Facebook Groups Start Showing Exactly Who Saw Each Post - <AUTHOR> http://newsroom.fb.com/News/Update-to-Facebook-Groups-186.aspx

<comment><USER3> Creepy shit. If I want to acknowledge a post, I can already comment on it, or do a passive like. And how exactly does fb decide that something was seen? I might not even have bothered to read the entire message. Is there any way to "unsee" it?

I feel that social contracts and relationships that people have are more complex than what fb models them to be. And leaving these imprints without any control over them is just gonna result in awkward moments.

</comment><comment><USER4> I can't decide if this is good or bad. I don't participate in a lot of FB groups, but I do a lot of politely keeping my mouth shut in other forms of online communication. I think I would feel like I was being put on the spot to say something, particularly in a small group.

A lot of times, I'm not going to lie and agree with that thing someone said, but I also don't want to invest the energy into arguing it with them, either... especially when it's someone who's clearly just looking for accolades and doesn't seem open to criticism.

If the other person knows you saw their message, then there's the potential for them to perceive your lack of response as rude or a show of obvious disagreement.

In huge groups, it wouldn't be an issue, but in smaller, more intimate communities, it could get awkward.

<comment><USER5> I think the social issues will work themselves out pretty quickly once people get used to it. When instant messaging was new, the same discomfort existed.

<comment><USER6> I think there's a huge difference between private messages between two people, and allowing everyone in a group to monitor other's usage.

</comment></comment></comment><comment><USER7> Probably as a way to show visual "engagement" for companies that are on Facebook but don't get a lot of likes. Its more derivative crap. We can call them "seens".

And of course there the creep factor.

I'm having a hard time determining if Facebook is just terrible, low value, and creepy, or I'm just cynical about Facebook. Probably both.

<comment><USER8> This is a feature for groups, not for pages (the way companies generally interact with people who use Facebook). Groups are generally created by people for groups of people that already meet/know each other in person or to discuss a shared interest, not by companies (unless they're company-internal groups, I suppose).

They are for things like for a bowling team in a league or a user group or other ad-hoc group of people who want to communicate with each other - co- ordinate dates and times, send out last-minute updates. The hope, as I understand it, is that it will reduce confusion/anxiety/overcommunication over who hasn't yet read something ("Did Mike read the update that mentioned he is supposed to bring the projector? Should I send him a direct message/phone him?").

Pages already have Insights which gives them aggregate-only demographic data about the audience who has interacted with a particular post ("52/48% female/male, 80% US, ...").

(A Facebook engineer, but not involved in this feature.)

<comment><USER7> Makes sense if you look at it that way, but as a potential consumer of your product every move now looks like Facebook wants to track my actions on the Internet and then tell others about it without my explicit permission.

Zero friction, sure. I'd call it zero consent. Most Internet lay users don't have the mental capacity to understand the legalease of a TOS, so to me saying they agreed to it is thin moral ice to stand on.

</comment></comment></comment><comment><USER9> Seeing something isn't the same as having read and digested it.

I used to have a boss who would send out emails and request read receipts and outlook would automatically send them as soon as I clicked on the item in my Inbox.

I would sometimes get a phone call within seconds of the email arriving asking for my thoughts on it.

</comment><comment><USER10> Wow, this feature and the comment history feature(when editing a comment) make me uncomfortable. They might as well begin showing you who is seeing your profile and how much.

<comment><USER11> They _don't?_ Orkut showed you who has seen your profile (but not in real time).

<comment><USER12> It's one thing Facebook has (always?) been careful not to show. Even with 3rd party apps they'd proxy all content so you couldn't make a "who's viewed my profile" app.

</comment></comment></comment><comment><USER13> Inspired by FuzzyDunlop's subcomment to another participant, I have to ask the direct question: does this help Facebook monetize and gain value for shareholders any more than any of its other features? I'm beginning to think that there really is a market for a PAID service where customers (the people paying for the service) are treated like customers, rather than advertisers being treated like the customers. Some of the friends I most like interacting with on Facebook are looking for a service like that. They are annoyed by Facebook's flailing about looking for ways to monetize.

<comment><USER5> I don't understand the prevalent HN stance that this is a user-hostile feature, which seems to be the source of your question. iMessage and BlackBerry Messenger do the same thing, though users can opt out. People like those products.

<comment><USER7> Blackberry doesn't steal your email address, follow your browsing history on other devices outside your phone, sell your personal data to advertisers, continually change your privacy settings in hopes you won't notice, etc.

<comment><USER8> What makes you say that Facebook will "sell your personal data to advertisers"?

Do you mean that advertisers pay to get information like your name, email address, street location, and other identifiable information about you, like in a huge spreadsheet?

Or do you mean that advertisers can pay money to have their adverts displayed to the sorts of people who most likely will be interested in them but receive no personal data, as explained at <https://www.facebook.com/about/ads/> ?

While I get that some people like to make it sound more dramatic by saying "sell your personal data to advertisers" while understanding how it works, it's also common that people just don't understand.

<comment><USER7> I do understand. Online advertising in a free product is an essential part of the business model where I work. I do understand perfectly the nuance of which you speak because I deal with personally identifiable information everyday.

Where I draw the line is when Facebook goes out of their way to learn about their users as a way to enrich their advertising platform through sneaky means. For instance, every 'Like' button on any web page can track where you go on the internet. While they don't hand this information directly over to their advertisers, its essentially spying without consent and then profiting from it. I consider my browsing history personal data because its mine, not Facebook's.

Would it make you more comfortable to say "they spy on me and then use that information to target me in ways I did not want Facebook's clients to leverage?" This holds especially true since that tracked behavior happens outside of their walled garden.

I say "sell your personal data to advertisers" because colloquially more people understand that and its a recognizable sound bite. But the nuance is there, I deal with it everyday in my job so I understand it, and I think Facebook crosses the line.

<comment><USER8> It seems to me that "sell your personal data to advertisers" sows more confusion through its recognition than clarity. People who hear "sell your personal data to advertisers" without your background tend to believe it literally - money is given to Facebook in exchange for personal information (ie, someone's name and particular data about them).

In terms of the "Like" button and other social plugins, unfortunately there's not all that much to be done about the way the technologies in the web works. Facebook came up with this "widget" that provided way more value to people than the equivalent buttons from Digg, Delicious, and several others, many of which encourage integration that uses resources stored on a central server which could allow tracking even without clicking on them. Many of these widgets need to talk to a server anyway - to provide credibility and popularity by showing how many people have liked the content. However, the "Like" button needs to talk to a server to provide its additional value - <USER2> show you a list of your friends who have also liked this content.

I encourage you to read the Facebook Data Use Policy, especially the section about "Social plugins" under "Other websites applications", and the link through to the Help Center that gives even more information about how that data is and is not used.

</comment></comment></comment></comment></comment></comment><comment><USER14> I hate this. I feel fine lurking in a group I've been added to unless or until I want to engage. This also gives an inappropriate amount of data to the creator of a group, who isn't always the person who is supposed to be armed with that information.

</comment><comment><USER15> In the group context, I think this makes a lot of sense. It is similar to Path (which is basically a "group" limited to my closest friend). For every post I make, it shows me which of my friends saw it, and that is convenient and cool.

I think this could work well for small groups of trusted friends (or shared interest groups). For large scale groups of strangers this could be creepy though. I definitely would hate to see it abused by larger brands, etc (or for this to be integrated into the main news feed for that matter)... which unfortunately at this point I can't say I trust Facebook enough to believe they wouldn't try to push it past that limit

</comment><comment><USER16> Personally, I think this stuff is great. It eliminates a lot of extra communication regarding whether someone has received a piece of information or not.

That said, I wonder at what point is a post considered "seen".

</comment><comment><USER17> Stalker-esq. FB is on a roll of strange product decisions and 1 star apps. Oy.

</comment><comment><USER18> Why are some people so eager to give Facebook the role of dictating social behavior, rather than forcing them to be what they should be, a tool that facilitates our own social desires and expectations?

<comment><USER19> They're fixing a serious error in the way they model conversation. Please explain how this is "dictating social behavior."

People engaged in an in-person conversation _constantly_ and involuntarily give each other verbal and nonverbal cues indicating the receipt (or loss/corruption) of each message. One of the primary gripes against the text- based communication Facebook et al "forced" us to use is the loss of that subconscious channel. Having an unreliable chat system that created the ability to hide behind "oh sorry, I didn't get your message" was one way Facebook corrupted human social interaction. Now they're making it right.

I, for one, _desire_ and _expect_ reliable delivery of my messages to my friends' attention. Do you see a workable solution besides acknowledgments?

<comment><USER18> Text-based conversations _are not_ in-person conversations! Text-based communication has existed for centuries prior to Facebook, and existing social protocols are perfectly capable of handling "seen" notifications. "Sorry, I didn't get your message" and other half-truths are an essential part of human interaction. If you want to know if your friends received a text message, just ask them. Instantaneous "X saw your message" notifications are an intolerable intrusion into private behavior, as they can convey unintended meaning without verifying user intent, _especially_ in multi-party conversations.

Aside from the mangling of social behavior, "seen" is an impossible flag to get right. Maybe someone else was using the PC, maybe the person shut their PC down without looking at their browser window, even though the browser window was focused, etc.

<comment><USER19> >Text-based conversations are not in-person conversations!

My guess is Facebook is wants its messaging system to be farther towards in- person conversation on the scale of information-richness.

>"seen" is an impossible flag to get right

I'll agree with you there, but I think _most_ cases would be handled quite well by setting "seen" iff the user interacts with the Facebook window after the message is displayed. This would handle situations where the browser is in focus but the computer is unoccupied, switching users, shutting down, etc.

</comment></comment></comment></comment><comment><USER20> I think this works in the chat but don't see the use of it in a group. I thought I wouldn't like it when it was announced for the chat but now it's nice to see a "seen" message. This kind of thing is a pressure to engage faster since you know when the other person has read something you sent to them in a one-on-one conversation. Then again, as others have mentioned, how can FB know if I've seen something or not. Surely, we'll have eyeball- following cameras in everything soon.

