Extreme surveillance' becomes UK law with barely a whimper - <AUTHOR> https://www.theguardian.com/world/2016/nov/19/extreme-surveillance-becomes-uk-law-with-barely-a-whimper <comment><USER2> Surveillance train has left the station, can't be stopped any more. It's just too cheap to use cameras, wireless and large HDDs. AI can sift through videos efficiently.

So, the only way back to balance is to do government surveillance, and more generally, to have a multi-way surveillance society in which a single actor doesn't have monopoly. We have to go all the way now, short of destroying all surveillance equipment everywhere and making sure nobody recreates it, which, given incentives, it's impossible to enforce.

The main problem now is balance of power, not if we like surveillance or not. This new power must not be put only in the hands of an elite. By the same doctrine of "separation of powers", we should not concentrate all surveillance power in a single point, because it lacks checks and balances.

<comment><USER3> This act is more about telecommunications data than CCTV cameras.

Something that really bothered me is Shami Chakrabarti, previously head of Liberty and a strong supporter of human rights, now shadow Attorney General, abstained from voting.

<comment><USER4> "They" probably have dirt on him

The thing about living in a surveillance society is how good people can be silenced via blackmail.

<comment><USER5> I don't really buy this paranoid viewpoint. If "they" were trying to use information from surveillance to blackmail people into doing what "they" wanted, considering the scale of these programs I find it hard to believe that they would not have tripped over someone who is either functionally unblackmailable or who is willing to take the hit for the greater good. Furthermore, at some point it becomes very difficult to _not_ trace leaks of such information back to government surveillance programs and entities, so every execution of a blackmail threat poses a serious risk to the blackmailers It works against key people when used occasionally, but it can't be used at scale without someone figuring out what is going on.

</comment></comment></comment></comment><comment><USER3> As one example: the act requires ISPs to log _every IP connection_ that their customers make, for a period of one year.

There's a PDF factsheet on this provision, and a full list of other provisions on Wikipedia.

[https://www.gov.uk/government/uploads/system/uploads/attachm...](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473745/Factsheet- Internet_Connection_Records.pdf)

[https://en.wikipedia.org/wiki/Investigatory_Powers_Act](https://en.wikipedia.org/wiki/Investigatory_Powers_Act)

<comment><USER6> > require communication service providers (CSPs) to retain UK internet users' > "Internet connection records" – which websites were visited but not the > particular pages and not the full browsing history – for one year

In what world is a serial list of IP connections that a customer made not a "browsing history"?

<comment><USER3> Presumably, it's not required to record "particular pages" because

\- It sounds reassuring

\- It's not possible to record, for instance when someone accesses secure sites (the majority of time and pages)

\- It's not necessary, since the a server's logs can easily be cross- referenced to the TCP connection logs

\- It's not necessary, since _plenty_ of insight results from knowing who, when, how much, for how long and how often everyone communicates with everyone else.

</comment></comment></comment><comment><USER7> It's odd that the usual hysteria by media, academics, assorted human rights organizations and concerned citizens about surveillance has been 'toned down' since the Snowden revelations.

It's nearly guaranteed there would be an earthquake of hysteria and frothing about totalitarianism and human rights were the revelations not about western countries. There is nearly zero activism about surveillance apart from the odd EFF press release.

It telling about the things we are supposed to care about, and the level of manipulation in local and global affairs over the last few decades and how countries are run. It seems like all societies we too want to think the worst of others and make excuses for ourselves. But that kind of posturing by our media, human rights orgs and reps is now going to become impossible to pull off with any credibility.

<comment><USER8> Groups like Liberty and the ORG have been campaigning against this for as long as it's been an issue, but if no-one in the mass media is interested in reporting it, there is only so much they can do. It hasn't even made the "back pages" of the BBC News web site much in recent months, as far as I've seen, nor been mentioned on any mainstream TV news broadcast that I've seen.

I'm confused about the current status of the bill. The linked Guardian article says it received royal assent, thus becoming law, on Thursday. However, as I write this, Parliament's own web site[1] says it is still in the "ping pong" stage.

[1] [http://services.parliament.uk/bills/2015-16/investigatorypow...](http://services.parliament.uk/bills/2015-16/investigatorypowers.html)

<comment><USER9> Now says "This article was amended on 19 November 2016. The act has not yet received royal assent, as stated in an earlier version." at the bottom.

<comment><USER10> Classic Grauniad

</comment></comment></comment></comment><comment><USER11> Spending my day off upgrading router to dd-wrt, installing openvpn in an country that is less friendly to this shit, hardening all my personal machines and encrypting everything I can encrypt (most of which I should frankly have done ages ago but I got lazy).

This was pretty much the straw that broke the camels back for me, I've nothing to hide but fuck them for doing this anyway (and everything they've done before).

<comment><USER12> You may be aware of this already, but for anyone thinking along similar lines... make sure your VPN client guards against DNS leaks. Using a VPN does not automatically mean your DNS traffic is obfuscated, it's necessary to configure the VPN so that your ISP does not see your DNS traffic.

[https://www.bestvpn.com/blog/5184/4-ways-to-prevent-a-dns- le...](https://www.bestvpn.com/blog/5184/4-ways-to-prevent-a-dns-leak-when- using-vpn/)

[https://www.dnsleaktest.com/what-is-a-dns- leak.html](https://www.dnsleaktest.com/what-is-a-dns-leak.html)

</comment></comment><comment><USER13> You could argue that this is another unfortunate consequence of brexit. Theresa May is now prime minister, which she wouldn't be if it wasn't for brexit.

The only thing we can do now, as developers and creators, is to create simple and easy tools, softwares, systems for the general public that make this kind of surveillance difficult or impossible. We need to work together to conserve and expand what little privacy we have left.

<comment><USER3> Technical methods are part of a response, but shouldn't be the only part.

We can also write to our MPs and lords, support organizations like ORG and Liberty who may challenge this law in court, and educate less-technical friends, relatives and colleagues.

</comment></comment><comment><USER14> Years ago most people believed they were being watched by God 24/7\. Now we're being watched by AIs 24/7 and everything is recorded forever

<comment><USER15> Do you have evidence for the first claim?

<comment><USER16> It's a play on a quote from Deus Ex.

<comment><USER15> Oh, fair enough

Still, I would be particularly interested in anything exploring the extent to which people did or did not actually believe their 'official' faith throughout time.

</comment></comment></comment></comment><comment><USER17> This government seems determined to destroy the internet in the UK: [https://www.theguardian.com/culture/2016/nov/19/pornography-...](https://www.theguardian.com/culture/2016/nov/19/pornography- sites-face-uk-block-under-enhanced-age-controls)</comment>


Microsoft: The Early Days (2000) - <AUTHOR> http://www.memecentral.com/mylife.htm <comment><USER2> This was a good read, but now the colors are all messed up. Nothing looks normal after looking at that green background for so long...

<comment><USER3> Holy Crap. That is what happened. I read it and then went to look up Multiplan and everything seemed pink. I was a little worried.

</comment></comment><comment><USER4> Still committed to Microsoft after all those years:

<meta name="Generator" content="Microsoft Word 12">

</comment><comment><USER5> Why did this guy have that super green background??!!! Everything is pink =(.

<comment><USER6> [https://outline.com/6jZFjf](https://outline.com/6jZFjf)

</comment></comment><comment><USER7> "Meme Central, (C) 1996"

oh my god. what a visionary.

<comment><USER8> Hah, "memetics" had been a thing for a long time by then. Easy to forget that Dawkins coined the term way back in 1976.

</comment></comment><comment><USER9> When the father of a friend retired and cleaned out his office, I ended up with Multiplan manual. It's kind of funny, because I have never used Multiplan or even seen it run, and these days I find myself swearing at Microsoft for _not_ providing decent manuals (or any manuals at all) for many of their products. And one day, I might even read that thing, just because I can. ;-)

</comment><comment><USER10> You can remove the green background with the Basic Formatting chrome extension and make this (and other unstyled sites) easier to read.

[https://chrome.google.com/webstore/detail/basic- formatting/a...](https://chrome.google.com/webstore/detail/basic- formatting/afeafeendipkcblhmnpmaloflafkodei)

Shameless self plug here :)

<comment><USER11> Or just open the dev tools and remove the bgcolor attribute from the body tag?

Pretty simple.

</comment></comment><comment><USER12> > My mission: write the world's first wordprocessor with a spreadsheet user- > interface.

