></comment><comment><USER19> I was disappointed to see this was just for the graphic, not for the actual design of the t-shirt.

<comment><USER12> In the US, an open source clothing design is superfluous since such designs are not usually protected (outside the scope of copyright, rarely qualify for patent, trade dress, or other protection.)

<comment><USER20> Clothing design in the copyright context means the pattern of the clothing, not images or text, and copyright for clothing generally applies to non- functional flourishes or design elements. In this case, the logos are derivative works of presumably copyrighted logos of open source projects.

</comment></comment></comment><comment><USER21> Well, does need some open-source improvement indeed. hasaatr printed wrong even on the shirts!

</comment><comment><USER22> In a way, you're open sourcing logo designs copyrighted by others, though. Some OSS projects may not care, but others can be just as protective of their branding as full-fledged companies, from what I've seen.

<comment><USER23> I don't think that a constellation - lines and dots is under any copyright. It's like saying that python logo has a python so it validates all logos that has snakes in logos.. Remember, no actual logos were used, changed, modified...</comment></comment>


Capsicum: Practical capabilities for UNIX - <AUTHOR> http://www.cl.cam.ac.uk/research/security/capsicum/

<comment><AUTHOR> Capsicum is a lightweight capability and sandboxing framework that was recently presented at Usenix. The authors have used it to improve the sandboxing of OpenSSL, dhclient, and a version of Chromium

Paper: [http://www.cl.cam.ac.uk/research/security/capsicum/papers/20...](http://www.cl.cam.ac.uk/research/security/capsicum/papers/2010usenix- security-capsicum-website.pdf)

Slides: [http://www.cl.cam.ac.uk/research/security/capsicum/slides/20...](http://www.cl.cam.ac.uk/research/security/capsicum/slides/20100811-usenix- capsicum.pdf)</comment>


AppVirality raises over $450K in Fund Raiser - <AUTHOR> http://pixr8.com/appvirality-raises-450k-fund-raiser/

<comment><USER2> Nice to see these beginner level of startups from asia getting attention but still much to improve comparison to funding stats.</comment>


DoH: Anti-Competitive and Network Neutrality Aspects - <AUTHOR> https://blog.powerdns.com/2019/12/03/doh-anti-competitive-and-network-neutrality-aspects/ <comment><USER2> The EU might be doing a better job here-- but is this suggesting that I trust my US ISP's DNS servers? The ISP that injects HTML into my HTTP requests? The same ISP known to hijack DNS requests?

Don't get me wrong, the issues raised by OP are valid and need to be addressed-- already we see the strangely privacy-antithetical behavior of using DoH to get around CNAME tracking in adblockers (using Cloudflare no less) --but I don't think legislation and regulation have been effective so far. Expecting that to change in the near future seems like a pipe dream.

<comment><USER3> > The EU might be doing a better job here-- but is this suggesting that I > trust my US ISP's DNS servers?

That's the false dichotomy. You shouldn't use either one.

The issue is that if you've already made your choice, e.g. by having your DHCP server give out the DNS you actually want to use or configuring it in your operating system, then having Mozilla default to ignoring your choice and overwriting it with Cloudflare is wrong.

And it would be one thing if it was something like people selling internet gateway devices that do this by default -- that's a great idea because it gets you away from the ISP's DNS by default but still provides a single place to set it the way you want it, and still allows the owner of an individual device to override it device-wide if desired.

Putting it in individual applications is the opposite. It means you have a full time job just changing it back to the way you want it in every application on every device, and even then you're liable to miss some.

<comment><USER4> > It means you have a full time job just changing it back to the way you want > it in every application on every device, and even then you're liable to miss > some.

Hopefully not. Firefox has some techniques for disabling DoH that rely on computer or network-wide changes. If other applications also adopt these or similar techniques, you'd only have to make the change in one place to turn it off for every application running on any computer on a network.

Specifically, as I understand it, Firefox disables DoH if

1) Windows Group Policy is used to manage a computer

2) A canary domain is blocked

[https://support.mozilla.org/en-US/kb/dns-over-https-doh- faqs...](https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_how- will-doh-impact-enterprises-with-custom-dns-solutions)

(Disclosure: I work for Mozilla, but not on the Firefox browser)

<comment><USER3> > 1) Windows Group Policy is used to manage a computer

This is solving the problem only where it least matters. If you're using Group Policy then you can configure DNS using Group Policy anyway, so any default there is already easy to override. Where the default really matters is on the devices where the only central management is DHCP, because those are the devices that require manual interaction to fix an application that defaults to ignoring the DHCP configuration.