</comment><comment><USER21> They've already been doing this in chat, I suppose this is a logical extension. That said, is it really necessary to see this or is it a step beyond what is necessary?

<comment><USER22> They're probably running out of things to implement that people want, so are now trying to shoehorn things in that people probably don't want. Probably as a result of new-found shareholder pressure.

<comment><USER5> That's a ridiculous theory.

The biggest barrier to using Facebook as a communication tool is not knowing how often other people check their messages or groups. This feature solves that and will increase the usage of messages and groups.

</comment></comment></comment><comment><USER23> Well that sucks.

</comment><comment><USER24> Too reminiscent of those pesky read email requests. Also, 'Seen by' is not the same thing as 'Really read by'. One reason why I stopped using Messenger (the app and web version)

Favoring the content producer over the consumer won't necessarily lead to less confusion or a better user experience. It's kind of a forced form of social regardless of the group's size.

</comment><comment><USER25> Perhaps version 2 of this will turn on your mike and web cam to record your reaction to the post?

</comment><comment><USER26> .aspx? Did not see that coming.

<comment><USER27> It's no different than a Haskell start-up running their blog on Wordpress or Posterous.

Presumably this site is run by FB's comms department, and could be an off-the- shelf system or developed by an external agency. You don't want to tie up your precious engineers on projects that aren't critical to the mission.

</comment></comment><comment><USER28> Stalking - excellent!

</comment><comment><USER29> where's Facebook going with this, seriously?

I already leave almost every group I'm forced into(cause I can't chose if someone 'invite me' to it), the two I decided to keep I barely ever look and have to change the settings so that shit stops notifying me for stupid shit I'm not interested

Also, I had been aching to silence(unsub) everyone in there because it just feel like a fucking noisy echo chamber with almost nothing that's remotely relevant... So.. I've probably already 'silenced' a big part of them, and then I ended up using a Chrome extension to just hide all that Wall crap out of there, because the chat is the only thing I can take some value of on this site.

But the experience is still pretty bad because I also keep getting notifications for event and game invites I don't want at all and also, for what people post in events I never RSVPed. In fact, I almost never even bother opening the event page. I'm a party dude, but I'll just care about events at the moment I want to go out. I also cannot stop notifications from invites, only for specific people, after I refuse a single invite and then 2 or 3 clicks into it(to stop invites from ONE person)

Facebook, you suck hard and you're going down soon I'm sure. I wish you didn't sucked so much because I'm getting wary I'll have to start untangling my future app from your API sooner than I expected.

<comment><USER8> I'm sorry you are having a bad experience.

It sounds like you have accepted some friend requests from some noisy/energetic people, and/or from people that you perhaps don't really care about. My experience is that unfriending people I don't actually care about (people I've only interacted with a few times a long time ago, for example), making a close friends list (people I care a lot about), and moving the 25%-ish people I care the least about to the acquaintance list has improved my experience a lot.

There are always some unusual cases - a cousin you mostly want to hear things from/about who loves all sorts of games, maybe. For those special cases, you can also control specifically that you don't want to hear from them about games.

I'm not really familiar with problems with events - I get a few event invites a month, and generally they are things I'm interested in going to. How many events are you being invited to? How many different people are involved in inviting you to them?

If you're using Windows, you could also try out the Facebook Messenger app to keep yourself on chat.

(I work at Facebook, but on infrastructure, not products.)</comment></comment>


Show HN: Check if a book on Amazon exists in your O'Reilly subscription - <AUTHOR> https://chrome.google.com/webstore/detail/oh-really/ihbgojffpnkokgcnooefebfidlhhgkak <comment><AUTHOR> If you're employed at a company or a member of a library, you may have an O'Reilly subscription which gives you access to hundreds of books for free. This extension will check if a book you're looking at can be read for free from O'Reilly.

A FireFox version is currently in review.

<comment><USER2> Thanks for making it, it looks useful. I'm waiting for its Firefox version to try it.

<comment><AUTHOR> Thanks for waiting, the FireFox version is here: [https://addons.mozilla.org/en-US/firefox/addon/oh- really/](https://addons.mozilla.org/en-US/firefox/addon/oh-really/)

<comment><USER2> The link is not working.</comment></comment></comment></comment>


Marriott hack hits 500M Starwood guests - <AUTHOR> https://www.bbc.co.uk/news/technology-46401890 <comment><USER2> Marriott's incident page [1] links to a Q&A page [2]. Apparently the forthcoming sorry-we-lost-your-data notifications will come from "firstname.lastname@example.com".

"Let's immediately set up a separate domain name that looks like ours" remains one of the weirdest antipatterns in incident response.

[1] [http://news.marriott.com/2018/11/marriott-announces- starwood...](http://news.marriott.com/2018/11/marriott-announces-starwood- guest-reservation-database-security-incident/)

[2] [https://info.starwoodhotels.com/](https://info.starwoodhotels.com/)

<comment><USER3> Is this to purposefully increase likelihood of getting caught in a spam/phishing filter? So they claim they've reached out while also (probably correctly) claiming it's not their fault if customers didn't get it.

<comment><USER4> Interesting theory. My theory was that there's incident management contractors get this sort of business and don't want to bother integrating with any existing company's infrastructure, so they just set up something entirely different.

<comment><USER5> Probably not so much "don't want to bother" as "can't do it in a timely manner because of the company's internal processes"

Once of the companies I work for has all kinds of crazy domains because the IT department and the Communications Department don't get along the way they should.

</comment></comment></comment></comment><comment><USER6> Is it time for us to simply accept that it's inevitable that, at some point, everything will be hacked, and hacked often?

Should we be focusing our efforts more on how to make "identity theft" (i.e. fraud) more difficult, even _when_ someone knows all your data?

Something more tied to your physical self, whether 2FA or something else?

<comment><USER7> > Is it time for us to simply accept that it's inevitable that, at some point, > everything will be hacked, and hacked often?

I disagree. I'd take the Economists route, which is looking for the incentives that drive motivation. If companies were held to a higher standard of accountability, imagine how many would beef up their security. For decades, security researchers have been poking fun at how ridiculous some of these sites are at handling security, and nothing ever happens.

Now, imagine if there was severe economic accountability to a company that was hacked. Perhaps payouts to each person affected (in this case, to all 150m). I imagine you'd see security become a top priority very quickly at most companies.

<comment><USER8> As a developer, do you really want to live in a world where "security is a top priority" at every company? Does such a world even make economic sense after accounting for the opportunity cost of the time most that developers would otherwise spend actually building new products and features?

While companies could probably do better than they are right now, hacks like this are probably never going to be eliminated. There are too many companies and too many developers for nobody to make mistakes, even when they're being mindful not to. Investing in solutions that assume hacks will happen seems reasonable to me.

<comment><USER9> 'As a car designer, do you really want to live in a world where "safety is a top priority" at every company? Does such a world even make economic sense after accounting for the opportunity cost of the time most that designers would otherwise spend actually building new products and features?'

Most professions and companies are (at least in theory) held accountable for their impacts.

<comment><USER10> No car on the market is as safe as the absence of a car. Car companies make tradeoffs towards safety where it's reasonable and economical, but still fulfill their baseline mission, which is inherently dangerous. People are injured and killed in car crashes every day; car companies are not "held accountable" unless there's a specific defect and they should have known better.

<comment><USER11> Such as a company knowing better than to keep their servers patched, to have a process to make sure their servers are patched, to have a process that shows a list of servers that are _not_ patched, etc.

There are a lot of really stupid mistakes made in a lot of these data disclosures that a competent IT team (and dev team) can prevent from happening. The current state of things is that there are hardly any consequences for losing people's data, just make a bulk purchase of credit monitoring and call it a day. This is cheaper than actually hiring the right people and implementing the correct processes.

</comment></comment></comment></comment></comment></comment><comment><USER12> "We cannot find any evidence that the stolen information has been misused" \- says every company ever, as if that means anything.

I give it 24 hours.

<comment><USER13> The only logical conclusion is the data must have been stolen as an academic exercise.

<comment><USER14> How lucky Marriott is, to have some good Samaritans to stress-test their security without the intention to misuse their user data.

</comment></comment></comment><comment><USER15> Not entirely on topic, but Marriott seems to be dealing with some internal phone abuse issues as well - calls going directly to hotel rooms (bypassing the front desk) and asking for card details to fix broken incidentals records. I got a call like this yesterday and found out that it's enough of an issue that they've printed out signs in the lobby warning guests to not hand out information.

<comment><USER16> That's interesting. I've had a couple of calls like this in the past and have always insisted on going to reception instead of giving details over the phone. Thankfully mine turned out to be genuine.

</comment></comment><comment><USER17> Here's a link to the official Marriott release, FWIW: [http://news.marriott.com/2018/11/marriott-announces- starwood...](http://news.marriott.com/2018/11/marriott-announces-starwood- guest-reservation-database-security-incident/)

</comment><comment><USER18> Note: This has affected Marriott's "Starwood" division.

Starwood's hotel brands include W Hotels, Sheraton, Le Méridien and Four Points by Sheraton. Marriott-branded hotels use a separate reservation system on a different network.

<comment><USER19> Odd. It looks like the intrusion could be the cause of the hurried merge.

[https://www.wsj.com/articles/inside-the-marriott-starwood- lo...](https://www.wsj.com/articles/inside-the-marriott-starwood-loyalty- program-turbulence-1543416010)

According to the article the systems were merged 3 months ago.

"The company resolved one major issue involving elite-night credits earned from credit card spending just last week, more than three months after the integration. That problem left many members in limbo, unsure of how close they were to hitting elite-level thresholds before year's end."

The intrusion was detected on Starwood's system in September according to the BBC article.

"On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database. Marriott quickly engaged leading security experts to help determine what occurred. Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014. Marriott recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it. On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database."

<comment><USER20> This sounds more like Marriott having better monitoring and once the DBs got merged they figured out somebody had been in the Starwood network for four years.

</comment></comment></comment><comment><USER21> As a first rough approximation, this figure includes _everyone on HN_.