Can somebody elaborate on this?

<comment><USER13> Yes! Well, sort of, but a little backstory... Yesterday, I believe, there was an article posted here called, "Perhaps it is simpler to say that Intel…was disrupted". It was written by Steven Sinofsky (who I wasn't familiar with) but had a look at his Medium posts. There was an interesting article there titled, "Design for an "Audience of One" ([https://medium.learningbyshipping.com/audience-of- one-107bad...](https://medium.learningbyshipping.com/audience-of- one-107baddbe38f))

Funny enough, there is a quote in there, "Did you know that a spreadsheet is a much better word processor than a word processor? After all, a word processor is just a spreadsheet with one cell."

That design for an audience of one was a great read. It may not answer all your questions but I think it will at least point you in the right direction of what he is talking about.

Btw, Steven Sinofsky is the former president of the windows division at M$.

<comment><USER14> Sinofsky also took the blame for Microsoft's Mexican stand-off culture when he was fired, though I think it was mainly billg and Balmer's fault.

<comment><USER15> If anecdotes are to be believed, Sinofsky wasn't exactly an unwilling participant either, though. Reportedly, he had no problems with squashing or grabbing control of projects that infringed on Windows' turf.

<comment><USER14> Oh, he was definitely complicit. But he unjustly takes the fall for it all when it was a wider MS problem.</comment></comment></comment></comment></comment>


European Central Bank head argues in favor of global governance - <AUTHOR> http://blogs.forbes.com/face-to-face/2010/04/29/ecb-president-favors-global-governance/

<comment><USER2> The Basil II regulatory monoculture had more than a little to do with the global nature of the Great Recession, so let's make financial regulation even more uniform and global!

</comment><comment><USER3> Yeah, cause the Eurozone is working out so well.

<comment><USER2> Yes, that points out the regulatory enforcement issue of this proposal. Eurozone countries are supposed to have much smaller annual deficits (3.6%?) than Greece has (or probably ever had in the relevant period). The ECB and company knew what was happening but turned a blind eye to it.</comment></comment>


Krush Founder Gina Ashe, After Horrific Car Crash, Has New Lease on Startup Life - <AUTHOR> http://www.xconomy.com/boston/2010/12/17/krush-founder-gina-ashe-survivor-of-horrific-car-crash-has-new-lease-on-startup-life/

<comment><USER2> Startups are hard enough without life-altering and life-threatening car accidents just before you launch.

My hat's off to her for sticking with it. And to her team for sticking with her.

</comment><comment><USER3> Nitpick: a Cadillac CTS hardly has a "huge engine up front." In a head-on 85MPH crash (closing speed would make this similar to hitting a parked car at ~125MPH), what likely saved her was a lot of luck and wearing a seatbelt.

<comment><USER4> The engine is a big block of hard metal, not what you want between you and another car in a head on crash anyway.

What the CTS does have that you do want in a head on is a nice long bonnet. This provides a nice big crumple zone in front with which to reduce the amount of g-force on the driver and passengers.

</comment></comment><comment><USER5> point of the story: drive a f __ __ __big car/truck, not a prius

and thank god she's alive & sad about other people dying</comment>


Predictions for Crypto Market - <AUTHOR> https://medium.com/@mkogan4/four-predictions-for-crypto-five-years-out-40dacc80ed7e <comment><USER2> For 2nd point, "Bitcoin will wither", I do not see in your post the reasonable explanation on that. In my opinion BTC will still be there, simply its first and foremost crypto currency in the world, never underestimate the pioneer. BTC is potential to become world's store of value asset due to its big value and solely usage of bitcoin blockchain( to serve BTC transfer transaction only). Ethereum and other cryptos can be useful for other purposes due to its blockchain flexibility(smart contract and other technology to build dapps on top of the blockchain), but its also the flaw because noone wants to use those blockchains to build end-user platform with billion transactions if those crypto currencies value is too high (that implies high fee when running transaction on blockchain). But lets imagine, with 1BTC = 1M$, you can easily make 1B$ transaction with very low fee in compare to using bank system instead, and the receiver can get that amount of money in the same day (in this case I do not count on bitcoin blockchain scalability project like Lightning network to make your transaction happen instantly ). After all, future has room for all of us.

<comment><AUTHOR> The idea is that it will be supplanted by other crypto. It's happening already, if you look at btc % of crypto market cap</comment></comment>


The Graveyard of the Elites - <AUTHOR> http://www.truthdig.com/report/print/the_graveyard_of_the_elites_20160228 <comment><USER2> Essentially correct but so many facile lines come out of french theory ("signifies nothing") although the anti-politics label is good.

Also it is dangerous to underestimate the flexibility of "the system." Because it hasn't tried to "buy off" the masses since 1978 or so, it may be able to do so at low cost.

<comment><AUTHOR> Is it dangerous if one seeks to co-opt/exploit the 'flexibility of "the system."'? I'd say that is the biggest weakness and engaging in such is much cheaper than pandering to the masses while many actors in "the system" will applaud/work with/schmooze such for their efforts… hence the seeds of destruction are always been sown within.</comment></comment>


The Vermont Sail Freight Project - <AUTHOR> http://www.kickstarter.com/projects/1746378042/the-vermont-sail-freight-project

<comment><USER3> I'm not sure to what extent this will be able to sail under wind power. They mention they will go through canals, which are too narrow to tack against a headwind. Back in the heyday of canals, sail power was not used much - <USER2> would usually be towed by animals walking alongside the canal. If they're aiming for renewable (as opposed to just plain archaic), solar panels and / or a wind turbine (e.g. [1]) would be significantly superior.

[1] <https://en.wikipedia.org/wiki/Blackbird_(land_yacht)>

<comment><USER4> I was wondering the same thing. In my merchant marine cadet days I've taken a ship (steam) up the Hudson from the Atlantic to Albany and it's quite a twisty river, sometimes with tall, steep, wind-blocking banks. Assuming they're planning to transit the Hudson, it will be an interesting trip.

However, I _love_ stuff like this and if I'm convinced that they can pull it off, I will contribute what I can.

Now I'm wondering how many acres of soybeans it would take to power the barge by biodiesel.

</comment></comment><comment><USER5> Vermont has quite an obsession with food and local stuff. In Burlington I went to a food place where mostly every ingredient was local, and the waitress not see the irony of that in a MEXICAN restaurant...

<comment><USER6> Please tell me what the irony is. I can see how it might superficially seem ironic if one didn't understand the reasons why people might want to buy locally-sourced food, but surely you appreciate that "food prepared in the style of some other place" and "food that was grown locally" are in no way exclusive.

<comment><USER7> I read it as the circumstance being ironic in that Mexico is much further south and one might not expect to find so many ingredients native to that area also to be sourced locally in Vermont.

I guess the "irony" might be found in having to be in Vermont, of all places, to find locally sourced Mexican cuisine. I don't know whether that is really "ironic", in that there is a significant movement for locally sourced food in Mexico, as well. (In which case, one might better describe the Vermont experience as "surprising", rather than "ironic". Meaning, it's not ironic because you _can_ find locally sourced Mexican cuisine in Mexico, as well.)

For those wanting to revisit the meaning of ironic, one exercise might be to run the lyrics of Alanis Morrisette's song through your head:

<http://www.azlyrics.com/lyrics/alanismorissette/ironic.html>

<comment><USER8> That song is not the best example, as analyzed in excruciating detail here (warning, 1990s CSS ahead): <http://fgk.hanau.net/articles/ironic.html>

<comment><USER7> Well, I hesitated a bit when typing my comment. And I chose the words "one exercise" (of multiple possible exercises) with some deliberation.

But, it's a well-known work, and I thought it would be at least acceptably on the mark.

I'll have a look at your link when I have a few more brain cells free for contemplation. I did skim it, and at that level I found myself not fully agreeing with the author on the specific points my skimming happened to capture.

As for the '90's CSS warning, appreciated. But, from my viewpoint, far better to have '90's CSS, than '10's "everything loads via Javascript" BS... ;-)

Isn't it ironic...

</comment></comment></comment></comment></comment><comment><USER9> I hope this works, but I'm a little nervous.

I don't know what the law is like in the US, but in Australia a new commercial vessel has to have its plans approved by a survey authority before construction can even begin. I couldn't find word that had been done, apart from "extensive research into regulations".

If there was a lot of maritime expertise on the team, I'd expect them to be announcing it on the Kickstarter. Buried in a page on his blog[1], it mentions that he has help from a pair of boatbuilders.