> 2) A canary domain is blocked

That could work, but what happens when the ISPs start blocking the canary domain? The FAQ says they'll monitor it but that doesn't tell you how they'll address it when it happens.

<comment><USER5> > but what happens when the ISPs start blocking the canary domain?

Put your own DNS server in front of it that resolves the canary domain, I guess.

The absurdity of rolling a DNS server solely to unblock a domain blocked by an upstream DNS server specifically so that an application can resolve that domain and consequently not actually use your DNS server is not lost on me.

<comment><USER3> Technically correct -- the best kind of correct.

Though obviously if you've got your own DNS server in front of the ISP's then you could just configure _that_ to resolve names however you like. Which would then typically cause it to accurately resolve the canary domain by default and thereby cause the application to not use it. Hmm.

</comment></comment></comment></comment></comment></comment><comment><USER6> > Note that some countries have an underdeveloped ISP market, with large > fractions of the population having no choice of broadband service provider. > Regulation is then of the utmost importance to keep everyone honest, but in > some of these countries the regulator has been captured by industry and is > no longer very effective. This mostly goes for the US.

I think this is the key motivator for a move to DoH. Large US ISPs can't be trusted.

<comment><USER7> > Large US ISPs can't be trusted.

It's certainly unfortunate that we've gotten to this point. The net result is that nobody can be trusted: Not ISPs, not Cloudflare. There is a clear conflict of interest in Cloudflare's strategy, and their "aww shucks, we're just being the good guys" attitude is dishonest. At this point, one or many not-for-profit DoH providers (with easy selection of service in your browser or OS) would be the only true solution to this issue.

<comment><USER8> So don't trust Cloud Flare. DoH in no way depends on them. You can simply run your own DoH resolver.

</comment></comment></comment><comment><USER9> I don't seem to understand the whole thing. To me the premises are:

1) we can't trust ISP with unencrypted DNS query

2) we can trust a third party with DNS query because those are encrypted.

My questions are:

\- Why is 1 true? What are ISP doing with unencrypted DNS queries apart from knowing browsing habits?

\- With DoH do they not know your browsing habit anymore?

\- If there is a possible mitm attack with unencrypted, would it be fine if the ISP themselves ran a DoH server?

\- For the 3rd party: why would a 3rd party want to run a dns server for free? ISP run DNS server but customers pay a bill to them precisely to do things like this.

in other words, in the long term, wouldn't it be a money sink for Cloudflare to run a DoH server?

\- Instead of just one DoH endpoint, could browsers take a list of DoH servers, and picking the best one in terms of p95 latency, with some round- robbin tries occasionally to verify if anything changes?

This would solve the issue of one of the DoH service "having a bad day". Some amount of centralization would remain but based on an objective criteria (latency).

(The article answers some of those questions and/or points out the same concerns)

</comment><comment><USER10> Why can't I, as an end-user, have the choice of who I want to trust?

My ISP, Cloudflare, Google, somebody else? Give me a dialog box in which I can choose whether to use DoH and if so which provider to use, and then I can make up my own mind over which of those parties I trust the most.

<comment><USER11> I would argue that the original way to do this--where applications used the system resolver--gave you that option, as the system resolver could trivially be modified to do whatever you wanted (well, unless you are on iOS; on iOS you are effectively just screwed, because Apple wants to control the entire software experience... more on this in a later paragraph <\- edit: and also, I realized you can also do this on iOS!). glibc, for example, allows you to just give it arbitrary software plugins to implement the resolver, and so you--the person who configures your computer--have complete control over not just "who" you want to trust, but exactly "how" you trust them: you can decide to talk to Google, Cloudflare, or your ISP, and you can use DNS over HTTPS, DNS over TLS, unencrypted DNS, or something insane like Active Directory for all anyone cared.