It appears to include everyone who's ever stayed in a room at a Marriott, St. Regis, Ritz-Carlton, Bulgari, W Hotel, JW Marriott, The Luxury Collection, Le Meridien, Renaissance, Westin, Tribute Portfolio, Sheraton, Autograph Collection, Design Hotel, Marriott Executive Apartments, Delta Hotels & Resorts, AC Hotels, Element, Gaylord, SpringHill Suites, Courtyard, Residence Inn, Fairfield Inn & Suites, Moxy Hotels, Protea Hotels, TownePlace Suites, Aloft, Four Points by Sheraton, or Marriott Vacation Club property.

For reference, there are under 130M households in the US and around 200M households in the entire EU.

<comment><USER22> What possible reason would Marriot have to have details of my stay from 6 years ago on record, especially on their reservation system.

<comment><USER23> Customer reactivation.

Other marketing activities.

Resale to third parties.

You at any point requested to be added to their mailing list and that's linked to purchase history.

Web analytics linked to purchase history.

Corporate policy is not to delete data.

Laziness.

So there's seven reasons of various legitimacy off the top of my head.

<comment><USER22> Not convinced any of those would pass the GDPR legitimate interests test, especially if I haven't specifically consented to such reasons.

Resale to third parties.

Corporate policy is not to delete data.

Laziness.

especially are great examples of why the GDPR was created, even once we ignore the advertising industry.

</comment></comment></comment></comment><comment><USER24> "It said some records also included encrypted payment card information, but it could not rule out the possibility that the encryption keys had also been stolen."

Oh dear.

<comment><USER25> Can anyone recommend solutions (for those that don't know). On how to have an encrypted database for sensitive information, i.e first name, last name, ip, geo data, etc and the encryption keys not be available to hackers when they have essentially gained root?

<comment><USER26> Have a server responsible solely for decryption and audit access to it. The server doesn't issue keys, it literally does the decryption. AWS KMS can do this for you.

The gist is you create an encryption key for your row, encrypt it using your encryption service, and store it next to your actual payload. To decrypt, ask the service to decrypt the key which you use to decrypt the payload. If your database gets popped, your decryption server hopefully didnt because you hardened it specifically.

</comment></comment></comment><comment><USER27> It's like you need to keep a running diary of every single service you've used / every single place you've been so when something happens like this, maybe you can find out if you actually used that service or visited that place.

I think I stayed at a Starwood 2 years ago in PA? But I don't remember if it was a Starwood or some other Marriott brand.

<comment><USER28> Does it really matter at this point? It's safe to assume all your data has been compromised. Given the state level IRS hacks that have happened in quite a few states, the OPM hack, and the hundreds of business hacks no one is safe anymore. Everyone should operate under the assumption their information is known and do things like freeze their credit and keep an eye out for the data being used.

<comment><USER27> Sure it does. Just because they "apologized" doesn't mean it should be acceptable or dismissable.

These breaches keep happening and these companies continue to be not held accountable or not punished in anyway, except for bad press for 2-3 days until everyone forgets and it's on to the next security breach.

You want me to shop at your store or use your services, you want me to join your mailing list or give you my address, CC and phone # - I expect at the least, for that information to be kept secure.

<comment><USER28> I agree companies should be punished and held accountable. As an aside, how does one go about punishing the government though?

The point I was making is that everyone should assume their data is already compromised. The weakest link will always be an issue, and in many cases it is one you cannot control - the government.

<comment><USER27> Us in the IT field - programmers, sys admins, whatever - yes, we probably should assume our data is insecure because we're in it. We see these breaches here on HN and we know what to expect when they happen.

As everyone always says about these types of things. We are not the target market so to speak.

Joe user doesn't know to read HN and gets their news from the TV IF they happened to be watching when it was covered.

I'm agreeing with you. I know we should know to be careful. But it's still not acceptable.

</comment></comment></comment></comment></comment><comment><USER29> History being a guide, Marriott will obtain a contract with some financial security monitoring service, and offer a ~12 month free period for affected consumers. I've always thought these products are b.s. The advertising is scammy. I'm betting they leak even more data, like your purchase histories.

Does anyone know of the efficacy of these monitoring services? If they were really even slightly more effective than even odds, I would say that consumer protection laws should require free monitoring for a longer period, say 24 months or even 36 months. Ironically though, proper monitoring means sharing all of this same personal information with a 3rd party, and then some.

I also wonder if it's just more effective to take advantage of the free credit report freezing feature, since that doesn't require me to share even more personal information with a 3rd party; and actually restricts access to personal information instead of expanding it.

</comment><comment><USER30> I guess without GDPR there wouldn't have been a push for these companies to notify of breaches so early. We could have found out about it next year.

Also given the potential penalties, probably companies will now start to invest more in proper IT systems.

<comment><USER31> Was that part of GDPR?

I know they have to hold the minimum amount of information needed, and inform you clearly what they know.

But weren't they always required to announce a breach?

<comment><USER32> GDPR has a specific 72 hour time limit on breach announcements: [https://ico.org.uk/for-organisations/guide-to-the-general- da...](https://ico.org.uk/for-organisations/guide-to-the-general-data- protection-regulation-gdpr/personal-data-breaches/)

In this case, they discovered the breach on September 8, 2018, and announced it on 30th November, 2018. That's 1,464 hours, a little bit more than 72.

<comment><USER30> hmm, they say they reported it to the regulatory authorities at the time of the incident. So i guess they are safe on that one.

<comment><USER32> Ah, true. I hadn't internalised that you only have to announce it publically in cases with "a high risk of adversely affecting individuals' rights and freedoms".

</comment></comment></comment></comment></comment><comment><USER33> I recently got added to Starwood Preferred Guest. I still don't know why they have my e-mail (don't seem to have stayed at any of their hotels), but I guess it's out there now, even though it wasn't in HIBP before.

</comment><comment><USER34> If they didn't keep the data from long ago, then the damage would be much smaller. Such companies definitely need some help from lawmakers. Companies shouldn't keep personal information for years.

</comment><comment><USER35> A handful of years ago, Paul Ohm wrote about a concept he called the "Database of Ruin" [0]. I think about it every time one of these pieces of news breaks.

"Once we have created this database, it is unlikely we will ever be able to tear it apart."

[0] [https://hbr.org/2012/08/dont-build-a-database-of- ruin](https://hbr.org/2012/08/dont-build-a-database-of-ruin)

</comment><comment><USER36> >It said an internal investigation found an attacker had been able to access the Starwood network since 2014.

Jebus that seems like a long time before discovering it.

</comment><comment><USER37> >"We deeply regret this incident happened," the company said in a statement.

This is peak non-apology apology.

<comment><USER36> Well I'm sure they regret it... it's very inconvenient for them.

</comment></comment><comment><USER38> ... and ... nothing will happen to Marriott.

</comment><comment><USER14> I just signed in to Marriott.com see what info they have on me that was stolen, and was forced to change my password. It even required email verification, which is good.

Then when I tried to log in with my new password I was rejected, saying my account is 'under audit' for suspicious activity. God dammit.

Is anyone else unable to log in?

</comment><comment><USER39> The New York Attorney General is opening an investigation into a Marriott data breach that may have affected 500 million guests.

[https://twitter.com/NewYorkStateAG/status/106851007239602995...](https://twitter.com/NewYorkStateAG/status/1068510072396029952)

<comment><USER40> I would expect the EU to follow with GDPR shortly, massive fines incoming.

<comment> shawn-butler Great massive fines, significant lawyer billing, some worthless credit monitoring service free for 6 months and screw the affected consumers.

Let's see Target is probably the most obvious parallel: $202 million in reported legal fees and other costs. $18 million to states (fines). $39 million to the financial institutions affected by the breach and a whopping $10 million for the consolidated class action lawsuit (along with the $6.75 million for plaintiffs' attorneys fees and expenses).

Oh wait, Target annual profits are $20 billion? Never mind.

</comment></comment></comment><comment><USER41> Great!

My last stay at a Starwood property was in January 2016 at the Bangkok LeMeridien.

Not that they would bother to set up a call center number for Switzerland.

Do they really expect me to call internationally at my expense to then hang in a loop for an hour or so?

On the plus side: Nothing bad happened since then.

Nevertheless I'm not impressed.

<comment><USER42> I'm thinking - they don't really expect you to call internationally to hang in a loop for an hour or so but they have calculated that a certain number of people will call internationally and hang in that loop whether or not any single individual is highly unlikely to do so.

<comment><USER43> I'm willing to bet that they haven't calculated _anything at all_ and they are scrambling to put out the fire.

<comment><USER44> Remember when Equifax set up a "have I been hacked" site and that site was then immediately hacked?

</comment></comment></comment></comment><comment><USER45> Outside of the privacy problems (which, let's be honest, our data is already out on the web) if you changed your credit card since your last visit you're probably safe on that particular financial attack vector, right?

</comment><comment><USER46> I'm almost certainly in the database.

So I have to get a new passport, get a new phone number, get a new credit card, change my email address... in the US, can I sue in small claims court to recover the costs of doing these things?

<comment><USER47> don't forget to change gender and date of birth as well

</comment></comment><comment><USER48>
        It said some records also included encrypted payment
        card information, but it could not rule out the
        possibility that the encryption keys had also been
        stolen.

Why did the world end up with a pull-system for payments? Why do I have to give out my credit card number and enable the other side to pull arbitrary amounts as often as they like?

This is one of several things crypto currencies got right. You pay by _pushing_ money to the other side.

<comment><USER49> The short answer is that credit cards were invented over 40 years ago, to operate in an offline and indeed paper-based system (hence the embossed digits for use in mechanical duplicators). For a more modern system look at contactless.

FWIW I think the "one shot push" model of cryptocurrencies has some serious limitations which I think should be addressed by an "invoice" system - e.g. you can easily pay the wrong person, or even an address which doesn't exist and is owned by nobody! Not to mention dumb errors such as swapping the payment and tip fields. It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X", and the payer was simply generating an approval of that.