It wouldn't be the first time a professional woodworker has decided to build a boat[2], and it wouldn't be the first time that it's worked. I hope they know what they're doing.

[1]: <http://vermontsailfreightproject.wordpress.com/about/> [2]: <http://en.wikipedia.org/wiki/Notorious_(ship)>

</comment><comment><USER10> Large cargo ships are phenomenally efficient. The efficiency of sea freight has more than doubled since the 1970s and is now in excess of 6 ton/km per MJ - more than fifteen times the efficiency of road freight.

Large ships have two key advantages. The first is drag, which increases approximately in proportion to the square root of displacement. The bigger the ship, the less energy it needs per tonne of freight. Large vessels can use extremely clean and efficient engines, with complex heat-recovery systems and exhaust particulate filtering. They run on bunker fuel, which consists of the densest and least valuable fractions of crude oil.

A standard 20-foot container is 30m^3 in volume and normally carries a maximum of 14 tonnes. The queens of the ocean, the eight Maersk E-class vessels, each carry 11,000 containers with a crew of just 13. Maersk have placed orders for twenty triple-E class ships, which will be a quarter of a mile long, carry 18,000 containers and be 37% more efficient than the E-class.

If sail is the long-term answer to sea freight, then it will be on an unimaginably grand scale.

</comment><comment><USER11> [http://www.fastcodesign.com/1665567/4-reasons-why-the- future...](http://www.fastcodesign.com/1665567/4-reasons-why-the-future-of- capitalism-is-homegrown-small-scale-and-independent&);

Reminds me of this article re: the emergence of "small-scale" capitalism...very interesting - thanks for the share.</comment>


Google publishes largest ever high-resolution map of brain connectivity - <AUTHOR> https://www.theverge.com/2020/1/22/21076806/google-janelia-flyem-fruit-fly-brain-map-hemibrain-connectome <comment><USER2> "In total, a fruit fly's brain contains 100,000 neurons, while a human brain has roughly 86 billion."</comment>


Apple Updates Safari - <AUTHOR> http://techcrunch.com/2013/06/10/apple-announced-new-safari-with-new-homepage-sidebar-icloud-keychain-improved-javascript-performance-per-tab-processes/

<comment> jarek-foksa In terms of the supported Web Platform APIs, is this new Safari release any different from the recent WebKit snapshots? ([http://nightly.webkit.org/builds/trunk/mac/1](http://nightly.webkit.org/builds/trunk/mac/1))

Also, is WebKit2 framework still private on OSX 10.9?

</comment><comment><USER2> Google Chrome Team: "Ah snap, and we just dropped WebKit!"

Edit: It's a joke, guys. :/

<comment><USER3> Nothing in there was particularly unknown as far as I know – Webkit 2 has been around for a while, Blink wanted a different direction on much of the newer architectural decisions IIRC.

</comment></comment><comment><USER4> I actually downgraded back to v5 because of the terrible changes they made to Web Inspector in v6, so I'm pretty annoyed that they didn't even mention it when introducing the new version -- at a _developers '_ conference, no less!

<comment><USER5> Safari 6.x is jam packed with new web inspector capabilities. What are you talking about?

<comment><USER6> It's more capable, unfortunately the _interface_ is rather inscrutable. It's a bunch of little tiny icons with no context you have to guess at.

When I have a lot of work to do debugging something, I switch over to Chrome which still has the old style layout, because I find it much easier to use.

<comment><USER5> yeah the UI is much different. I read somewhere apple is trying to keep the UI consistent among XCode debugger and Safari debugger. Notice, they have almost the same UI design.

<comment><USER6> That's true, it is somewhat similar with the XCode interface. I'd rather they switch the XCode interface to be more like Safari 5 had.

The interface in XCode isn't bad. My big problem is that you can't view source any more, it's crammed in that panel. The list of requests? Crammed in that panel. JS console? Inspecting elements? All crammed in there.

I always feel light I'm fighting to find what I want instead of switching between things I might need.

<comment><USER5> This year's WWDC they broke down how to use the debugger and some advanced tips (2 sessions that you can watch online: [https://developer.apple.com/wwdc/videos/](https://developer.apple.com/wwdc/videos/)). Btw, new Safari seems to have changed the UI again, this time for better the icons are bigger now :)

</comment></comment></comment></comment></comment></comment><comment><USER7> Now with PRISM support! j/k

<comment><USER8> Thing is, that's definitely NOT a joke

</comment></comment><comment><USER9> An iCloud keychain? No thanks.

<comment><USER10> LastPass does this really well for all devices, works with any browser, even mobile too!

This iCloud key chain must be Safari only! :)

<comment><USER11> I thought they'll add KeyChain integration in iOS more deeply. Something like, "If you tap-hold on a password field in an iOS app, the OS will ask you if you want to paste the password from your KeyChain." That's where it becomes much more useful than LastPass.

</comment></comment></comment><comment><USER12> The news cycle rolls on.

Let's see how challenger WWDC fares against defender PRISM.

<comment><USER13> PRISM will be a top story again when something new of substance happens. Are they supposed to be reporting 'nothing changed in PRISM scandal' as a top story?

<comment><USER14> I think this is precisely why the original reporter made it clear that there was new information that has yet to be revealed.

If they blow their news all at once, they won't get a sustained reaction as they would by releasing snippits every day.

</comment></comment></comment><comment><USER15> > Apple announced the next version of Safari which will launch with OS X > Mavericks.

Does this mean it's launching at the same time as Mavericks or does it mean it's launching only with Mavericks?

</comment><comment><USER16> Hopefully they got rid of whatever "Safari Web Content" was doing. That is the primary reason I don't use Safari.

<comment><USER17> Are you talking about the process in Activity Monitor? It's just Safari's rendering worker process, just like Chrome's "Google Chrome Worker" processes. What it was "doing" is rendering pages and running javascript. If it gets out of control, CPU or memory-wise, it is almost certainly a misbehaving tab.

</comment></comment><comment><USER18> Can anyone explain this? [http://tctechcrunch2011.files.wordpress.com/2013/06/scaled-s...](http://tctechcrunch2011.files.wordpress.com/2013/06/scaled- screen-shot-2013-06-10-at-1-35-27-pm.png?w=620&h=473)

Is that real or just BS?

<comment><USER19> It's likely "real". By real, I mean that I just ran JSBench on my MacBook Air with Safari and Chrome (latest released version of each) and Safari came out significantly ahead (Chrome took 1.75x longer). They're claiming 2.53x faster than Chrome in that slide so that would mean an improvement of probably around 50% over the current Safari in terms of JS speed on this benchmark. So, it would seem that this particular benchmark already favors Safari's JS engine and that the next Safari will improve on the current Safari's performance.

Now, the issue with JSBench is that it's real-world JS, but only from 5 sources. Granted, they're 5 sources that are very high-trafficked, but it's still a small sample size ([http://jsbench.cs.purdue.edu/](http://jsbench.cs.purdue.edu/)).

Similarly, Apple showed off SunSpider benchmarks showing the next Safari being faster than Chrome. The current Safari on my MacBook Air beats Chrome, with Chrome taking 6.9% longer. So, part of it is that each browser maker has its preferred benchmarks.

<comment><USER20> What would it say if you ran a benchmark with Safari on your Macbook and Chrome on your Windows/*nix box and Chrome came out significantly ahead?

<comment><USER21> Benchmarks taken with different software on different hardware isn't very useful.</comment></comment></comment></comment>


D3 6.0 - <AUTHOR> https://github.com/d3/d3/blob/master/CHANGES.md <comment><USER2> I've always been curious on what Mike would do if he could completely rewrite D3. I saw some experiments with a declarative API [0] which seems really interesting.

It seems like the main learning curve for learning D3 is deeply understanding the underlying web technologies (looking at you SVG), so could something D3-like have a more abstracted renderer?

Anyway, once you use Observable - Jupyter notebooks are forever ruined, which is the highest praise I can give. Thanks for all your hard work Mike!

[0] [https://observablehq.com/@unkleho/introducing-d3-render- trul...](https://observablehq.com/@unkleho/introducing-d3-render-truly- declarative-and-reusable-d3)

<comment><USER3> While learning D3 I was stuck on a simple bar chart problem. Just could not figure it out. Asked on the D3 slack. None other than Mike himself took the time to look at my code and point out the error. Then he gave me some general tips that he noticed. The guy is so generous with his time and expertise and I admire him a great deal.