However, at some point, web browsers decided that they didn't like end users being able to have this control, as, in practice, no one ever took advantage of it and they always allowed the operating system to select, by default, "use unencrypted DNS to the current ISP", which was slow, insecure, and often just _wrong_ (as ISPs--for at least four reasons I can think of, all but _maybe_ one of which I will assert are "bad"\--would sometimes return incorrect answers _on purpose_ ); and so, now, the new reality is that software is coming with embedded DNS resolvers that do exactly and only what the software developer wanted (which, in a world of not just codesigning but notarization, increasingly means the user has no ability to have any say in the matter what- so-ever), because "developers know better than everyone else" (originally, this was just for performance reasons or to avoid strange behavior from ISPs, reimplementing the logic, but not the protocol, though now they are using that control to take it further).

For clarity, I will restate "the premise": if software uses the system resolver (the one that people erroneously like to claim is somehow synonymous with "unencrypted DNS to your ISP"), anyone who wants to use DNS over HTTPS can, AFAIK on _any_ non-iOS operating system (if nothing else, by simply setting their DNS server to 127.0.0.1, if for some reason you can't just plug in your own resolver backend; edit: oh, actually, _even on iOS_ , by using a local Network Extension, which is how Cloudflare's 220.127.116.11 app works), do that for not just their web browser but for all software on their entire system at once; and, when some new protocol comes out that is _even better_ than DNS over HTTPS (maybe by solving some latency issue, or by using a decentralized resolver, or adding cryptographic verification), it would be equally easy to change your system resolver, and by extension all software on your entire computer, at once, to use _that_ protocol.

And now, again, for clarity, I will restate "what happened": that this was deemed not something that either users or, interestingly, operating systems should be in control over (though it would be hilarious to see Apple try to fight this one out from their fortress of iOS, claiming you don't get to be in the App Store unless you use the system resolver, a similar battle to their issues with people doing HTTPS requests that don't use their App Transport Security library); and so, instead, software (possibly ever single piece of software you use: not just your web browser, but random desktop chat applications, e-mail clients, games... maybe even network-oriented command line tools such as curl!) will now embed their own DNS implementations, making it "your guess is as good as mine" as to what protocol or root of trust any specific piece of software is relying on :/.

<comment><USER12> Discovered this Fun fact last night; the systemd resolver since V242, used cloudflare as a fallback DNS. [0] The fallback has been Google and quad9.

In theory (haven't tested it,) this means that even if I give 0 DNS servers on a DHCP request, and I ignore any DNS requests to the gateway (if I wanted a machine totally unable to resolve) I can't do that because a distro choice to use the systemd resolver.

[0] [https://github.com/systemd/systemd/blob/master/NEWS#L751](https://github.com/systemd/systemd/blob/master/NEWS#L751)

<comment><USER13> This is going to create a lot of noise (firewall drops) in networks where Linux is expected to be isolated. Many companies do this and many of those companies will start seeing alerts in their security operations centers. I am curious how most of them will respond.

<comment><USER14> It's trivial to disable the systemd resolver or change the fallback DNS servers to something other than Cloudflare.

<comment><USER13> Agreed, but people tend to not customize settings proactively. I usually see reactive changes. More often than not, people don't even know these changes to the base OS are occurring.

</comment></comment></comment></comment></comment></comment><comment><USER15> While I disagree with Mozilla's decision to switch users to centralised DoH, I believe they are right in their assesment that the current DNS infrastructure is not very private.

And something like DoH sounds pretty cool.

Without encryption there are a few nefarious things ISPs can do quite easily:

\- transparent DNS proxies

\- DNS query tracking

These things are pretty bad if you're affected, but I believe this shouldn't be addressed by centralisation of DNS.

<comment><AUTHOR> I think Dns-over-TLS (DoT) is a much better solution. It seems super weird to me that Mozilla isn't pushing for that, and is instead pushing for DoH+cloudflare.

</comment></comment><comment><USER16> > We have to keep in mind that if a DNS lookup is slow, the entire internet > feels sluggish. Slow DNS = Slow internet.

Ridiculously low DNS TTL is an idiotic curse of the internet, but fortunately (and currently) one that can be (mostly) fixed locally.

</comment><comment><USER8> This is a disinformation campaign. DoH doesn't centralize DNS or DNS privacy. Anyone can run a DoH resolver server, and it'll do just as good a job as Cloud Flare's.