<comment><USER48>
        It would be better if the payee crafted a cryptogram
        for "please pay me (authenticated address) the sum of X"

Are you talking about offline? Because on a website I would expect the payer to simply copy&paste the address.

I would also expect a link type to evolve that browsers understand. Something like "payto:1fs8e...?amount=0.01&coin=btc" to pay 0.01 bitcoin to 1fs8e... Similar to the "mailto:user@host?subject=...&body=..." link type.

An when we talk about offline (paying for a restaurant or something) - isn't there a visual link type already? I am not a user of crypto. But I think I have seen barcodes or something used for this.

<comment><USER50> Something like the `bitcoin:` URI scheme?

      bitcoin:1fs8e...?amount=0.01

[https://github.com/bitcoin/bips/blob/master/bip-0021.mediawi...](https://github.com/bitcoin/bips/blob/master/bip-0021.mediawiki)

</comment></comment></comment></comment><comment><USER51> This was the kick in the pants I needed to finally take the time to freeze my credit. I don't know how much it will help but it can't hurt, I guess.

</comment><comment><USER52> Is anyone else noticing unusual downvotes on this thread? Anyone think it's plausible a Marriot damage control team is participating on this thread?

<comment><USER23> I think it's unlikely that a Marriott "damage control team" cares about comment vote totals on an HN thread.

<comment><USER52> I would usually agree, but near as I can tell the vast majority of the top- level comments in this thread have a negative score and I find that surprising.

<comment><USER53> The most famous damage control team:

[https://en.m.wikipedia.org/wiki/Jackie_(dog)](https://en.m.wikipedia.org/wiki/Jackie_\(dog\))

Never underestimate collective stupidity.

</comment></comment></comment></comment><comment><USER54> How could it affect 500 million? 1 in 16 people worldwide have stayed in a Marriott hotel? That seems like a lot...

<comment><USER23> 500 million reservations from 150 million people/companies/entities.

</comment></comment><comment><USER55> I hope they at least hashed the credit card numbers ( ͡° ͜ʖ ͡°)

<comment><USER56> Wishful thinking, they encrypted them so they could conveniently be recovered.

</comment></comment><comment><USER57> They still don't even use https, so this is not surprising.

</comment><comment><USER58> When you start using Ethereum and web 3.0, the solution to data security becomes quite clear. I'm sure I'm gonna get roasted here for even mentioning this, but you'll all eventually come around.

</comment><comment><USER59> Why on earth would they hold onto passport numbers? The amount of data companies hold onto is ridiculous. It can't all be necessary.

<comment><USER60> In many countries hotels are required by law to keep passport numbers of foreign guests.

In the US there is, apparently, no federal law; however, it is often part of state law: [https://travel.stackexchange.com/questions/76012/laws- requir...](https://travel.stackexchange.com/questions/76012/laws-requiring- identification-at-hotel-check-in)

In many more countries hotels do it despite it not being required; they just do it to assist law enforcement agencies.

And doubtless they like to keep the data themselves as an effective way to track and mine guests across multiple visits.

</comment></comment><comment><USER61> Privacy is dead. Long live... ?

<comment><USER62> Getting constantly hacked from all angles. FB AMZN GOOG AAPL are always listening to us thru devices. Mega corps build systems that leave sensitive data exposed to the public web. I'm curious to see what actually caused this hack. I wonder if they used mongo db with default settings lol.

<comment><USER63> I think the vast majority of these hacks come from some random office working clicking on a doc in an email and opening it up in a microsoft app, on microsoft windows. we've never really blocked that up yet. I don't see it coming because someone hacked the backend of apple, google or amazon. who knows about facebook.

</comment></comment></comment><comment><USER64> I do not envy their ops team.

</comment><comment><USER65> A nice article to read while sitting here in a Marriott.

</comment><comment><USER66> This is going to end so many marriages, it's not even funny.

</comment><comment><USER67> That's quite a lot of gasoline being thrown on the whole train wreck that is the Starwood integration.

<comment><USER68> I wouldnt call it a wreck, probably 80% of members transitioned without any real problem. For some though, its been awful.

</comment></comment><comment><USER52> A breach like this should mean that Marriott should immediately be in bankruptcy, since the potential damage to any individual customer is well above multiple thousands of dollars.

I wish some of these giant companies would see some real consequences for their lax security practices.

</comment><comment><USER69> I find this to be justification in carrying a fake ID and issuing a credit card from my corporate line of credit in that cover name for use when renting hotel rooms.

Every time a private organization demands your government ID to do business, assume that this will happen eventually. Airlines and hotels immediately come to mind, but I am sure there are lots of others. I'm not sure that air travel with a fake ID is viable due to Secure Flight, however. Also, as rental car insurance interfaces (potentially) with a police report/government ID, I am not sure I will rent cars in the future.

When it comes to places you regularly or habitually sleep, this could mean direct physical danger to you, depending on circumstance.

Protect yourself.

<comment><USER45> > When it comes to places you regularly or habitually sleep, this could mean > direct physical danger to you, depending on circumstance.

Sorry, what are you saying here? That the online identity thieves will come to your house?

<comment><USER69> That people looking to extort, blackmail, or kidnap you or your family can now tail you from the hotels you usually/habitually frequent during conferences you consistently attend. It lets them predict your future location so that physical surveillance or ambush can be prepared.

<comment><USER45> I doubt that's going to be the result. I doubt that anyone is in any way that important. It's going to be financial / identity fraud, there's no reason for the thief to ever see your face.

<comment><USER69> Several thousands out of the 500 million that stayed at Starwood properties are indeed that important.

<comment><USER45> Several thousand are so important that one may want to physically stalk them, but not know their home address / travel habits until this particular leak? I doubt it.

<comment><USER69> It is relatively simple to maintain a "home address" in a different place from where you and your children sleep. It is not the case when you stay in a hotel.</comment></comment></comment></comment></comment></comment></comment>


NYC Is Using Oysters to Protect the City from Future Hurricanes - <AUTHOR> https://impact.vice.com/en_us/article/8xav4g/new-york-city-is-using-oysters-to-protect-the-city-from-future-hurricanes <comment><USER2> Related (and very good) read. [https://medium.com/invironment/an-army-of- ocean-farmers-on-t...](https://medium.com/invironment/an-army-of-ocean- farmers-on-the-frontlines-of-the-blue-green-economic-revolution-d5ae171285a3)

<comment><USER3> I remember reading about this awhile ago and thinking it was awesome. Has there been any follow-up? Are these style of farms growing?

</comment></comment><comment><USER4> Also related, artificial oyster reefs as coastal protection in the Netherlands: [https://www.ecoshape.org/en/projects/oyster- reefs/](https://www.ecoshape.org/en/projects/oyster-reefs/)</comment>


Bitbucket down - <AUTHOR> http://bitbucket.org

<comment><AUTHOR> Status page - [http://status.bitbucket.org](http://status.bitbucket.org)

<comment><USER2> I don't want to be pedantic, but what was your thought-flow when you submitted this to HN? I mean, sure Bitbucket isn't down that often but is it really thusly news-worthy that your first reaction and instinct is to post a thread about it on HN?

<comment><USER3> I tried to push commits and the command hung. Then I went to isitup.org and the connection hung. So I went to downforeveryoneorjustme.com and found that both isitup.org and bitbucket.org were down.

Great. Let's go to HN to find the "Bitbucket is down" thread just to make sure. There are now three threads on bitbucket.org being down so I think it might be the tinyist bit news worthy.</comment></comment></comment>


Google is now funding numerous Tea Party groups - <AUTHOR> http://www.deathandtaxesmag.com/210909/google-is-now-funding-numerous-tea-party-groups/

<comment><USER2> "Larry Page publicly stated at Google's I/O conference this year that he wants to start his own country."

You know it's serious journalism when they take something that was already overblown by the actual media and rehash it. Also, when he says, "if I can speculate further," and proceeds to talk about "steal[ing] the content that greases their ad machines," as well as "their quasi-religious effort to more quickly bring about technological singularity," ending in an unclever and sarcastic comment.

This is an inflammatory piece of junk with an alarming lack of facts (and abundance of pathos appeals and weasel words) to back up any of the claims. Political criticism is fine, but this is just blasphemy pretending to be news.

<comment><USER3> Inflammatory piece of junk is putting it nicely

</comment></comment><comment><USER4> Nothing really new here. 42%+ of Google's PAC donations in the last 5 years have been to Republican organizations.

[http://www.politico.com/news/stories/0911/64005_Page2.html](http://www.politico.com/news/stories/0911/64005_Page2.html)

Tea Party groups are definitely on the far right of some of those PACs, but as long as any of those groups' interests align with Google, of course they'd donate.

</comment><comment><USER5> Google becoming political is indeed a concerning thing, but this article is absurdly biased.</comment>


Introduction to HTML Components - <AUTHOR> http://blog.mecheye.net/2017/08/introduction-to-html-components/ <comment><USER2> Personally, I think there's an important lesson here, and its the same lesson that polymer is learning as it stumbles around trying to convince people to use it.

Most people don't actually derive much benefit from writing custom UI widget primitives.

Certainly, that's a useful thing for a UI toolkit builder to be able to do, but tangibly, for most people, it's not actually useful.

I don't have time to invest hours implementing `ImageDropDownSpinner` as a custom element. <select> is good enough for me, and heck, maybe I'll use some 3rd party widget if I need something special.

That's not why react, vue, angular, etc. are winning the mind share of 'how to build web apps'; building UI widget is far less interesting than the ability to decompose your UI into a custom hierarchy of re-usable self contained units of functionality, that only at the _lowest level_ actually involve UI components, is extremely powerful.

They might look like custom widgets, but <PageFoo> isn't a UI widget, it's your entire application; that's the difference.

It's easy to say this was a revolutionary idea, before its time, and it would have flown today instead of vanished into obscurity... but I think it missed the mark; it didn't solve problems people were actually having.

...but to be fair, it's easy to look at 'Web Component' efforts (like Polymer...) and go... yeah, this seems very familiar...

<comment><USER3> I think that people that disregard Polymer fail to understand that Web Components are already here.