<comment><USER4> Mike is everywhere D3 is, it's incredible. Most of the popular D3 questions on StackOverflow are answered by him.

</comment></comment></comment><comment><USER5> The first few days I used d3, I really struggled. And I got very frustrated. I simply couldn't understand why the library was so popular. But I powered through because people whose thought patterns I respected, swore by it.

Then I read some blog post somewhere. I wish I could give that author the credit they deserved. It explained the fundamental building blocks of d3, the selection APIs, etc with such clarity.

Once the light bulb went off, I was able to quickly iterate on some pretty awesome totally custom stuff quickly and have sung d3's praises ever since (it's been 5 years).

<comment><USER6> Sounds similar to this guide I put together - understanding how the different modules work together and who is responsible for what is really helpful.

[https://wattenberger.com/blog/d3](https://wattenberger.com/blog/d3)

<comment><USER7> i can confirm that i dreadfully wished for something like this when i muddled through the freecodecamp d3 curriculum in 2017! it was especially confusing as everyone was switching from v3 to v4 right then.

also, hey :)

</comment></comment></comment><comment><USER8> We are hosting a d3 meetup online Thursday 8/27 (tomorrow) more info here: [http://meetu.ps/e/Jh8GY/1kwFr/d](http://meetu.ps/e/Jh8GY/1kwFr/d)

Mike Bostock will be doing an AMA at the end if you have burning d3v6 questions (though you can expect some more documentation on upgrading to come very soon!)

I'll also plug our other two speakers, Mike Freeman and Amelia Wattenberger who are amazing d3 educators & authors.

It's exciting that this is the first big online d3 meetup since the pandemic put a stop to in-person events, and as a consequence of being online anyone can participate!

<comment><USER9> oh man, I'd love to attend but that is such an awkward time for me.

Will the talk be recorded and hosted anywhere?

<comment><USER10> Yes, the recording will be posted to the Observable to YouTube channel after the event. [https://www.youtube.com/channel/UCCD2tAKN32ya7V639gkbWhg](https://www.youtube.com/channel/UCCD2tAKN32ya7V639gkbWhg)

</comment></comment></comment><comment><USER11> For those looking for higher level interfaces for interactive visualization via D3, check out Vega/Vega-Lite [1] and Altair [2] (a Python library based on Vega-Lite).

[1] [https://vega.github.io/](https://vega.github.io/) [2] [https://altair- viz.github.io/](https://altair-viz.github.io/) [3] [https://vega.github.io/vega/about/vega- and-d3/](https://vega.github.io/vega/about/vega-and-d3/)

<comment><USER12> One of the things I really like about D3 is how there's nothing it won't do, precisely because it's a lower level interface.

With many higher level interfaces, things go great until I eventually run into a situation where I would like to do a tiny tweak that would improve readability a lot, and it turns out the higher level interface does not support that, so I'm out of luck.

That said, I haven't tried Vega. What are your experiences in terms of that problem with Vega?

<comment><USER13> I think they serve different use cases. I love Vega-lite for exploratory analysis and for quick prototyping. You can get fantastically complex visualisations very quickly with it. But for building "production" visualisations, I think the low level approach is better: you'll get much smaller bundle sizes, you have much more control over the final look and that control tends to be expressed "naturally" rather than in convoluted configuration.

<comment><USER14> I would not even touch vega, it's the engine vega lite is built on. Vega lite is a declarative json format for representing charts. The spec is very well thought out and you can rapidly iterate on prototypes. Altair is a python wrapper for vega lite

</comment></comment></comment></comment><comment><USER15> I just wish all the cool animated examples of D3 were updated to use the latest version of the library.

Mike had such cool and colorful ideas for the web 8 years ago which still wow supporters of any project. But I have had to spend significant time and money updating things to work with Vue or React while simultaneously trying to figure out what changed across versions of D3 while simultaneously trying to figure out what the inherited version of D3 was even doing.

Mike seems to have opted for more practical designs in the latter half of the decade in his exploration of data visualizations. While other contributors lack inspiration of using this as an art form.

<comment><USER16> We've updated hundreds of examples to the latest version. Here's the gallery: [https://observablehq.com/@d3/gallery](https://observablehq.com/@d3/gallery)

We're still in the process of republishing some of them and were hoping to announce tomorrow but it looks like someone noticed and here we are on HN.

<comment><USER15> Good to see you here today, and glad to know that.

Why ES2015 specifically? Like where are the compatibility issues or is this a necessary upgrade path for older versions and then you'll phase into es6 or leapfrog that to something even newer?

Or if ES2015 is "good enough"? Javascript can be a hot mess, there isn't always a need to keep up and the troubles arise when you try to.

<comment><USER16> Collections (Map and Set) and iterables; the latter practically requires for- of syntax and so can't be supported in older browsers. d3.group and d3.rollup are much more enjoyable to use than d3.nest.

<comment><USER15> Is this a consideration of many JS library maintainers? Or just you because D3 has broad appeal.

This and other compatibility charts shows only Internet Explorer continuing to be the bane of your existence.

[https://kangax.github.io/compat-table/es6/](https://kangax.github.io/compat- table/es6/)

<comment><USER17> IE11 is still widely supported across a lot of the industry. It's use is declining, but I suspect it'll be a a good while yet before it disappears because there are still so many IE-only internal apps.

</comment></comment></comment></comment></comment></comment><comment><USER18> Does the full adoption of ES6 modules result in trivial tree shaking? I've found that's one of my favourite effects of libraries adopting the newer module styles

Edit: it's modular but the modules I peeked at have sideEffects set and look pretty clean. I'm excited to see what I can do and keep tiny bundles! (I'm obsessed lately with making neat gadgets that load instantly)

<comment><USER16> D3 has been written in ES modules since the beginning of 2016 when we adopted Rollup for bundling. The difference now is that we're adopting ES2015 language features that can't be transpiled (namely for-of).

We didn't get around to it for 6.0 (mostly for fear of breaking backwards- compatibility in Node), but we plan on adopting type: "module" for Node in the nearish future. In the meantime you can consume D3 as an ES module using Skypack if desired. [https://cdn.skypack.dev/d3](https://cdn.skypack.dev/d3)

</comment></comment><comment><USER19> As a former Protovis user whose mouth hit the floor the day he discovered D3, I never cease to be amazed at the quality of work Mike does. Thanks, Mike!

<comment><USER16> Thank you!

</comment></comment><comment><USER20> Sankey diagrams are still blowing enterprise minds in 2020. I don't know what award it would be, but it should be important, and the author should get it.

<comment><USER21> Didn't the inventor of flow diagrams die in the 19th century?

</comment></comment><comment><USER22> Is anybody else annoyed by how tightly coupled D3.js is with [https://observablehq.com](https://observablehq.com)?

It's basically impossible to get started with D3 without using the Observable online playground, I find it so frustrating.

<comment><USER23> Hmm no. It is not coupled to Observable at all, what problems exactly are you facing to use it elsewhere?

<comment><USER22> Both the introduction link [1] and examples link [2] on the D3 homepage [3] and Github [4] only shows sketches on Observable - is there any official D3 getting started documentation _not_ on Observable?

Similar frustations are aired in a forum post: "I want to learn D3. I don`t want to learn Observable. Is that ok?" [5].

[1]: [https://observablehq.com/@d3/learn-d3](https://observablehq.com/@d3/learn-d3) [2]: [https://observablehq.com/@d3/gallery](https://observablehq.com/@d3/gallery) [3]: [https://d3js.org/](https://d3js.org/) [4]: [https://github.com/d3/d3/wiki](https://github.com/d3/d3/wiki) [5]: [https://talk.observablehq.com/t/i-want-to-learn-d3-i-don- t-w...](https://talk.observablehq.com/t/i-want-to-learn-d3-i-don-t-want-to- learn-observable-is-that-ok/1957)

<comment><USER24> The vast majority of library documentation of even major libraries is simply text with no playground.

The fact that they've made the effort to add a playground by leveraging a fairly easy to use tech should not be held against the open source maintainers!

Besides, all those examples are trivially reproducible locally, the way you would have to do it for the vast majority of languages which don't give such fancy interactivity in their tutorials.

</comment></comment></comment></comment><comment><USER25> Which wrapper library around d3 that's declarative would people recommend? I'm thinking something where I can swap the state in React between renders and it updates intelligently with animations etc.