The people crusading against DoH favor a different centralized DNS standard, DoT. DoT is DoH with essentially one difference, which is that it runs on its own port, so that network operators can block it. There's a sprawling cottage industry of security and analytics products that rely on passive DNS analysis to function, and people who sell those products or operate networks that use them have a strong disincentive to block DoT and require users to speak standard, plaintext DNS to servers they can monitor.

Note however that once it's up and running, DoT is just as centralized as DoH is; it has to be, because it provides the exact same service model. Centralization and competition has nothing to do with their real concerns, or they'd be lobbying against DoT as well.

I can't say I'm especially fond of Firefox's decision to default to Cloud Flare for its DoH resolver, because I loathe Cloud Flare. Google Chrome does something more sensible: it won't change your DNS server at all, but will upgrade you to DoH if your nameservers support DoH. You should use nameservers that do, because DoH is valuable: if you're in the US, your ISP is almost certainly passively monitoring and recording your DNS queries, and you shouldn't let them. Personal feelings about Cloud Flare aside, you are better off with them than with your US ISP's DNS servers.

There's a strain of Unix sysadmin criticism against DoH that says it's wrong for browsers to co-opt DNS resolution at all, and that they should use the system's resolver. This is nonsense. First, almost no matter which browser you use, you should trust their DNS resolution code more than your operating system's; it will be more security-conscious and probably more performance- conscious code --- DNS resolution maintenance is the job you get on Microsoft or Apple's OS teams to punish you when you break the build. More importantly, as anyone who's ever had to mess around with libares will tell you, browsers have always needed better DNS resolution than libc offers, because they need fast async lookups.

There's another strain of criticism against DoH that Unix nerds won't see much of but which is probably even more important to be aware of: there have been hearings in Congress about how DoH threatens law enforcement by depriving them of intelligence for investigations. Ultimately, this is of a kind with the DoT vs. DoH argument: the people lobbying against DoH _simply don 't believe DNS lookups should be private_. Another "tell" that you're reading one of these people is when they start talking about how DNS privacy doesn't provide complete or perfect privacy --- that you shouldn't care if your DNS lookups are being monitored, because you're leaking so much information elsewhere. This is bamboozlement. DoH privacy is extraordinarily low-effort, actually modernizes the DNS protocol in some ways, and addresses a threat millions of users are directly facing right now.

You should be wary of any outlet that promotes the meme that DoH is somehow shady.

<comment><USER12> > crusading against DoH favor a different centralized DNS standard, DoT

I think that there are 2 camps against DoH. 1. Default centralization to specific points. EG firefox using cloudflare first and foremost, nobody else. 2. DoH adding complexity. DoT was (practically) superseeded with DoH anyway, if for nothing more than adoption.

> criticism against DoH that says it's wrong for browsers to co-opt DNS > resolution at all, and that they should use the system's resolver. This is > nonsense.

So... your argument is that I can't trust the OS to 'do the right thing' but I should trust the browser, because they know best? If you can't trust the OS, then how could I possibly trust a browser running on the said, untrusted OS?

Honestly asking how you came to that conclusion because the train of trust is broken on the OS level, so anything above is moot.

> DoH simply don't believe DNS lookups should be private

Problem with DoH is that it _is_ private _up to the endpoint_. Nobody can listen on the request, but nobody is preventing the endpoint from telling everyone else that 'Joe Smith visited Youtube at {timestamp} Once the endpoint has the request, they have your info and can just as easily sell that to telcos.

End-to-End encryption and privacy is only as good as the people on the other side. Can't trust Alice with your message, then don't send it.

> modernizes the DNS protocol

If by modernize you mean convolutes. If I have a resolver on my network serving qwer.localnet. Browser asks cloudflare, returns nxdomain, then my system resolver asks for it; that is _far_ more latency and is far from the modern proper solution for speed and privacy. Cloudflare now knows that I have a local domain, qwer.localnet.

<comment><USER8> With respect to your OS versus your browser, you're using "trust" in a different way than I am. Obviously, you have to "trust" your OS in a strict engineering sense; if the kernel is compromised, nothing the browser can do will meaningfully mitigate that. That's not what I'm talking about. I'm saying I "trust" my browser developer to care more about DNS security than I "trust" my OS vendor, just like I "trust" Chrome's X.509 handling more than I "trust" the certificate validation code that ships on the OS. It's not that I think the OS developers are malicious; quite the opposite. I just believe, with some evidence, that they're not incentivized to adopt modern security mechanisms for those features.