They are fully supported on Chrome and Safari, and hopefully Firefox and EDGE will eventually catch up with them.

And they have to, because Chrome and Safari own the mobile web.

Polymer is transitioning to being a thin layer on top of what the browsers support, which basically means a Polyfill for Firefox and Edge, and utility classes to make writing components easier.

Web Components is what is making me finally get to love web development again.

If it is to make an application platform out of browsers, then give me a platform, not an application for doing hypertext documents that we try to bend for something else.

Chrome settings panel, the new You Tube, all new EA gaming portals are already using Web Components.

I look forward to have something like Blend for Web Components.

[https://www.youtube.com/watch?v=otcmcNY-3pk&t=17s](https://www.youtube.com/watch?v=otcmcNY-3pk&t=17s)

EDIT: fixed a few grammar issues

<comment><USER4> > I think that people that disregard Polymer fail to understand that Web > Components are already here.

No. Polymer is here. As Rob Dodson said, "Polymer is the jQuery of WebComponents".

No one in their right mind would even think about writing and using WebComponents in vanilla JS.

Hence we're coming back to the problem with WebComponents: they are a solution in search of a problem.

<comment><USER3> Angular and React also have plans to eventually move into Web Components.

<comment><USER5> This isn't true [https://facebook.github.io/react/docs/web- components.html](https://facebook.github.io/react/docs/web-components.html)

<comment><USER4> It's partly true, see [https://custom-elements-everywhere.com](https://custom- elements-everywhere.com) and linked issues.

The main problem: when the framework makes the developer decide whether to pass attributes or properties to Custom Elements, it's mostly ok. The framework should also allow binding any events (which cna be named as onEvent, or on-event or...)

Frameworks that are trying to be clever and hide the complexities of DOM behind proper APIs, and that implement their own event systems suffer greatly because DOM APIs and WebComponent APIs are a pile of steaming crap.

<comment><USER6> The site you linked to is about frameworks 'playing well with' custom elements. It says nothing to the assertion about React moving to web components.

Also it is not helpful to call standards 'a pile of steaming crap' without backing that up with something substantive, examples/alternatives etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Nice; I used these "back in the day" while at Google to implement the illusion of native SVG support in Internet Explorer 6-8; I used hidden Flash for the rendering and Microsoft Behaviors wrapping it all so that the fake SVG would look like it was part of the DOM for full JS scripting. Fun times. Check it out here: [https://github.com/BradNeuberg/svgweb](https://github.com/BradNeuberg/svgweb)

</comment><comment><USER8> "Why did IE5's HTML Components never quite catch on? Despite what you might think, it's not because of a lack of open standards"

Actually thats precisely why it never caught on. Source: I was front end developer at one of the big dotcoms ca 2000.

Also, its remarkable how many people skimmed this article, and didn't understand that the first part was from 1999. That really says a lot about people's expectations when it comes to Microsoft and web technology.

</comment><comment><USER9> I am not sure it is not a coincidence that the same idea keeps resurfacing. I remember reading pretty early on that HTML/XML/XHTML would eventually lead to a world where "chemists would have their own tags to represent chemical formulas" and similarly each discipline would develop their own tag language. Browsers would just know how to render them!

People have tried to materialize this idea in multiple ways over time - HTC, microformats, web components etc. It should not be surprising that the solutions are similar. This isn't to say the first implementation was the best, and the others have just forgotten history. I am sure there are some pretty senior web developers around who remember their history, and were even part of it. If anything we should be optimistic that the new implementations have learned from the mistakes of the past.

<comment><USER10> > Browsers would just know how to render them!

They wouldn't "just know," there were supposed to be DTDs published that would tell the browser how to render that specific kind of markup.

<comment><USER11> I guess the rendering of custom XML documents was more supposed to be controlled by CSS via the processing instruction <?xml-stylesheet type="text/css" href="styles.css"?>. It's a little known fact that this was actually working in Mozilla/Firefox all this time, but not anymore I suspect.

</comment></comment></comment><comment><USER12> I remember discovering these in the mid-2000s, and thinking along the same lines as the author: why hadn't they caught on and been standardised like XMLHttpRequest, etc. had been?

I think the reality is, Microsoft introduced these technologies at the tail- end of initial "dot com boom". Shortly afterward, most of the companies who might have built ambitious web apps using them went bust. Microsoft stopped investing in IE, and for quite a while afterwards, web development regressed to people building document and brochure-style sites. People were too busy trying to figure out complex CSS, and what `hasLayout` meant in IE to build component-based apps.

A few years later, web development crept out of the doldrums: JavaScript's reputation began to be rehabilitated, the term "AJAX" was coined, and companies like Google began building more ambitious web apps. But by now Firefox was the browser of choice for most developers, and had gained enough market share that you couldn't build IE-specific sites.

Mozilla teamed up with Opera and Apple, and later Google, to create what became HTML5, and that included reverse engineering and standardising a number of proprietary IE APIs. However, they chose to ignore element behaviours. Presumably because they had their own component technology, XBL, and wanted to make _that_ the basis of web apps. And, since element behaviours never made it into Firefox, developers never started using them.

My guess is, had Firefox adopted them, they'd now be a standard part of the web platform, and we wouldn't have web components as they currently stand. There are a lot of similar "what ifs" in the history of the web. For example, what if Microsoft had adopted XBL? What if flexbox and grid had been implemented in early 2000s when they were originally designed, instead of fifteen years later? What if ES4 had been accepted and implemented? What if Cassowary had been built into CSS when it was proposed, instead of being ignored (and later used by Apple as the basis for auto layout)?

<comment><USER11> XBL 2.0 was doing well on the standard track and would have made that happen [1], but it died along with all the other technologies whose acronym starts with an X. Flexbox was by the way implemented in Mozilla back then, I used it all the time in XUL, but then that acronym also starts with an X [2].

[1] [https://www.w3.org/TR/xbl](https://www.w3.org/TR/xbl)

[2] [https://developer.mozilla.org/en- US/docs/Mozilla/Tech/XUL](https://developer.mozilla.org/en- US/docs/Mozilla/Tech/XUL)

</comment></comment><comment><USER13> As far I remember that time, I would say IE Components didn't succeeded, because at that time server side rendering was far more popular. I personally was doing sites in PHP and tried to avoid JS at all costs. Strange that today I'm doing exactly opposite.

<comment><USER14> And even stranger that with concerns about battery life; we should now be moving back towards server side rendering.

<comment><USER15> Unfortunately there's no real downside to eating people's battery. 99.9% of people just aren't going to know why, just that their battery dies faster.

</comment></comment></comment><comment><USER16> I think Web Components will have/already had the same fate.

To paraphrase the meme: "Stop trying to get Web Components/Polymer to happen. They aren't gonna happen".

At least not in this version of them. It's like XHTML that went about for years before it was taken out of its misery.

We needed something like Web Components for a long time -- but the current implementation is exactly how it should not have been done.

React/JSX got the good parts of it, and added even more useful things. If we could add the missing parts on top of that (like encapsulation from the external DOM), it would be perfect, and the rest of their horrible API/design can vanish.

<comment><USER17> It's happening, slowly: [https://platform-status.mozilla.org/#shadow- dom](https://platform-status.mozilla.org/#shadow-dom)

And "XHTML experience" is now built in to browsers, no developer effort needed (implementation consistency, the ACID tests, strict mode for JS, and WASM for speed)

And see also [http://ishoudinireadyyet.com/](http://ishoudinireadyyet.com/)

<comment><USER16> > _It 's happening, slowly_

That's browser adoption. XHTML was also adopted by all browsers.

I'm talking about developer adoption.

</comment></comment></comment><comment><USER18> A great early site back in the DHTML/component days where IE4 was really pushing things was WebFX [1]. This was back when IE was actually a good browser as Netscape was fading due to DHTML/early AJAX (which was the XMLHttpRequest object originally from Exchange Server). DHTML at the time was mostly easier in IE because it didn't draw a new DOM for each layer i.e. document.layers (Netscape) each layer was a new full DOM and document.all (IE) was one DOM.

[1] [http://webfx.eae.net/](http://webfx.eae.net/)

</comment><comment><USER19> This goes into the bucket of scary, poorly thought out features that makes the web hard to secure. It's just like expression(), in that it allows code within a style take to result in script injection. CSS, due it's weird parsing behavior (data is not quoted, so it's hard to determine whether a token is data or code without a full CSS parse) is very hard to escape, and it's common to let user defined variables into CSS. Stuff like this is a nightmare for developers concerned about locking down their apps. And to the best of my knowledge, there's no way to disable it.

Fortunately, like expression, it's gone now in newer browsers, but this was not a proud moment for web security.

</comment><comment><USER20> > "Why did IE5's HTML Components never quite catch on?"

because technology per se is just one of the variables that matter. For example, you are missing things like "timing", "marketing strategy" and a whole lot of other things. =)

</comment><comment><USER21> creating apps in html is like creating a spreadsheet in word.

why didn't we stick to xml and use a language to transform it into ui.

<comment><USER3> I was a big fan of XHTML and all related XML Components, but then politics won.

<comment><USER22> If you call web browser vendors mutinying against the W3C who was pushing XHTML 2 down their throats "politics", which lead to Apple, Mozilla and Opera creating the Web Hypertext Application Technology Working Group (WHATWG) and to HTML5--then I'm okay with the politics.

Yeah, I could close my tags and validate my code with the best of them back when XHTML was a thing--but that's no way to live. I'm glad WHATWG stepped in and literally saved the web from itself. OMG! XHTML 2 would have sucked so much!

<comment><USER11> The way I remember it, there was a guy called Hixie something that was in charge of standards implementation at Mozilla and made a terrific job at that. But then he got hired by Opera and saw that there was no point in competing with Gecko and so he started a FUD campaign called "XHTML considered harmful" to lower market standards. He bluffed you into believing that namespaces are far too complicated for the human mind to comprehend, when in reality XHTML hadn't caught on because the CMS systems were not up to date. He did a terrific job at that, so he got hired by Google to publish a competing specification that was actually based on the way that Internet Explorer 6 parses HTML4. He did at terrific job at that, so we are finally back where we started, with a standard that lives forever while IE6 is long gone, and Goggle can scavenge the specifications from this forgotten future for ideas they can present as original. Even Mozilla played along with the HTML5 scheme, it was like watching a nuclear superpower go down in a fist fight. How can you not call that politics?