<comment><USER26> Just use d3 directly in react, rendering svg is ok for most cases. You would want to ignore all the dom manipulation parts of d3, but otherwise they work well together.

<comment><USER27> Indeed. When you Google for "React/Vue/Ember D3", the tutorials always use the DOM manipulation layer of D3. But every front-end framework already comes with a great reactive system to ensure the DOM is in sync with the data. And those are a lot easier to use than D3's in my opinion.

The only tutorial that doesn't do this and that "gets" it is one by Amelia Wattenberger: [https://wattenberger.com/blog/react- and-d3](https://wattenberger.com/blog/react-and-d3). I recommend this tutorial to understand how to use D3 in React.

</comment></comment></comment><comment><USER28> It seems like a very versatile framework, but nowhere I can find any recipe or guide of a very simple case - how to combine different types of charts in one? Like simple line chart overlaying the bar chart. It seems to be only possible by rendering them as completely separate charts and then overlaying one on top of each other in DOM? Which seems hacky.

<comment><USER29> D3 is pretty low level - geometry and binding data to create DOM elements. It's not really a charting library - look for libraries built on top of it for abstractions like "composite chart" or whatever.

So yeah at the D3 level you would just draw one chart and then draw another chart on top, probably each wrapped in a <g> if you're using SVG. Maybe they'd share X/Y scales.

</comment></comment><comment><USER30> What's the best resource(s) to learn D3 for an experienced dev? I find most books/tutorials to be overly verbose.

<comment><USER16> I published a new tutorial for D3 earlier this year: [https://observablehq.com/@d3/learn-d3](https://observablehq.com/@d3/learn-d3)

<comment><USER31> Thanks.

Is there anything in it that is now outdated?

It would be nice to mention the D3 version targeted in the very first paragraph.

<comment><USER16> This tutorial, along with the hundreds of other examples we maintain on Observable, are kept up-to-date with all D3 releases.

</comment></comment></comment></comment><comment><USER32> Oh, D3.js is awesome, and all the cool visualizations that I saw over the years makes me glad it exists.

Let's share our creations here!

Here's mine: a tech tree using D3.js made many years ago: [https://github.com/ldd/tech-tree-js](https://github.com/ldd/tech-tree-js)

</comment><comment><USER33> Awesome, I'm always shocked by how much D3 has to offer and the quality amount of time + effort Mike Bostock continues to invest into the project.

On a different note, hoping the CORS issued I received when using a v6 version d3-fetch with local files got updated

<comment><USER16> Thanks. Philippe Rivière has been helping substantially and making amazing contributions!

If you think you've found a bug please file an issue on GitHub. (That said, d3-fetch is just a trivial wrapper on the native Fetch API, so any CORS error there is probably expected.)

</comment></comment><comment><USER27> I love D3. I tried plenty of other higher level libraries but very quickly you run into customization issues. So for Backtest ([https://backtest.curvo.eu/](https://backtest.curvo.eu/)), I moved all the charts to D3. It's a bit lower level and was more work to set up initially, but now I'm in full control and can easily extend any chart. D3 is a great piece of software!

</comment><comment><USER34> I use d3 in my map generator app. I'll look into this update to add and rewrite some of the features. Labels have been an issue lingering around for too long.

</comment><comment><USER35> I love D3, have been using it on and off for years.

The biggest pain point I have coming back to it - esp after a release or two - are the scope of the changes!!

Many methods and properties have changed thus most of the examples, blog posts, and stackoverflow assistance are outdated so it generally takes much longer than I had hoped - but the results are always worth it.

</comment><comment><USER36> For me, a data scientist, learning D3 feels so far off since the background needed to learn it seems vastly connected with some notion of frontend concepts, which for me are very foreign. And honestly, I don't care much about UI programming.

Is this impression correct? Is there a way around this? A learning source that covers both?

</comment><comment><USER37> Awesome. I am a huge fan of D3. I am still using v4. But I will definitely spend some time migrating on my next refactoring.

<comment><USER16> The changes between v4 and v5 are tiny (adopting promises in d3-fetch instead of callbacks). The changes between v5 and v6 are also largely backwards- compatible, so hopefully your upgrade will be painless. A migration guide is here: [https://observablehq.com/d/f91cccf0cad5e9cb](https://observablehq.com/d/f91cccf0cad5e9cb)

</comment></comment><comment><USER38> I have several charts on my development list that I have been planning to use D3 for - this new release is perfect timing.

</comment><comment><USER39> Just won't render, at all, for me. Lotta "Notebook not responding. There may be an infinite loop that has crashed this notebook, or a notebook open in another tab.".

So why should something happening in another tab be allowed to mess anything up? (Not that there is anything.)

No, sir, I didn't like it.

</comment><comment><USER40> exciting to see event listeners drag, zoom. they make data come alive</comment>


"Distraction," Simplicity, and Running Toward Shitstorms - <AUTHOR> http://www.43folders.com/2010/10/05/distraction <comment><AUTHOR> This really struck home with me:

      Doing that annoying hard stuff is how you grow, get better, and learn what
      real help looks like. Even if that's not the answer you wanted to hear. You
      get better by getting your ass out of your RSS reader and fucking making
      things until they suck less. Not by buying apps.</comment>


Pair Programming: The disadvantages of 100% pairing - <AUTHOR> http://www.javacodegeeks.com/2012/01/pair-programming-disadvantages-of-100.html

<comment><USER2> I've found that while pairing is sometimes useful, it's often not. People, even good programmers, have different brains that work differently, and that sometimes gets in the way of pairing. You get into stupid arguments about the right order in which to do things, or waste time bikeshedding about variable/function names when really you just want to sketch the whole thing out and clean it up later. And that's assuming no one ever mentally checks out. If everyone pairs 100% of the time and you _don't_ have these problems, what you probably have is a monoculture where no one thinks differently. And if you do have those problems, you probably lose more productivity than you gain from someone saying you forgot a semicolon.

The monoculture point deserves elaboration. The job postings for one particular consultancy that does 100% pairing are pretty explicit about requiring everyone to use the same particular text editor. Think of the five or ten best programmers you know--do they all use the same text editor? People say that their company has a "culture", and if you don't fit in then it doesn't matter how brilliant you are. In other words, they place a higher priority on being just like everyone else than they place on being good at what they do. So already, they're handicapping themselves by not hiring the best people. On top of that, they think they have a recipe for a "company culture", but really what they have is a recipe for groupthink. Real cultures have diversity. Healthy, creative cultures are the most diverse of all. So not only are they not hiring the best people, but they're constructing a social environment among the people they _do_ have that effectively makes them more stupid.

100% pairing is probably one of the worst ways to develop this kind of monoculture, because there's even a brain difference between people who naturally are good at pairing and people who aren't. So not only are you excluding the people who don't share your particular text editor and way of thinking and working, but you're excluding those people within the already exclusive population of developers who can pair effectively. And then you complain that it's hard to hire people.

I went to a conference once where someone gave a talk about how awesome his company culture was because they paired 100% of the time and after work they went out to dinner or the bars together and talked about work and came back to work to work on the ideas they thought about during dinner. Someone asked a very insightful question about whether this culture excluded people who might have had families, and they responded that everyone in their company were young, single men. If I ran a company and I discovered that all of my employees were bachelors with nothing better to do at night than hang out with their coworkers and work some more, I would stay up at night worrying about that. What about my company or my hiring practices is so broken that I only hire people exactly like me?

One thing I've found enlightening to think about is that nearly all formal methodological dogmas are promulgated by people who are selling something. Who's going to make more noise--someone with some altruistic desire to advance the state of software engineering, or salesmen? If you convince everyone "agile" is a good idea, then maybe they'll want an agile consultant. If you're going to sell scrum master training courses and certifications, you have to sell the idea of scrum. If you're trying to sell CASE tools and you're not clever enough to design software that can be adapted to different processes, you need to sell people on using the process you designed the CASE tools around. Likewise, if you're a consultancy trying to differentiate yourself from all the other consultancies, you need to sell people on your process, and pair programming is a process that conveniently allows you to double your billable hours. That allows you to fully utilize all your devs on a smaller number of projects, which reduces the overhead involved in bringing projects onboard.

</comment><comment><USER3> This pretty much nails it. Pairing is a tool in your toolbox. It's not something you should be doing 100% of the time.

I did take issue with two points:

>I can certainly understand the argument that you should be learning things like that in your own time anyway.