My operating system ships with IPSEC VPN support. I'm not going to use it, even though I think highly of the poor souls tasked with maintaining it for Apple; I use WireGuard instead, because I trust Jason and, more importantly, Jason's incentives, more than I trust Apple. I certainly don't feel like I need _permission_ from my OS (in the form of them formally adopting WireGuard) to do so.

With respect to endpoint security – I assume really what you mean is the security of the resolver server that you use, which can indeed monitor your DNS requests – yes! You do have to trust the DoH server with your requests. You should choose one that you do trust. But because your US ISP is already violating that trust flagrantly, you're almost better off with any off-network DoH server you can find. Really, if you're a stickler, you'll just run your own DoH server. You can't do worse than the status quo ante.

I don't care about the "convolution" argument.

</comment></comment></comment><comment><USER17> The article claims that there is some push towards centralized DNS. I do not see the evidence to support this - the only reason Cloudflare is the default in Firefox is that DoH implementations are still rare. PowerDNS is free to implement DoH themselves if they want their customers to be competitive, and so is every ISP.

<comment><USER18> CF was chosen because they signed a contract with Mozilla to reduce the amount of data they collect to the bare minimum.

<comment><USER19> Can (US) National Security Letters override such contracts?

One nice thing about 'plain' DNS(-over-54; Do53) is that it is distributed in nature, so to get any kind of massive surveillance you have to visit multiple ISPs.

<comment><USER14> > _Can (US) National Security Letters override such contracts?_

Yes, and normal, everyday courts can compel companies to siphon their customers' data and keep it secret that they're doing so, despite any claims that the companies make in their privacy policies.

</comment></comment></comment></comment><comment><USER20> The point presented by the post is plain wrong, people were using non-ISP recursors for a long time already and this was not problem due to the fact that EDNS Client Subnet has been a thing for a while now.

The problem mentioned in the post is specific to Cloudflare, as they do not support EDNS Client Subnet anyway, even over plain UDP53

more reading: [https://www.samknows.com/blog/dns-over-https- performance](https://www.samknows.com/blog/dns-over-https-performance)

<comment><USER21> Mozilla did their own testing of DoH and its effect on performance in conjunction with Akamai:

Test announcement: [https://blog.mozilla.org/futurereleases/2018/11/27/next- step...](https://blog.mozilla.org/futurereleases/2018/11/27/next-steps-in-dns- over-https-testing/) "To do that, we're working with Akamai to help us understand more about the performance impact."

First results: [https://blog.mozilla.org/futurereleases/2019/04/02/dns- over-...](https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https- doh-update-recent-testing-results-and-next-steps/) "The results were strong! Like our previous studies, DoH had minimal impact or clearly improved the total time it takes to get a response from the resolver and fetch a web page."

Final post: [https://blog.mozilla.org/futurereleases/2019/07/31/dns- over-...](https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-https- doh-update-detecting-managed-networks-and-user-choice/) "Furthermore, we found that web pages that are hosted by Akamai–a content distribution network, or "CDN"–have similar performance when DoH is enabled."

<comment><USER22> And nowhere is "TCP" mentioned. I suppose the connection just builds up itself in 0ms time.

Sure if you already have <5ms latency to your DNS, the additional RTT from TCP and TLS won't matter much. For the rest: they will.

<comment><USER23> That's valid, but it's also why HTTP/3 is being pushed for 1-RTT and 0-RTT connections (0-RTT is most likely going to be enabled for their DoH if it isn't already)

[https://blog.cloudflare.com/even-faster-connection- establish...](https://blog.cloudflare.com/even-faster-connection- establishment-with-quic-0-rtt-resumption/)

<comment><USER19> And for that you need TLS tickets/cookies, don't you? (So you can resume your crypto state.) Isn't that a good way to track users?

Instead of a query coming from an IP (probably NATed with IPv4), you can identify individual browsers AFAICT.

<comment><USER24> The DoH server gets to track users if they use a resumption method, yes. As I understand it Firefox puts extra work in to ensure that it doesn't share the backend cache between your HTTPS service and the DNS resolver so there's no risk that if the DNS service and the HTTPS site you're visiting are owned by the same people they can correlate that, but they would be able to see that it's the same browser asking for say, camelporn.example and visit- arabia.example

If you disabled resumption you could get rid of this issue at a cost of one extra round trip per DNS lookup.

