SimpleSSR: Server-Side Rendering at Scale - <AUTHOR> https://www.simplessr.org/ <comment><USER3> I may get hate for this but watching JavaScript development mature makes me feel like I am taking crazy pills. So much shit was figured out decades ago but it's like everyone is just learning this shit for the first time. I don't know if it is because the standard library is so lacking or that it's been historical a client side only language but it makes me feel completely disillusioned with programming. It's like we're not progressing at all, merely learning that same shit over and over again each generation in a series of cycles.

Or maybe I'm just too old and need to get off my own lawn.

<comment><USER4> You're not crazy.

I created and maintain VueJS's other Server Side Rendered library. Express-vue

I've spoken on it at a few talks, and every time I do, the eyes of the audience just go blank when I talk about SSR. It's like I'm talking in some strange language they don't seem to understand, where the only thing they get is client side everything.

I get the stupidest questions like "so how do I add in <insert unnecessary bloat for a SPA here>" most of these are about state management on the client. Aka redux, or vuex etc. Which I reply. "You don't need that. State lives on the server. It's simple".

Since having this library and it getting as big as it has, having to defend it and defend SSR. I've fully burnt out of JavaScript and frontend all together.

We use my library in production at work, and have started talking about migrating to Nuxt. I'm planning on changing teams before that happen.

Javascript is just hype driven development, of the worst kind.

<comment><USER5> Thanks for all the work you've done on express-vue. Even though I'm not the biggest fan of vue and only really use it at work, it makes me happy to know there's good libraries out there for it that do one thing well (a trait that's sorely lacking in a lot of JS libs).

</comment></comment></comment><comment><USER6> You can't beat serving useful data to the user on the first payload (base HTML), no matter how fast or clever client-side rendering gets.

<comment><USER7> Agreed. Useful data in the first payload is what matters for a responsive experience. The kind of engineering team drives whether it is appropriately accomplished with view templates, rendered view frameworks, or some other HTML rendering technology that embeds preloaded data.

<comment><USER8> Here's a pattern: since your Service Workers won't run the first time a user visits a page, you should send server-side rendered content to the user that also has a line that installs a Service Worker after the page is fully loaded from base HTML with useful data.

The second time the user visits your page, the Service Worker will ideally be installed and will run, intercept the call and download your components separately, when they're needed, and save them on cache, as opposed to let the server render the components to base HTML.

Third time forwards, components are loaded directly from cache and rendered by the Service Workers.

<comment><USER9> This is exactly the pattern I use in [https://github.com/PaulKinlan/webgde- deck](https://github.com/PaulKinlan/webgde-deck) and whilst is a little harder to mange it's incredibly fast

[https://webdev.topicdeck.com/](https://webdev.topicdeck.com/) is an example of it hosted.

<comment><USER10> FYI I'm getting "542: An error occured with your deployment" when clicking that link!

</comment></comment></comment></comment></comment><comment><USER5> I'm seeing a lot of posts about NextJS here...

Adding a (huge) abstraction on top of another (huge) abstraction to solve a problem introduced by the first abstraction is rubbish software engineering. It's one of the oldest anti-patterns in the book.

I get that these libraries provide some utility beyond their core purpose, and that it's a bit more nuanced than A -> B -> A, but I'm highly suspicious of people that recommend these libraries without giving much context behind it.

<comment><USER11> The industry norm for SPA seems to be moving towards SSR along with code- splitting and offline workers. The main SSR framework for React is NextJS. Vue and others have their equivalents.

Honestly I don't see a reason not to use it. I could write a traditional website using Next/react at the same speed as someone using Django/rails/etc.

<comment><USER12> Next.js is a front-end framework, right? So how can you build a traditional website using only a front-end framework at the same speed as someone using Django or Rails?

<comment><USER13> It's not like it's hard to find: [https://nextjs.org](https://nextjs.org)

Next integrates the server and client code in a single framework, and is made for seamless deployment using Now.

<comment><USER12> I previously visited nexjs.org and read the docs, and it wasn't clear that Next.js is a full-stack framework. The term "full stack" isn't used anywhere at nextjs.org[1], unlike rubyonrails.org[2].

Furthermore, there are numerous references on the web to Next.js being a front-end framework, including statements made by Next.js maintainers[3]. Do these statements not reflect the current state of Next.js?

If Next.js is a full-stack framework, then this seems to be another instance of JavaScript tools having inadequate documentation. Speaking of which, if Next.js is a full-stack framework that's comparable to Rails and Django, why is the documentation just one page (!) and there's no mention of database migrations or other basic features that are included with every full-stack framework?

[1] [https://www.google.com/search?q="full+stack"+site:nextjs.org](https://www.google.com/search?q="full+stack"+site:nextjs.org)

[2] [https://www.google.com/search?q="full+stack"+site:rubyonrail...](https://www.google.com/search?q="full+stack"+site:rubyonrails.org)

[3] [https://github.com/zeit/next.js/issues/1933#issuecomment-300...](https://github.com/zeit/next.js/issues/1933#issuecomment-300476550)

<comment><USER14> Next.js is not really a fullstack framework. It provides a server for static websites but as soon as you want dynamic content you can use any js api framework of your choice.