No! If you're using a new tool for work, work-time is when you should be learning it. And learning in a pair can be great. It takes patience though. Research, OTOH is harder. It's a lot like reading a book at the same time. Often a strategy of "split-up and regroup later" works well.

>In my experience house cleaning tasks such as investigating why a test is 'randomly' failing on the CI machine are less likely to be looked at if everyone on the team is pairing 100% of the time because it interferes with productivity of a story.

You fix this by making those tasks their own, smaller story and throw a pair on it. This is independent of pairing and is more closely tied to your overall process. A granular system like kanban (which has its own problems) shines here.

</comment><comment><USER4> I have to agree that PP loses value when you have many senior level programmers on the team. The biggest value in PP, in my personal experience, is transfer of knowledge and experience. This applies mostly to teams with huge gaps in experience (juniors vs. seniors) or new team members that need to be caught up to speed with the codebase.

If the talent level is the same (and by talent I mean having the innate passion and ability to learn, not having actual knowledge) the knowledge of the collective team members will eventually equalize through the initial PP sessions.

Like the author said, the context of the team and the general strategy of the company (i.e. maintaining a project vs developing new features) are the most important signals when determining the programming tactics (i.e. PP and self- learning) to reach those goals.

P.S. The link at the bottom of the article ([http://blog.jayfields.com/2011/08/life-after-pair- programmin...](http://blog.jayfields.com/2011/08/life-after-pair- programming.html)), provides two great team contexts for when pair programming succeeds and when it fails. Definitely take a read on that.

</comment><comment><USER5> > You can't just sit back and read some code. You can't just sit and think. I > mean, you can, but then your pair is just sitting there.

Or bugging you, breaking your train of thought.</comment>


MARS – National Geographic Channel - <AUTHOR> http://channel.nationalgeographic.com/mars/ <comment><USER2> I'm digging the cover of "Home Sweet Home" they're using in the commercial, but can't find a source for it!</comment>


A Child's Garden of Inter-Service Authentication Schemes - <AUTHOR> https://latacora.singles/2018/06/12/a-childs-garden.html <comment><USER3> If you're like me and are wondering what Macaroons are, some searching revealed to me that this is the 2014 paper [1] that introduced them to the public. It's a nested, chained HMAC construction that's useful for delegation, and here's a library and some code examples [2] that one can play with to get a feel for what they do and how.

No wonder it's not well known: it hasn't been picked up by the blog treadmill where dudes on Medium post half-baked info they just found out about, and isn't being pushed by commercial auth proxies.

On that note, posts by Latacora or affiliated persons, there and here, seem to mix well-researched opinions and advice with in-jokes that are lost on all but other experts, assumptions of an inconsistent amount of domain expertise, and quips that muddy some topics more than a bystander would reasonably expect. Why not be more dry and less wry, include links, and morph the FUD around JWT to something real?

[1] [https://static.googleusercontent.com/media/research.google.c...](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/41892.pdf) [2] [https://github.com/rescrv/libmacaroons](https://github.com/rescrv/libmacaroons)

<comment><USER4> Mail us any time for a refund. :)

I'm fucking around, but really the answer is: if we didn't have the presumptive informality of a "blog" or some-such, we just wouldn't write; we'd get 20% of the way through a draft and just pick at it, hoping to make it more correct and authoritative, until our will to keep going evaporated. I have a whole folder full of things I started doing that with.

The in-jokes and snark are what trick us into writing in the first place. There's no getting rid of it.

I'm hopeful that people can at least appreciate that we aren't confining this stuff to Twitter threads anymore.

<comment><USER5> The jokes make it readable as well as writeable. Keep them.

</comment></comment></comment><comment><USER6> Is this _finally_ the more expansive statement from tptacek than just "Don't use JWTs" that I've been waiting for?

Still feels like we're waiting for another shoe to drop in this space - <USER2> it really is Macaroons?

But since container-driven microservice orchestration is ultimately destined to recapitulate the whole of CORBA and DCOM and therefore probably kerberos and every flavor of PKI ever attempted before it gets blown up and replaced with something leaner and simpler and based on shared secrets again, I don't hold out much hope.

<comment><USER7> The published asymmetric macaroon constructions were pretty gross last time I looked. We were missing a practical asymmetrically verifiable append only signature. This deficiency rules macaroons out of numerous use cases (namely where the relying party is separate from and untrusted by the issuing party).

<comment><USER8> I implemented publicly-verifiable macaroons as a PoC and found them reasonably ergonomic: [https://github.com/ecordell/watchstander](https://github.com/ecordell/watchstander)

(docs are sparse, I wrote an accompanying doc that might help: [https://docs.google.com/document/d/1AU9bwpMYlnWBlwSIiwNyse0N...](https://docs.google.com/document/d/1AU9bwpMYlnWBlwSIiwNyse0NiMaGuM-r4hZGYEsHFcA/edit?usp=sharing))

The basic idea is what you described: append only asymmetrically verifiable signatures.

As with most things Macaroons, the harder part is developing a caveat language and verifiers that actually meet your needs. And convincing people that they're a good idea.

<comment><USER9> I think there are a few weird incompatibilities between libraries that are likely to bite you unless you have 1 library you use, but generally speaking: yes, figuring out how to structure your claims is the hard part. Most claims are really quite simple, which is why I'm bullish on most tiny startups just sticking a random token in a database and calling it a day.

</comment></comment></comment></comment><comment><USER10> I don't understand the condemnation of JWTs, this article doesn't seem to explain the condemnation other than saying that "It is extraordinarily easy to screw up JWT." and not to use them.

We use JWTs to provide SSO authentication functionality to partners who wish to take on the responsibility for authenticating their users. I still feel like JWT was the correct choice but I'd really like to know what alluded potential pit falls are.

They provide us with the public key of a asymmetric key pair and we provide them with a key ID to use to identify this key a pair. On our side we associate their key ID(s) with the users they are allowed to authenticate.

When they wish to authenticate a user, they generate a JWT with a user identifier, the client IP address, the Key ID , and the "issued at time". This is then signed using their private key associated with the Key ID. They then provide this to to user's client who then send it us.

We then verify the recency of the JWT, that the JWT is indeed signed by the private key associated with the key id provided, that the IP address matches the client and that the key ID is valid for authenticating the user associated with the user identifier. If all this checks out, we can create a session for the client (using the standard cookie bearer token model).

The reasons we picked JWT are:

1) We aren't responsible for securing their secret(s) (since we never know them) and they can easily send our their public keys to us via less secure channels. If we get a correctly signed JWT, this proves that either the partner approves the authentication or that they have lost control of their private key (in either case, the responsibility is theirs since we have no ability to generate a JWT signed by their private key). This seems like a big improvement over using a shared secret.

2) There are existing libraries for most languages to generate and sign a JWT when provided with a few parameters, this decreases the likely hood that our partners will try to roll their own buggy authentication implementation.

Aside from the issue of trusting our partners not to expose their private key, I'm not sure what the foot-guns are here? (although I am admittedly not an expert)

<comment><USER4> So what you're saying is that you re-invented SAML, but with JWT? What you're describing is SAML; every commercial SSO system on the market offers it natively.

<comment><USER10> Our partners are not commercial SSO systems, nor do they all use commercial SSO systems.

We looked at SAML and it didn't seem to be a good fit for our use case. It is overly complex for our needs.

Instead we built a very small subset of what SAML allows, that is very easy to understand and allows our partners to use lightweight JWT libraries with simple APIs instead of trying to figure out how to get a complex SAML implementation to work with our flow.

We didn't re-invent anything. We used an existing, simpler standard for one of it's intended use cases. Our implentation is < 100 lines of code (not including the JWT library which implements the standard).

Edit:

The relevant SAML flow is this:

[http://docs.oasis-open.org/security/saml/Post2.0/sstc- saml-t...](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech- overview-2.0-cd-02.html#5.1.4.IdP- Initiated%20SSO:%20%20POST%20Binding|outline)

But good luck finding good documentation on it.

<comment><USER4> The model that you described is, verbatim, the bearer model of SAML that everybody uses. SAML in theory does more than just that, but the flow you just described is the subset of SAML that every open source SAML library implements. Apart from some minor security controls that you didn't describe and that SAML implements, the only difference is that you built your ad hoc system using JWE, and SAML is built with XMLDSIG.