Nobody else gets to track users this way (at least in TLS 1.3 and I'd assume DoH implementers will use TLS 1.3 since they are of similar vintage) because the keys aren't re-used so the identifier for the key will just appear to be random noise each time.</comment></comment></comment></comment></comment></comment>


CPU, Display, and Word Processor... In Minecraft - <AUTHOR> http://www.youtube.com/watch?v=jgWyg3LL_kM

<comment><USER2> I wish there was a Minecraft <=> Arduino mod, like mapping Arduino inputs to blocks in Minecraft and blocks to Arduino outputs. Someone needs to make this happen =)</comment>


Create GIFs Using Python - <AUTHOR> https://medium.com/swlh/python-animated-images-6a85b9b68f86 <comment><USER2> I'd suggest using webp over gif. Maybe avif in the future, and APNG is supported in places.

With that in mind, you can still create gifs easily with:

        convert *.png animation.gif # optionally use -delay between pngs, or -loop to limit the number of animations
        ffmpeg -pattern_type glob -i '*.png' out.gif # optionally with -framerate N

Not sure why anyone would do it in python (again, use something else than GIF if possible), but it's cool there is a library for that anyway :)

</comment><comment><USER3> I also found out you can do this with GIMP with layers, I think you name them a specific way and export as GIF and it does it. Also for Linux users, you can record your screen with Peek and turn it into a gif. Not sure if OBS does gifs wouldn't surprise me though.</comment>


Rising riches: 1 in 5 in US reaches affluence - <AUTHOR> http://www.chron.com/news/us/article/Rising-riches-1-in-5-in-US-reaches-affluence-5047261.php?cmpid=usworldhcat#photo-5572420 <comment><USER2> > Because they spend just 60 percent of their before-tax income, often setting > the rest aside for retirement or investing, he says their capacity to spend > more will be important to a U.S. economic recovery.

As a salaried employee at less than $100K, my tax withholding in california was 35%. Spending 60% of your _before_ -tax income doesn't seem to leave much room for any "capacity to spend more".</comment>


9 tricks to appear smart in brainstorming meetings - <AUTHOR> https://techcrunch.com/2016/09/30/9-tricks-to-appear-smart-in-brainstorming-meetings/ <comment><USER2> Wait for someone to make an observation...then qualify that observation.

Colleague: "Were going to need more routes"

You:

"But how many more routes will we need?"

"But what kind of routes will we need"

"Should they be bigger or smaller routes?"

( ͡° ͜ʖ ͡°)</comment>


PySide project future - <AUTHOR> http://www.pyside.org/2011/08/pyside-project-future/ <comment><USER2> This has to make you wonder about the future of Qt itself. With Nokia focusing on Windows Phone where is their need to continue support of Qt? If they were going to continue support for Qt I would think the Python binding would be a very "nice to have" thing and relatively inexpensive.

If they are going to discontinue support I would hope they change the open licensing from LGPL to something closer to BSD as a way to encourage community support.

<comment><USER3> What is the problem with an LGPL library? And what would a BSD library get you over the LGPL one?

<comment><USER2> I can statically link to the library making for a smaller distributable.

<comment><USER4> I don't believe the LGPL forbids static linking of object code licensed under it, though it's been a long time since I read it.</comment></comment></comment></comment>


How Much Do You Pay for Web Apps? - <AUTHOR> http://webworkerdaily.com/2008/10/21/how-much-do-you-pay-for-web-apps/ <comment><USER2> I'm actually surprised by the responses. In my mind, it's always the same few companies making bank off of SaaS apps (like 37signals).

</comment><comment><USER3> $0

</comment><comment><USER4> I pay the 7 bucks / month for github mostly for the private repo's

That's about it

</comment><comment><USER5> $0</comment>


Russian startup to release a smartphone with e-ink display on the back [video] - <AUTHOR> http://news.bbc.co.uk/2/hi/programmes/click_online/9782115.stm <comment><USER2> It seems bbc did not link the company's website: <http://www.yotaphone.com/>

I always wondered why a concept like this never made it to a device -- e-ink displays are pretty incredible with battery life, and my phones usually last quite a long time without the screen turned on. The specs look quite compatible to current-generation top end phones, so it'll be interesting to see this device in action.