</comment></comment></comment></comment><comment><USER23> I'm slightly confused by the combination of "introduced in Internet Explorer 5.5" and "offers a powerful new way" being written in an article posted on August 28, 2017

<comment><USER24> FTA: _cough OK, obviously it's 2017 and Internet Explorer 5.5 isn't relevant anymore. But if you're a Web developer, this should have given you some pause for thought. The modern Web Components pillars: Templates, Custom Elements, Shadow DOM, and Imports, were all features originally in IE5, released in 1999._

<comment><USER25> It was a truly great release.

<comment><USER26> haha, it really was too, no hint of sarcasm! Young'uns these days probably can't believe what a saviour Microsoft from the clusterfudge that Navigator represented back then.

.

Typed on Firefox :)

<comment><USER25> Oh no, I agree. IE got its bad reputation due to neglect, not because it originally wasn't good.

It just wasn't good enough to last 10 years without updates

</comment></comment></comment></comment></comment><comment><USER27> Polymer will ditch 'html-import'(which is similar to the HTML component) as it is not widely implemented on browsers and such.

Polymer 3 will switch to ES6-loader and npm, probably one year away?

I spent quite some hours with Polymer, but finally give up for now, one reason is that I want Polymer 3 today, but it is not there yet, also big companies tends to make its stack for big players(look at Angular2).

I will use Vue.js for new projects at the moment, I read somewhere saying, Vue.js could be the next modern jQuery, and I kind of agree.

</comment><comment><USER28> I think the main problem with IE technology was the way Microsoft pushed it down our throats. The tech wasn't necessarily bad, but when the giant corporation pushes new features while not respecting/implementing the existing standards very few people support their efforts.

So as a result 96% hated the IE and the other 4% were using other browsers. No wonder nobody wanted to use the newest Microsoft only features.

<comment><USER29> I was young in 1999 so not very experienced with technology but I really doubt people were hating on Microsoft back then. Sure, every company will have a hate camp but I doubt it was as spread as it was in the past few years.

<comment><USER28> Actually, it was much worse back then. Nowadays Apple Macs are affordable and alternative PC operating systems are quite usable too. In 1999 there was a usable but limited/old Win 95 and Win 98 which was crashing on a daily basis. So you can imagine how frustarating it was to work with such a machine.

Furthermore, microsoft was fighting open source software which didn't make them more popular: [https://en.wikipedia.org/wiki/Halloween_documents](https://en.wikipedia.org/wiki/Halloween_documents)

Compared to those times the data collection on modern Win 10 systems and forced updates are small sins ;-)

</comment></comment></comment><comment><USER30> I used HTC a lot and waited for the other browsers to implement it. XBL came around but waited many years until it became web components. Great post!

<comment><USER31> All this talk of HTCs reminds me of HTAs: HTML Applications.

[https://msdn.microsoft.com/en- us/library/bb250409(v=vs.85).a...](https://msdn.microsoft.com/en- us/library/bb250409\(v=vs.85\).aspx)

They behaved like a native app, with control over their native chrome, and without any browser sandboxing: their JavaScript (JScript) or VBScript could use COM components to access to the file-system and other features, including loading other binaries in-process. File-system access was through Scripting.FileSystemObject, for example.

Some built-in Windows components were/are built as HTAs, like the previous versions of the Microsoft AntiMalware / Windows Defender UI.

I tried to use it for a project in 2013 but couldn't because HTAs are forced to run in Quirks-mode, so you can't use IE11's Edge mode, unfortunately.

Best of all: they ran while needing only a few megabytes of RAM. Compare with Electron-based apps and it makes me weep because this, right here, is evidence that a Web-View can be used as the basis for an application, using a platform that was available since 1998/1999, without it dragging my PC down.

<comment><USER32> You can still do this, and in OSX too using MacGap (or writing a tiny webview wrapper yourself). The main reasons this is not widely done are incomplete device APIs, no control over browser versions/features - app might break at any moment for different subsets of users, and the lack of cross-platform compatibility. Electron actually solves most of those pain points despite the heft.

<comment><USER31> Does the Cocoa WebView expose any kind of non-sandboxed COM-like API for system access? That was what made HTAs so useful.

</comment></comment></comment></comment><comment><USER33> These were widely used for at least one thing in practice: adding support for :hover pseudoclass on arbitrary elements (not just <a>) in IE6. [https://peterned.home.xs4all.nl/csshover.html](https://peterned.home.xs4all.nl/csshover.html)

</comment><comment><USER34> Chronological snobbery? [https://en.m.wikipedia.org/wiki/Chronological_snobbery](https://en.m.wikipedia.org/wiki/Chronological_snobbery)

</comment><comment><USER35> Wow, reading this is like a blast from 2004. DHTML? JScript, the propriety IE javascript dialect?

All without the marketshare of the time, thankfully.</comment>


All Roads Lead from Prague - <AUTHOR> https://www.the-american-interest.com/2020/06/13/all-roads-lead-from-prague/ <comment><USER2> The subhead: _A new book by Michael Gordin shows how 16 months in Prague formed a young Albert Einstein—and the shape of science, politics, and intellectual history to come._

</comment><comment><USER3> What I dont understand is that so many of the world's great intellectuals lived in beautiful cities and towns. University towns often are really pretty with quaint buildings both in Europe and the East Coast.

Then how did SV manage to do well? Butt ugly warehouses and suburban office buildings.

<comment><USER4> Other than Stanford, I don't think that SV really has educational institutions as its driving force.

<comment><USER5> A lot of amazing research and startups come out of UC Berkeley, and while they are on the fringe of the Bay Area and arguably outside of it UC Santa Cruz and UC Davis do very interesting research in bio chemistry and materials

<comment><USER4> I wouldn't consider Santa Cruz to be part of SV and definitely not Davis. There are plenty of significant educational institutions in the Bay Area and even more if you expand the net to Northern California, but SV's prominence is driven more by the location there of early tech companies than any educational drivers outside of Stanford (although Stanford is very important).

<comment><USER5> I disagree, I think education is one of the foundational pieces of what created SV and helps maintain is tech ecosystem. There was something that got those early tech companies to be here in the first place and I don't think it was just luck.

My opinion is that there are 3 main drivers and that top tier education is one of the most important ones.

They go like this:

Higher education that has enough gravity to aggregates diverse 'cutting edge' people from a variety of pursuits.

A reason for those smart people to stay that isn't just money. I think that's lifestyle and access to nature. You have the ocean, mountains, wine country, and relatively good weather.

The last is capital, I think saying companies is putting the cart before the horse. When I say capital I don't just mean startup capital. The ecosystem has to also have liquidity. There are lots of areas that have one of the 3, but very few that have all of them.

</comment></comment></comment></comment></comment><comment><USER6> German University of Prague.

If you can read German or know how to use Google translate [https://de.m.wikipedia.org/wiki/Deutsche_Universit%C3%A4t_Pr...](https://de.m.wikipedia.org/wiki/Deutsche_Universit%C3%A4t_Prag)

Insigniestreit.... Czechoslovakia, "victim" of ww2...

<comment><USER7> What is the meaning of this comment and "victim"? Was not Czechoslovakia victim of Nazis?

<comment><USER6> If you translate from the German wiki and from the history of this German University in Prague before ww2, the "raid" might not have been so random, greedy and unjustified as history books might want you to believe. But such comments are not welcome on HK</comment></comment></comment>


EduClan – Cloud LMS Builder and SAAS Provider - <AUTHOR> https://educlan.com <comment><AUTHOR> Hi,

I am the founder of EduClan. I am looking for Feedback on my newly upgraded SAAS.

EduClan offers cloud based e-learning LMS for your Schools, College, Private Institute or Single or Group based Author to launch their own E-Learning LMS portal in 3 clicks without worrying about Hosting or Technical aspects.

Let us know, what do you think?

Thanks</comment>


Just a Techie? – Techies, Devs, Boffins and Geeks - <AUTHOR> https://juxt.pro/blog/posts/dev-not-just-a-dev.html <comment><USER2> Very short article (which I like) and some great points that have been occupying my thought process lately.

Every other day our local newspapers mention the word "techy" to describe someone work in IT, he could be a product manager or an operations manager in facilities, just because he is in Silicon Valley of India.

The agile example is great. We enforced something which works for assembly line where things are repetitive and we know how much time it takes exactly to assemble two parts of a car. Software Development is could not be more different than this. We want iterative development yet we need to have fixed deadline.

We don't trust the developer, we hire a scrum master who in most cases just moves stories in Jira if a developer forgets to do it religiously. In that process, we (read middle management ) are happy to have stories in "done" section but have a problem with "in progress" section tough later is likely to have higher quality. Because earlier one looks good on paper.

I have seen when scrum master/co-ordinators / middle managers when getting a tech-related question from other teams or execs, they loop the engineers saying "rookie question".Really just say "I don't know anything about engineering that my team does"

Also the "IC track" for engineers? Seriously if someone works in teams that is engineering teams. Why should they be called "Individual contributor"?

IMHO, if engineers were little more disciplined we did not need middle managers or these dedicated agile coaches, scrum masters who neither has any tech skill nor has any vision, unlike the leadership / executives.

<comment><USER3> The scrum masters feel 100% like a scam to me. The "work" they do is a complete joke - they basically have a couple of rigid scripted behaviours that could be performed by a bot or an intern - ask people about tickets' statuses, ask if a ticket cannot be split into smaller ones, ask people to do estimates, ask if X can help Y on task Z etc (all these questions are so basic that in general any experienced dev has already asked them themselves in their heads before coming to a standup). Also, from what I'm seeing, they "work" maybe for 1-2 hours a day. The only redeeming factor is that they usually make way less than a senior dev (at least here in Europe).