(Responding to edit)

I can only assume that the most widely-used flow in SAML, the dominant SSO protocol on the Internet, is better documented than the ad-hoc custom version of SAML you reimplemented with JWT. :)

I don't _like_ SAML (I in fact hate it), but the problems I have with SAML are all shared by JWE/JWT! You are describing perhaps the one scenario in all of human experience where I might recommend that someone adopt an XMLDSIG protocol.

<comment><USER10> > I can only assume that the most widely-used flow in SAML, the dominant SSO > protocol on the Internet, is better documented than the ad-hoc custom > version of SAML you reimplemented with JWT. :)

JWT has much better documentation than anything I was able to find on SAML, but this may be due to my lack of experience with the domain. I had trouble even finding clear documentation on what the basic structure of a SAML assertion should be. As a developer with limited knowledge of the domain, when picking a tool to solve my problem I default to the simpler tool with more accessible documentation.

The documentation for utilizing our JWT implementation is simpler and more straightforward than what Salesforce provides for it's similar flow implemented with SAML.

> the problems I have with SAML are all shared by JWE/JWT!

And what are those? This was my original question.

</comment></comment></comment></comment></comment><comment><USER11> If this is a reference to Maslanka's "A Child's Garden of Dreams", I like it. One of my favorite pieces for wind ensemble.

<comment><USER12> Or perhaps "A Child's Garden of Verses" [1] by Robert Louis Stevenson.

[1] [https://en.wikipedia.org/wiki/A_Child%27s_Garden_of_Verses](https://en.wikipedia.org/wiki/A_Child%27s_Garden_of_Verses)

</comment></comment><comment><USER7> A couple corrections to the section on token binding:

1\. It works on all TLS connections, not just mTLS connections. It even works on unauthenticated TLS (although I wouldn't advise forgoing server authentication). That's the beauty of key binding the token. It's useless without the key.

2\. It's unclear what the tokbind noun refers to in this paragraph. I'm going to assume that you are just referring to the token binding. A token binding lasts for the duration of a TLS connection (sans renegotiation and resumption which complicate things) and is derived from the [clientrandom,serverrandom,mastersecret] of the connection. The token binding secret is just an RSA or ECDSA keypair, independent of client or server certificates, that is generated when the token is issued. The token is bound to the keypair (e.g. by a hash of the public key that's stored in a JWT claim or stored in a database table keyed by an opaque oauth token).

3\. Anyone can use token binding, not just members of the IETF TLS working group :)

<comment><USER4> I'm fuzzy on token binding versus channel ID, the preceding (and, to my eyes, more useful) extension. In neither case do I anticipate widespread use. But it's good to know that it's there.

<comment><USER7> Token binding changed a few things as it evolved from origin bound certificates, notably:

* moving from using client certs to signing exported keying material[0] to prove key possession

* adding support for RSA keys

* adding support for multiple token bindings on a single connection (see referred token binding)

Fundamentally the two are very similar. I'm curious as to why you think origin bound certificates are more useful.

> In neither case do I anticipate widespread use

For the browser case:

* 0-RTT in TLS 1.3 (and resumption in general) negate a lot of the benefits of token binding. Big players aren't going to give this up (see QUIC).

* Hardware bound keys are interesting, but if crypto oracles are available on consumer machines, they are often far to slow to be used practically.

* Many compromises happen in the browser so token binding only marginally improves the security of cookies.

I think it will fall out of favor there. The service to service use case is an interesting one. If you turn off 0-RTT and session resumption, and bind tokens to hardware, the security properties start to look a lot like hardware bound mTLS. If the tooling ever gets developed, it might turn out to be a leaner alternative to a full blown PKI.

[0]: [https://tools.ietf.org/html/rfc5705](https://tools.ietf.org/html/rfc5705)

</comment></comment></comment><comment><USER13> I am somewhat surprised by the statements about asymmetric crypto algorithms. Given a good library they don't seem more error prone and given many common use-cases they are not significantly slower.

<comment><USER9> Securealpolitik: saying there are safe asymmetric primitives doesn't mean that's what's actually deployed. As long as the spec says is P256 ECDSA it's a pretty reasonable assumption someone is going to screw up nonce handling.

(Incidentally ECDSA really is that much slower, but I appreciate that could be seen as cherry picking because ECDSA is slow even for an asymmetric algorithm.)

I don't think the argument we're trying to make is that asymmetric crypto definitionally can't work. I'm pretty happy TLS exists. Just skeptical that you want to build your s2s auth on it.

</comment></comment><comment><USER14> FYI: The article seems to make a comment that implies that SPIFFE is only available to Kubernetes, this isnt the case and SPIFFE is explicitly designed for heterogenous environments.

<comment><USER4> It's a snide comment, meant to imply that there isn't much to SPIFFE outside of MTLS (it's not a fair dig, but not meant to be one).

</comment></comment><comment><USER15> I just use hashing with single use server salt, why is that not mentioned here. It's secure and simpler than everything else.

<comment><USER6> Hashing or HMACing? How is 'single use' of the salt enforced?

<comment><USER15> Just hash = hash(secret + salt) and the server enforces the single use by generating and sending one for each authentication, so you need double handshake:

client ----- server

req salt -> gen salt

hash sec. <\- reply salt

send hash -> remove salt

all good? <\- verify hash

<comment><USER6> How does the server verify that the salt it receives in the second request is the same salt it generated in the first response? Does the server have to retain state?

Also you should maybe read [https://benlog.com/2008/06/19/dont-hash- secrets/](https://benlog.com/2008/06/19/dont-hash-secrets/)

<comment><USER15> Servers are stateful.</comment></comment></comment></comment></comment>


Netflix's US Catalog Has Shrunk by More Than 2,500 Titles in Less Than 2.5 Years - <AUTHOR> https://www.allflicks.net/netflixs-us-catalog-has-shrunk-by-more-than-2500-titles-in-less-than-2-5-years/ <comment><USER2> Actually a line chart would probaby been better at making the change look dramatic, thinner bars would have helped too...

</comment><comment><USER3> Huh. Nice to see numbers back up something that I seemed to be seeing over the last few years but was unable to prove.</comment>


A Different Kind of Love Story - <AUTHOR> http://www.cringely.com/2010/06/a-different-kind-of-love-story/

<comment><USER2> He makes the same point that PG made on his essay on "Cities and Ambition" ( <http://www.paulgraham.com/cities.html> )

Cringley: "The common link that bound all 28 of my New York meal companions was they wanted money."

"None of the San Francisco donors were looking for money. They wanted to talk about ideas."

Paul Graham: "New York is pretty impressed by a billion dollars even if you merely inherited it.

"What matters in Silicon Valley is how much effect you have on the world."

</comment><comment><USER3> I really enjoy the reading here. Have never given in to the 'listen don't read' experience but for some reason I was compelled to click Play today. Kudos to having a very entertaining voice (both written and spoken)!

</comment><comment><USER4> Sigh! The only comment I can make on this rainy Friday with imminent layoffs is that I definitely would like to be in his shoes. Rather than the cool lunches he describes, I will take my luncheon in a miserable cafeteria, talking about inane project matters with my colleagues.

BTW, so the interesting lady with the turban on his blog header is not his wife, she doesn't look like her?</comment>


CPS based functional references - <AUTHOR> http://twan.home.fmf.nl/blog/haskell/cps-functional-references.details

<comment><USER2> I saw this on reddit earlier and it reminded me of this neat, unannounced hack by Kaz:

<http://paste.lisp.org/display/71952>

P.S. Don't try it in your working buffer if you have sb-alien imported ;-)</comment>


Show HN: A web port of Colossal Cave Adventure - <AUTHOR> http://grack.com/adventure/

<comment><AUTHOR> This is a port of the Colossal Cave adventure (550 point version) that I've been working on - on and off - over the last few years. It's a generic interpreter for the bizarre ACODE language that these cave-style games use (spoiler alert: [https://github.com/mmastrac/adventure/blob/master/com.grack....](https://github.com/mmastrac/adventure/blob/master/com.grack.adventure.web/war/ADVENTURE.ACODE)) rather than a port.

Source here: [https://github.com/mmastrac/adventure](https://github.com/mmastrac/adventure)</comment>


Revenue vs. Value - <AUTHOR> http://www.daniellemorrill.com/2013/05/revenue-vs-value/

<comment><USER2> This article vastly overestimates the value of tech buzz and considerably underestimates the value of revenue.

Buzzed about tech companies where their founders are giving talks, they get mentions on twitter, they're talked about on HN, etc., but that are actually going nowhere are a dime a dozen.