I also recall Pixel QI (<http://en.wikipedia.org/wiki/Pixel_Qi>) working on a hybrid e-ink and lcd display, hybrid in the sense that they used current lcd manufacturing technology to have a display operate in two power modes, with and without the backlight on, with different resolutions too, but I haven't seen any of their displays make it to a really main-stream product yet.

<comment><USER3> "my phones usually last quite a long time without the screen turned on."

It's important to remember that this isn't just because the display is off - it's also because the device is in a low power state. Try having an app running with the screen turned off - it also doesn't last too long.

It's be interesting to see what % of the battery usage is due to JUST the screen. If anyone has any stats, please post!

<comment><USER4> In my experience its usually %50 screen %40 network radio and %10 everything else

</comment></comment></comment><comment><USER5> Finally. I've been suggesting this for years. Companies who want to really compete with apple should be trying radical designs. Tragic lack of tinkering on the hardware front.

<comment><USER6> I agree with the tragic lack of tinkering, however, Samsung hasn't had to do anything radical on the design front to print crazy sums of profits successfully competing with Apple. They did of course have to produce great products.

<comment><USER7> Samsung produce great products and spend loads of money in advertising (Just like Apple). You can see the difference with HTC who also produce great phones, but lack on advertising spending. And they have suffered for it.

<comment><USER8> To say that Samsung "spends loads of money in advertising, just like Apple" is a bit stretching the truth, if Horace Dediu's estimations are to be believed:

[http://www.asymco.com/2012/11/29/the-cost-of-selling- galaxie...](http://www.asymco.com/2012/11/29/the-cost-of-selling-galaxies/)

Samsung seems to spend about an order of magnitude (10x) more on advertising than Apple.

</comment></comment></comment></comment><comment><USER9> I would love all my displays to be e-ink, meaning: My 24inch displays for programming, my phones, everything. Android would need to provide an e-ink mode, but that shouldn't be too hard to do. I honestly don't need that much animation or color, so I would be more than fine with switching to it completely. I can still use my old display if I ever really want to do some multimedia use, but for day to day use e-ink should be perfect.

<comment><USER10> Have you ever tried scrolling with an e-ink display? Maybe the absolute latest ones are better but using the kindle web browser on my 2 year old kindle is an unpleasant experience.

<comment><USER11> Just use a pager. I prefer paging to scrolling.

What I'd like is probably something in between. Or one e-ink display and one 'normal'. But the OS would need to be aware that it was dealing with an e-ink display. You'd need to say goodbye to animations/flashing cursors and mouse pointers etc.

<comment><USER12> It's called Pixel-QI

</comment></comment></comment></comment><comment><USER13> The use cases / problems the device solves as mentioned by the CEO are multiple in nature. But I'm not sure which will realistically be the one that gets consumers to buy.

For me a phone with e-ink is amazing because it allows me to read stuff with hurting my eyes. You can also use it in the sunlight.

What does everyone else think?

<comment><USER14> I think it's a brilliant idea - as long as the screen is sufficiently protected. I am on my second Kindle. I'm not particularly rough on gadgets but I travel a lot and even the second one is starting to show a lot of wear whereas my iPhone shows almost none.

<comment><USER2> They say they've got some sort of curved gorilla glass protected thing going on, though I don't understand why they are going for a curved design over a flat piece.

<comment><USER15> Vlad touched on this briefly. It seems to be essentially an "affordance" to encourage the user to put the phone down with the e-ink side facing up. Putting it down on the side that makes it wobble feels less natural than putting it flat-side down.

<comment><USER2> Good point, I didn't seem to catch on it. It seems like an interesting design choice, I seem to always place my venerable droid-x with the screen facing down. Hopefully it is still quite easy to use the phone on a flat surface with the lcd screen facing up.

</comment></comment></comment></comment></comment><comment><USER16> Seems inspired to Popslate, who's crowd-sourced fundraising is still going on on Indiegogo: <http://www.indiegogo.com/popslate>

It reached its target to bring an iPhone 5 case with eink on the back; it received pretty wide coverage (and raised eyebrows) back in late November.

<comment><USER17> In the interview the gentleman says that they have been working in it for two years, and they handle a working phone. I don't know what the lead time is to manufacture a new phone, but the timing indicates to me that they were conceived of independently.