I suspect Scrum Masters will be completely purged out of the industry in the next 10-20 years, as the execs realise they provide negative value (sadly, they'll probably be replaced by some other fad role, and the same people who are scrum masters now will just retrain into that fad).

<comment><USER2> The dedicated Scrum Masters I think already started to be diminishing, in my last two jobs usually one of the engineers (not too senior or junior but should be able to communicate well) is asked to take that role along with his usual 8 story point a week coding responsibility.

But unfortunately in this case above scripted behaviour is being shown by middle management (Engineering manager with not much coding background ). This is because they are mostly under fire if there is a "Spill Over" . The engineer playing scrum master role can easily get away with it because the probably did their part in the coding front and just threaten to step down from the role. But managers don't add much to anything else in the delivery process, so they are forced to be accountable for everything. (C'mmon we all know appraisals are also pretty much scripted) .

</comment></comment></comment><comment><USER4> One of the reasons developers will never garner even 1/3 of the respect of a surgeon is that our mistakes can almost always be fixed. If a surgeon makes a mistake, that can ruin a person's life or even end it. We have so much wealth that we can afford to devalue programmers and put up with bad code, but there's yet to be an affordable way to completely reverse a severed spinal cord for even the richest.

</comment><comment><USER5> > There's a destructive pattern inside of Agile software development of > squashing individualism. Devs can't be trusted to work solo, so pair them > up. Devs can't be trusted to think holistically about the problem at hand, > so each 'story' needs to be written child-like. We demand TDD, a convoluted > code-review and branch process, and antipatterns such as 'the big ball of > mud' terrify us, so we must insist on nano-sized microservices to promote > code shared ownership and polyglot diversity, so that each service can be > rewritten at any time in any language, and no single developer can possibly > ever become a bottleneck.

</comment><comment><USER6> If "techies" assume as much personal liability as surgeons, then they may deserve seen in the like.

Where are the malpractice suites for person info leaks of infrastructure downtime?

<comment><USER7> A better analogy would be if the Lion Air crash resulted from a software defect in the new design.

</comment></comment><comment><USER8> "It's not simply the insidious dehumanisation and the patronising that bothers me - which to be fair, is a human condition - rather it's the attempted commoditisation of what is a highly specialised trade. When you trivialise a trade, you make the trades-people interchangeable."

This pushback has been going on since the very earliest days of the attempts to professionalise software development. Here's Nathan Ensmenger in "The Computer Boys Take Over":

"In response to this perceived challenge to their authority, managers developed a number of interrelated responses intended to restore them to their proper role in the organizational hierarchy. The first was to define programming as an activity, and by definition programmers as professionals, in such a way as to assign it and them a subordinate role as mere technicians or service staff workers. As the sociologists Haroun Jamous and Bernard Peloille argued in their groundbreaking study of the organizational politics of professional development, this technique of reducing the contributions of competing groups to the merely technical is a time-honored strategy for defending occupational and professional boundaries. We have already seen some of the ways in which the rhetoric of management literature reinforced the notion that computer specialists were self-interested, narrow technicians rather than future-minded, bottom-line-oriented good corporate citizens. "People close to the machine can also lose perspective," maintained one computer programming "textbook" for managers. "Some of the most enthusiastic have an unfortunate knack of behaving as if the computer were a toy. The term 'addictive' comes to mind.""

</comment><comment><USER9> I think our society tends to offer respect and status to others for some specific (mostly superficial) reasons, and developers usually don't meet the criteria. I can think of a few different cases of this:

1\. I feel society respects people with authority over others and most developers have none. Most of us are just implementing someone else's high level idea (granted, a great idea implemented poorly can be useless, so good developers are very important in fact. It just isn't clear to an outsider as to why).

2\. We also respect others who have great social skills, but the word "coder" or "developer" tends to conjure up an image of some guy sitting behind a computer screen by himself for hours on end (if you knew nothing about what a software developer really does). Some devs will have good social skills, some will not, but I would imagine the average developer job does not necessarily require it.

3\. The stakes matter. If a developer screws up, you revert the change or fix the bug and most of the time the worst case scenario is that the company lost some money (with some exceptions like those who work on self driving cars or autopilot). Doctors are dealing with peoples lives. Law enforcement, firefighters and military risk their own lives for others. Lawyers and high level executives at larger companies work in positions where the economic stakes are often high, not just occasionally.

4\. We respect those who are at the top of their respective field. With software development, there is nothing that those at the top of the field are displaying to the public that differentiates them from anyone else in the field (that the average non developer can understand, anyway). This is very clear if you're an athlete or professional musician.

I would say that software developers as a group are usually fairly intelligent people with respect to technology. I think referring to someone as a "techie" does not make an assumption that someone isn't knowledgable about the domain of tech, but may come embedded with an assumption of lower status (with respect to the points I mentioned above).

As a developer myself, I do sometimes regret my choice given the low status that this job carries (at least in North America - perhaps in other parts of the world this is different) in spite of the fact I get paid fairly well. On the other hand, I enjoy writing code and solving difficult technical problems, so if I just forget about what people I don't know think about me, then the job is great. Hard to beat a comfortable, high paying job where I get to work on interesting problems and mostly get to avoid the annoying political battles that are often ongoing in large orgs.

</comment><comment><USER10> Beancounters, suits and normies are the ones calling us techies. There is really no need to get upset about the labeling. Most of the time I see techies looking down on other departments at least as much as they look down on us.

<comment><USER2> Like "techies" look down upon testers?

<comment><USER10> Testers are techies I would assume.

</comment></comment></comment><comment><USER11> x100. Let's stop using the inactive words "developer" or "engineer" to describe people.

Instead say things like we need to get some people to "build it" or "make it work" or "figure out what is the best". It is how managers obliterate their workers and claim all credit.

I like to use the word "human" in these cases to emphasize what is going on. "We need three developers" vs "We need three humans". The latter emphasizes how ridiculous and dehumanizing it is (unless you are a contractor and paid up front).

Managers are basically just schedulers at best. A good leader is someone who actually risks their time, reputation or capital.

Management structure would be fine if they were literally given a pot of money that they could pay themselves or contractors with and required to build something. Anything else involving employees kind of results in dehumanizing power structures once the size of the team gets big enough.</comment>


An interview with Chuck Peddle (in memoriam) - <AUTHOR> https://theamphour.com/241-an-interview-with-chuck-peddle-re-air/ <comment><AUTHOR> Excellent interview with Chuck Peddle, originally aired in 2015 by The Amp Hour podcast. He was a true legend behind the personal computer, and unfortunately passed away last December [1][2].

From Wikipedia [3]: " _Charles Peddle (Nov 25, 1937 – Dec 15, 2019) was an American electrical engineer best known as the main designer of the MOS Technology 6502 microprocessor, the KIM-1 single-board computer, and its successor, the Commodore PET personal computer, both based on the 6502._ "

[1] [https://www.nytimes.com/2019/12/24/technology/chuck- peddle-d...](https://www.nytimes.com/2019/12/24/technology/chuck-peddle- dead.html)

[2] [https://wdc65xx.com/in-memoriam-of-chuck-peddle/](https://wdc65xx.com/in- memoriam-of-chuck-peddle/)

[3] [https://en.wikipedia.org/wiki/Chuck_Peddle](https://en.wikipedia.org/wiki/Chuck_Peddle)</comment>


The Primitives of Elixir Concurrency: A Full Example - <AUTHOR> https://www.poeticoding.com/the-primitives-of-elixir-concurrency-full-example <comment><AUTHOR> In this article we see how to use `spawn`, `send` and `receive` to make multiple concurrent HTTP requests, merging the results in a single one. Then we see how to refactor our code with `Task`, which makes everything easier.

The most passionate will find a small challenge at the end.</comment>


Would It Be Selfish to Register Calzone.Pizza? - <AUTHOR> http://www.circleid.com/posts/20140226_would_it_be_selfish_to_register_calzonepizza/

<comment><AUTHOR> Article discusses whether there are business and ethical issues of registering domain names solely to prevent others from using it</comment>


You must use Internet Explorer at work: visual proof from Google Analytics - <AUTHOR> http://clemesha.posterous.com/you-must-use-internet-explorer-at-work-visual

<comment><USER2> My website (whirlpool.net.au) sees IE6 account for 2.3% of traffic on weekdays and 0.9% on weekends.

Combining all versions of internet explorer together, the figures are 28% and 23%, respectively.

The only browser with a greater-than-expected boost on the weekend is Safari, but only by a very small margin compared to the increase seen by Firefox and Chrome.

All figures from GA.

<comment><USER3> Track.com gets 33% IE, only 13% of which is 6.0 (so about 4% total), 22% 7.0, 64% 8.0, and just under 1% 9.0. And most of our customers are financial institutions, who I wouldn't expect to be on the cutting edge.

We actually get more people using Opera Mini (presumably Blackberry users) than we do IE6 users.

</comment></comment><comment><USER4> This is why no sane commercial site can drop support for IE6. The people left using it largely have no choice.

<comment><USER5> But is it really IE6? The site doesn't break it down by browser version, so it could be 7 or 8, which have relatively better standards support.

<comment><USER4> I'm not at liberty to share our GA data right now, but we see it for IE 6 especially. IE 6 is about 5% of our total traffic and it looks like the vast majority are people at work.

<comment><USER6> Hmm, that seems to imply that IE6 is finally going away.

Unfortunately we have to wait for ie 9 to get access to the nice stuff.

<comment><USER4> It is, but slowly. Are you willing to turn away 5% of your customers?

<comment><USER7> Are they customers?

One site I'm aware of asked a somewhat different question. They mapped the browsers of the visitors that were buying and how much each bought, and found a completely different answer.

Though the site saw a higher percentage of IE than what was discussed here, the data showed the IE users weren't their customers. FF, Opera, Chrome and Safari all bought more and bought bigger than IE.

<comment><USER4> For us, every user who visits the site is a customer, since we make money from ads.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Or it could be that there's a lot of not-very computer/Internet savvy people using the application during the week, and that their browser of choice is IE.