Revenue actually changes the underlying economics of your business so it's close to the essence of what a non-vanity metric is.

This article takes a really short-term and dismissive view of revenue. If you're at $1M ARR after a year, throw a party and invite all of your best friends -- you've done something that less than 1% of startups will ever accomplish. If you're at $1M ARR after a year, imagine where you will be after 5 years.

Of course, revenue is just part of the picture. You have to look at revenue growth, whether it's transactional or recurring, how monetization happens, the market opportunity, etc. etc. But I'm pretty confident that revenue is a better indication of how a company is doing than Facebook likes, Twitter mentions, web traffic, etc. that currently comprises the author's startup momentum index.

<comment><USER3> Sour grapes are at play in the original content.

</comment></comment><comment><USER4> I can't help but suspect that this blog is a subconscious reflection of the state of the author's venture. SXSW not in the cards this year? Attending conferences is for chumps. Site not generating revenue? Revenue isn't important. Et cetera.

<comment><AUTHOR> It's totally conscious, unsustainable revenue was our vanity metric for Referly. If you followed to Ecomom saga it was quite similar, we just pulled the plug sooner (and had no physical inventory).

As to SxSW, lol I can't deny I did enjoy taking that dig at all the attendees who should be at home working on their startups.

P.S. I've figured out you don't like me by now codex, but somehow I'm gonna win you over

<comment><USER4> Actually, I admire your courage to pivot refer.ly and I wish you all the best. I do like reading your articles but, unfortunately, I'm cursed with extreme, clumsy bluntness. That's really not as sexy as it sounds. I myself have terrible blind spots to my own flaws and failings, and I sometimes wish others were as blunt with me as I am with them. Sometimes niceties don't do anyone any favors.

<comment><AUTHOR> Oh, those are qualities I understand all too well, so I guess we are fellow travelers. Months of curiousity satisfied.

</comment></comment></comment></comment><comment><USER5> This is an advertisement for an eventual product. We may as well be discussing the merits of Ron Popeil's latest blender infomercial. So let's stop voting up every ridiculous article submitted by this blog already and get back to real content.

<comment><AUTHOR> I should hope to be as successful as Ron Popeil! Also, weak sauce argument on your part. Try again

<comment><USER5> All the points regarding why this post is so ridiculous have been thoroughly covered. I'm just pulling back the curtain on your exploitative use of HN as part of your grand marketing plan (in case it wasn't obvious).

<comment><AUTHOR> I love that anyone thinks I have a grand marketing plan

<comment><USER5> The "aww shucks" card isn't going to fly. This is very much a content marketing campaign and HN is the soapbox right now.

<comment><AUTHOR> I troll harder

</comment></comment></comment></comment></comment></comment><comment><USER6> I'm sorry. But the argument that there are more important things for companies than making money is getting old. Maybe it's because I'm from the Midwest (gasp!) and you're from the Valley.

Companies exist for one reason - to make money. It's their oxygen.

<comment><AUTHOR> Maybe you should ask yourself why the only Midwest startup I can think of is Dwolla?

<comment><USER7> Have you earned the right to have this much attitude? Strikes me as odd that as someone building a startup about startups that you'd be so dismissive of others on HN - a startup heavy community.

Interesting PR strategy.

<comment><AUTHOR> I'm real. There are enough cheerleaders and I love many friends in the Midwest startup scene, but it doesn't help them to blow smoke up their asses. I'm from Seattle, another startup community in denial. It's time for an objective industry voice and it won't all be flattering.

<comment><USER7> Your conflating two unrelated things here - being objective (or real) and being dismissive.

</comment></comment></comment></comment></comment><comment><USER8> Revenue can be deadly friction in many early stage startups.

If you are in a market with network effects, you need to acquire users FAST. What would grow faster: Facebook monetizing each user from day 1 at $1 a user or Facebook growing fast, kicking in network effects, and delaying monetization. What would ultimately have more value?

So this isn't saying "don't make money", it's about examining the market you are in and making a strategic, thoughtful choice.

<comment><USER9> This is true for facebook, but false for 99% of other companies. At the end of the day, revenue - costs (profit) is what you're optimizing for.

I think dmor's point is that revenue can be a lagging indicator, and that some startups can suddenly turn on a revenue pump that makes watching revenue silly.

I agree with her - in 1% of cases. The problem is that for dmor, that 1% of cases is all that matters - because those cases are going to be the all or nothing billion dollar company cases, which is what she's aiming for. Facebook, AirBnB etc - all would have terrible numbers while starting up, then suddenly their numbers start to look great.

<comment><AUTHOR> Their revenue numbers maybe, but there were other signals. I am gonna find the next Airbnb with what I'm building mark my words

<comment><USER7> If you can really do that, become a VC or full-time angel vs. starting some silly startup index SaaS platform.

<comment><AUTHOR> Nah that path is too obvious, I'm making the new Dow Jone Industrial index. Way less plausible, way more fun.

<comment><USER7> You're drastically overestimating how many people care about startups (and will pay for a product related to them). This is a small market and VC as an asset class is shrinking (so it's getting smaller). VCs are terribly intuition driven and the good ones already do what you're thinking of and they'e good at it. And even if they bought, it's less than 50.

If you're trying to build one of those shoot for the moon startups (the kinds VCs like), this idea won't be it.

Not being a hater.

<comment><AUTHOR> Don't care about exit size anymore, it's all about blowing shit up and changing the world. ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This POV pidgeonholes startups into an investor dependent mindset.

Why raise 20k if you you'll make that next month?

Early Revenue is only bad for pump-and-dump startups that KNOW they'll never be profitable, but hope they can fool everyone long enough to get funding and make the company somebody else's problem.

\-----

If the data _was_ in fact available, I have no doubt in my mind that it'd be one of the most important indicators.

</comment><comment><USER7> Revenue is a vanity metric. That's a new one.

This seems like an interesting way to justify shortcomings of dmor's momentum index. So:

\- Mentions in TechCrunch > Revenue \- Conference presentations by CEO > Revenue \- Klout score > Revenue

This is some combination of naive, farcical or dumb.

Of course, you can throw out Facebook as an example of what over-optimizing for revenue would have done to them but this is survivor bias at its best. You could also look at Pets.com, Webvan and Kozmo from a bygone era to see what a poor monetization plan does. Note: it's not just revenue that is important but revenue > COGs.

(Note: Yes I know. This time is different. I'm an idiot.)

</comment><comment><USER11> 20% revenue growth each month isn't sexy? That's crazy.

<comment><USER12> That same million after one year becomes 9 million the next and 80 million the year after that. Most people would kill for a 20% revenue growth rate per month.

<comment><AUTHOR> I agree, not sexy != not awesome

</comment></comment></comment><comment><USER13> I wonder how this mindset affected the failure of the original referly. Could they have shunned revenue in order to try and get more investment funding? This ultimately send them towards a pivot. A pivot that I'm still to understand. Dmor shows good promise with her data gathering, but I wonder where that fits into the pivot.

</comment><comment><USER14> An annual run rate of 1 mil is an admirable goal that we should put on a pedestal, not wipe away with a dismissive "tiny business" label. If you're a founder, that should be your goal.

<comment><USER7> VCs don't like that type of company. As a result, you should not aim for that goal.

<comment><USER14> Why do you care what VCs like. Making a mil a year (or run rate of 1 mil) should be the goal, not impressing VCs.

<comment><USER7> Sorry - sarcasm never translates well in writing. I totally agree with your point. Apologies for confusion.</comment></comment></comment></comment>


Show HN: Build heroic rest apis on a deadline with Django 1.11 - <AUTHOR> https://github.com/agconti/cookiecutter-django-rest <comment><AUTHOR> cookiecutter-django-rest now supports Django 1.11+!

cookiecutter-django-rest takes care of the details so you can focus on making your api awesome. Scaffolding a project takes seconds and gives you a solid foundation by baking in Django's best practices. Just add your own resources to the api and start shipping.

We're happy to announce that we just released 0.7.0 this morning! We'd love to hear your feedback.</comment>


Bitcoin drops under $200 for the first time in over a year - <AUTHOR> https://bitcoinwisdom.com/markets/bitfinex/btcusd

<comment><AUTHOR> Apologies as I linked to the Bitfinex charts. There is an instance where the market price dropped to $100 due to a margin call, which I have disregarded.

Its interesting to see that Bitfinex's selling limits are in play here to prevent margin calls from cascading.</comment>