</comment></comment><comment><USER18> Maybe it would also be interesting to have phones with e-ink displays on its sides, for things such as notifications, weather conditions and phone status.

<comment><USER19> The form factor that makes the most sense for notifications is a watch. It's a lot easier to look at a watch than it is to dig out a cell phone.

<comment><USER20> A little watch that I could program with Lua to do pub/sub to my phone events would be great.

<comment><USER21> Not great conversation for a dinner party, but I'd buy one for $100.

</comment></comment></comment></comment><comment><USER22> I wonder what code would look like on an e-ink display. I would like to code outside in the sun.

<comment><USER23> You might want to check out the Kindle hacks that turn e-ink kindles into displays / terminals:

[1] <http://www.turnkeylinux.org/blog/kindle-root>

[2] <http://tinyapps.org/docs/e-ink-monitor.html>

[3] <http://www.ponnuki.net/2012/09/kindleberry-pi>

</comment></comment><comment><USER24> I'd be happy with something small (like the HTC Wildfire S) with just an e-ink screen. Or as the e-ink screen as primary with a tiny OLED for alerts.

</comment><comment><USER25> What content would you like to see on your phone/tablet e-Ink backscreen?

The video shows a weather app as an example. It implies we would leave our phone the e-Ink screen up. I find it interesting because it changes the way we are using our devices today.

<comment><USER26> Most of what I do on a phone could be done with e-ink.

Calling/skype, various messaging apps, podcasts, music, weather, bus app, email, calendar, chess clock. There are some things that wouldn't work (games, video). These are fairly low priority for me. Some things that might sorta work, especially if they were re-made for e-ink (eg maps/navigation apps). These I want on my phone.

An e-ink phone might not be a bad idea if it could carry other advantages too. A $200 smartphone with 3 day batteries that runs 80% of apps might be appealing to a lot of people.

<comment><USER19> A $50 smartphone with e-ink and 7 day batteries might take emerging markets by storm.

<comment><USER27> Well there is a phone with e-ink and 7 day batteries. It's called Motofone F3.

It didn't had much success in Perú. (although I'm an avid fan an ex-user of it)

<http://en.wikipedia.org/wiki/Motorola_Fone>

<comment><USER19> Good information, but this seems to be more of a feature phone with good battery life than a smartphone optimized for the particular use cases of the emerging markets.

Why do you think it hasn't cautious on in Peru. What would catch on there?

<comment><USER27> Well it was basically because it looked 'ugly' with fonts like an old calculator.

The phone had 3 mayor design issues. At least from my POV. First, I couldn't write . in in text messages. I had , @ even £ but alas, no .! Then there was the issue that all sound went increscendo, thing is the message notification was to short for the sound to reach an audible level. And last, as the e-ink only consumes power to paint the screen if you manage to run out of battery You wouldn't realize immediately as the screen was still showing what it showed before running out of power.

I think what would catch is something cheap that seems pretty/expensive.

<comment><USER19> My point exactly. An android handset optimized for time between charges would kill it. The other problems you mentioned are quite fixable.

<http://news.ycombinator.com/item?id=5017643>

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I would love to have one of those! Right now, on the back of my phone, I have a camera and a quick stand; the rest is a waste of space.

<comment><USER28> Have you seen the popSLATE ?

<http://www.popslate.com/>

</comment></comment><comment><USER29> Before I proclaim that I'd love this I only have one question. How much will it cost?

<comment><USER30> In the engadget video [1], they claim it will be priced as a top end android phone.

[1] <http://www.youtube.com/watch?v=mnO0p5XAl9Y>

</comment></comment><comment><USER31> There are YouTube videos: <http://www.youtube.com/results?search_query=yotaphone>

Not excited by this.

<comment><USER21> I'm more excited because its different and bold. If this doesn't excite you at all, what are you waiting for?

<comment><USER31> eBooks are my thing. eInk stopped being exciting quite a while ago.

</comment></comment></comment><comment><USER32> I like it, but I want the screens to be stacked. When you turn of the LCD screen I would like to then be able to view the e-ink display.

</comment><comment><USER33> This is simply brilliant!I would be buying this for sure when it comes out.

</comment><comment><USER34> The ad on the video is quite annoying!</comment>