</comment><comment><USER9> What is the scale? These graphs are useless without magnitude.</comment>


Serenity: x86 Unix-like operating system for IBM PC-compatibles - <AUTHOR> https://github.com/awesomekling/serenity <comment><USER2> Hey guys, I'm the author of this project. Surprising to see it on HN but life is surprising sometimes!

I actually made a little demo video about this system just yesterday if you'd like to see it running: [https://www.youtube.com/watch?v=hE52D-zbX3g](https://www.youtube.com/watch?v=hE52D-zbX3g)

<comment><USER3> Can I share some observations? There are a few things I really love about this:

\- You kept the end user in mind: You. The GUI looks like a mashup, in a good way: A Mac OS menu bar, Windows GUI feel and a NextSTEP launcher on top of a Unix like system. It shows that for every element, instead of simply recreating whatever system you decided to emulate, you took the parts you liked best from whatever system and simply recreated that. I haven't looked at the code too thoroughly, but I can probably find the same mindset there.

\- You kept the scope tight. It's easy to lose sight of the bare minimum MVP, especially when working on a hobby project. The functionality showcased here tells me that whenever you started implementation of a feature, you built exactly what you needed, nothing less, nothing more.

\- You also didn't get bogged down with premature optimizations. Yes, the PNG renderer is slow. But it does the bare minimum it's supposed to.

But most of all, this takes a crazy amount of time, skills and dedication. You've probably encountered quite some frustrating moments you had to chew through, but now you're here, presenting your work. And it's awesome!

<comment><USER2> Thank you for these observations, you've just distilled my personal programming philosophy into three concise points!

If you looked at the code, you would indeed find a similar "take what you like and leave the rest" style mashup. I spent many years working on WebKit, so you find a lot of WebKit-style patterns, containers and templates. I also spent some years working on Qt, so there's a huge bit of that in the GUI library. :)

<comment><USER4> But you rewrote it all from scratch in a "clean room" so as to not incur any license issues ;)

</comment></comment></comment></comment><comment><USER5> The README here is a model (or perhaps a superfluity) of modesty. This person has, apparently, written a complete OS from the metal up to a usable GUI, single-handed, AND done it in about 6 months -- at least, the oldest commit in the Kernel branch is October 2018. Well, I'm impressed, anyway.

<comment><USER6> Modesty in the comments too :)

[https://github.com/awesomekling/serenity/blob/master/Kernel/...](https://github.com/awesomekling/serenity/blob/master/Kernel/kmalloc.cpp#L1-L4)

/* * Really really _really_ Q&D malloc() and free() implementations * just to get going. Don't ever let anyone see this shit. :^) */

<comment><USER7> Sorry, what is "Q&D?"

<comment><USER8> Quick and dirty

</comment></comment></comment></comment><comment><USER9> This is excellent. I was expecting to see a screenshot of a command prompt and was pleasantly surprised to see GUI and applications.

"the goal here is a marriage between the aesthetic of late-1990s productivity software and the power-user accessibility of late-2000s *nix" That sounds right up my alley. Will give this a try!

</comment><comment><USER10> I remember when home computing was full of neat hobby OSs. It was fun. Then somewhere around the last 20 years everyone stopped writing kernels and just built Linux distros instead (and these days you don't even see that much variety in Linux any more either).

Anyhow, this project looks really inspiring. At least from a quick cursory glance. Looking forward to digging a little deeper tonight.

<comment><USER11> > (and these days you don't even see that much variety in Linux any more > either)

I beg to differ! While I do see that there are a a handful of very popular distros, there are tons more out there!

Spend a few minutes poking around DistroWatch[0] and see if you don't agree.

0\. [https://distrowatch.com/](https://distrowatch.com/)

<comment><USER10> I'm not on about quantity of distros, I'm on about _variety_. A thousand Ubuntu derivatives doesn't add much variation. systemd hasn't helped much here either because there used to be a lot of variety in how distro's would implement sysv. There even used to be distros that rolled their own file system hierarchy.

Some might see the grand unification a good thing for interoperability and developers - and I don't disagree with them. But it was fun looking at the different ways different distros would solve the same problem. Whereas now the biggest difference between a lot of distros is a great deal more superficial.

<comment><USER11> I agree that the majority of distros are based on debian/ubuntu/fedora but there are still some significantly different ones out there. The most interesting/useful of these for me lately has been void linux[0]. It is based around runit (instead of systemd) and has a very nice native package manager as well.

0\. [https://voidlinux.org/](https://voidlinux.org/)

<comment><USER10> I'm not saying there isn't still some distinct ones out there. I'm saying in there is less variety than there used to be.

 _variety_ is the key description I used. Sure there are few outliers still but the rest are just systemd + (apt|rpm) and there this really the same as what Linux was like 20 years ago where even Debian and Redhat were distinctly different from one another. Even Arch has come into the fold somewhat over the years.

</comment></comment></comment></comment></comment><comment><USER12> Having worked on the Windows kernel team, I can say this impressive stuff. It seems early enough to pick a specialty for this OS that it could do well that others may not.

</comment><comment><USER13> The author has discussed his system for months in 4chan.

<comment><USER14> what board/generals?

<comment><USER15> The /g/ daily programming threads.

</comment></comment></comment><comment><USER16> It appears to be extremely bare bone. For example the TCP socket is like UDP with hard coded IP addresses. It won't handle any packet reordering or lost packets.

I haven't checked other parts, but if they are like that it would be more a very elaborate demo than something actually usable.

Still impressive even for a demo.

<comment><USER2> Your observations are of course accurate: many parts of the system are indeed quite bare-bones. I've been trying to bring up a huge number of subsystems in parallel by building enough of the scaffolding and infrastructure in each area for a larger system to grow around.

Now for the rest of my life, I will always have something to hack on. :)

<comment><USER17> > Now for the rest of my life, I will always have something to hack on. :)

This is such an inspiring and humbling sentiment!

Thank you for all your hard work on this impressive project.

<comment><USER18> Totally agree. Hat off.

</comment></comment></comment></comment><comment><USER19> This seems pretty incredible as a learning resource just as it is. I can't quite believe how much is here and how concise it seems - has anyone gotten it to run?

I really hope the author or someone else writes sone high level documentation! Just knowing the design decisions would be great!

<comment><USER2> Thanks. The design is mostly "discovered" through iteration. I tried making a few diagrams at one point but in a week they were already outdated, so I've given up on trying to document until things slow down.

</comment></comment><comment><USER20> Also of note, it appears to be a mostly (if not entirely) C++ codebase.

<comment><USER21> That's too bad. Needs more HolyC! (Rust would also do, in a pinch.)

</comment></comment><comment><USER4> Very awesome. Love that it's a new take on a modern OS - including a GUI. I didn't think I'd see even an entrant into that sphere from a non-corporate entity again.

</comment><comment><USER22> Respect! This is a very impressive achievement for a single person and requires a lot of knowledge about operating systems.

</comment><comment><USER23> If, like other people said, this was done in merely 6 months by a single person, let me bring some skepticism into the thread here. From writing a bootloader up to a functional UI with various functional user programs is not a 6-months job, unless you take many shortcuts.

<comment><USER24> I've seen it done (multiple times).

I worked for a set top box manufacturer where the lead engineer wrote an OS and a GUI system, from scratch, for our platform in less than a year. It had a bunch of syscall personalities. One for vxworks so we could port stuff from our existing platform and one for Linux so that people could write drivers for it based on the O'Reilly Linux device drivers book (which was current at the time). It also had a couple of others for odd things that we needed. It was _incredibly_ well written. It only took me a couple of weeks to port it to PowerPC and the first week of that was just phaffing getting my cross compiler working properly.

In contrast, we had another couple of programmers trying to write a web browser for that platform. After a year they had something that could render primitive web pages but there was still a good chunk of the web that didn't work "quite right". After two years they were still in a similar position.

Operating systems are a dark art, and the person who wrote Serenity is very talented, but OSes are, at least, a tractable and well defined problem.

</comment></comment><comment><USER25> Serenity Now!

<comment><USER26> Insanity later

</comment></comment><comment><USER27> Are there any pre-built distributions I can just plug into QEMU?

<comment><USER2> Here's what I can offer right now: unpack this in serenity/Kernel/ and then run "./run" in the same directory. Or just start QEMU manually with qemu- system-i386 -kernel kernel -hda _fs_contents

[https://drive.google.com/file/d/1954ki8wzHT6axoj9vbFKj8XxFK5...](https://drive.google.com/file/d/1954ki8wzHT6axoj9vbFKj8XxFK5DdE4z/view)

<comment><USER27> sweet, thanks!

and it works! Boots in like .1 seconds. Very neat.

One strange thing, in QEMU, the mouse is all crazy and I can't control it in a usable way. Jumps around.

<comment><USER2> That's weird! Maybe it's some confusion between the PS/2 mouse and the PS/2 keyboard both using the same I/O port.. Does it help if you give it a little keyboard input before the mouse input? What OS are you running QEMU on?

<comment><USER27> I tried giving some keyboard input before using the mouse, no change. I am using Debian Stretch. If there is a more appropriate venue where you'd prefer continue this conversation, let me know.

</comment></comment></comment></comment></comment><comment><USER28> This would be quite an accomplishment for one person in six months.

I am skeptical.

</comment><comment><USER29> Weird title. Made me think this was for the original IBM PC and its clones but it seems to require at least a 686 (Pentium Pro). By that time the term IBM PC compatibles was already obsolete.

<comment> DC-3 This person has made their own fully fledged OS. Discuss that instead of bikeshedding about terminology.

<comment><USER30> That would be nitpicking not bikeshedding :)

(They do have a point though; IBM PC compatible implies it would run on an IBM PC...)

<comment> DC-3 It's a form of bikeshedding, in that it involves discussing the superficial details that are easy to form an opinion about.

<comment><USER31> Oh my God they're literally bike shedding bike shedding.

<comment> DC-3 I'm obviously gunning for inclusion in webshit weekly :-)</comment></comment></comment></comment></comment></comment>