</comment></comment></comment></comment></comment></comment><comment><USER15> disclosure: I'm the biased author

texas [https://gitlab.com/dgmcguire/texas](https://gitlab.com/dgmcguire/texas) is a library that brings development back to the server. You can integration test without headless browsers, get SPA-like UX without writing a line of JS and basically just write SSR apps with only adding a few lines of code to make you apps realtime and SPA-like.

It works by leveraging persistent connections (websockets) first page load is entirely SSR and subsequent updates are SSR, but only by V-DOM diffing html fragments, sending only the minimum amount of patch data over the wire.

Your apps will be faster, your development process will be faster with less code and removing all kinds of complex tooling.

Here's a todoapp that does all rendering SSR [https://warm- citadel-23442.herokuapp.com/](https://warm-citadel-23442.herokuapp.com/) \- you can see just how fast it is even on a free tier of heroku - open it up in multiple clients and you'll see that all operations are realtime broadcasted too and believe it or not there's only like 3 lines of code you write to make that happen (plus all the code necessary to get a normal SSR app running)

<comment><USER16> That's interesting, but the latency is clearly perceptible between each action and the related screen update.

<comment><USER15> Likely you're just located somewhere far from the server in Virginia, USA. If you watch the conference talk just a few minutes in I show a gif of the latency from Seattle to a server in California. Most interactions you can't tell at all.

</comment></comment></comment><comment><USER17> I can't say I fully comprehend the SSR vs SPA war. Both concepts are definitely being misused/overused, one is "dated" and the other "modern", but surely the middle ground where best usage of both can be attained is prefered. I don't know of any terms that mediate the opposition other than perhaps "hydration"?

<comment><USER18> This is the key. There are super developed SSR frameworks and super developed SPA frameworks, but getting the two to work together is like pulling teeth. No one tries to write an SSRSPA framework because that would be considered too "opinionated", but maybe that's exactly what we need.

<comment><USER19> Doesn't nextjs do this already? You write an SPA that nextjs implicitly also knows how to render server side

<comment><USER20> Yeah, that's essentially the purpose of Next.js and it does it very well.

</comment></comment></comment></comment><comment><USER14> I've been using Next.js and SSR with react is dead simple. I use React even when building standard web pages because the React way of doing things makes more sense to me as a programmer than the html/css/js way of doing things.

I like building composable building blocks with self contained state. The old model of separate html, css, and js never worked well for me.

My main complaint with React SSR is that it almost forces on me the requirement of using Node for the backend. I'd prefer to use a language like python.

<comment><USER21> Is there any way to do use python as the backend? I feel the same way about handling raw HTML/CSS/JS. Either I haven't learned enough about handling those or I should learn React/Angular/Vue, but I do want to stay on python for my backend.

<comment><USER14> I mean, the way to do it is to have a server for ssr and standard requests and another server for the api written in the language of your choice.

</comment></comment></comment><comment><USER22> Gatsby.js (and some other recent tools) makes the SSR vs. SPA argument moot. There's no need to pick one when you can have both.

Disclaimer: I'm not affiliated with Gatsby.

<comment><USER23> I'm a fan of gatsby and think it's a sensible approach for many sites. But it has limitations. Most obvious being it essentially reverts to an SPA if you need the user to be logged in before you can render any real data.

</comment></comment><comment><USER24> React SSR is not a problem, and I can get quicker TTFB than I ever remember getting with even a simple RoR app (300+ms yikes).

I can also work faster with the React ecosystem (and find it much more enjoyable) than RoR and SSR makes the end result the same anyway.

People like component-based frameworks and modern JavaScript (and its supersets). Things are different now. Deal with it!

<comment><USER25> > Deal with it!

We, your users, _do_ deal with it. Constantly. Usually, we deal with it by waiting 30 seconds for your single-page application blog article to load because we only get intermittent 3G reception on the metro.

I don't really care what sort of frameworks you like. Stop building shit webapps!

<comment><USER14> Your complaint has nothing to do with using React over using other frameworks such as django.

The problem you have is that people are not implementing SSR on their websites and they don't host all of their assets.

</comment></comment></comment><comment><USER26> Upcoming Phoenix LiveView is actually pretty viable for SSR -

[https://www.youtube.com/watch?v=Z2DU0qLfPIY](https://www.youtube.com/watch?v=Z2DU0qLfPIY)

</comment><comment><USER27> I really don't get this whole SSR thing. You take a framework designed explicitly for dynamic client side code and use it to make a glorified old school framework (insert your choice of RoR, Django, Laravel, etc).

Why does anyone think this is a good idea? You end up re-implementing Rails on a foundation of quicksand and manage to throw the excellent standard libraries that come with those languages out in one stroke.

Is this a result of too much kool-aid? Or have we ended up with hippie bootcampers without a shred of knowledge in high level positions? It's depressing to watch really.

<comment><USER28> I firmly believe defaulting to SSR/old-school is the way to go. And only add dynamic behavior when needed.

But when you _do_ need to add that dynamic behavior... things get hairy.

See this comment for more info: [https://news.ycombinator.com/item?id=18289460](https://news.ycombinator.com/item?id=18289460)

<comment><USER19> I went to a conference recently where one of the talks was a guy from comcast on 'Progressive Web App performance'.

The two takeaways were that they had decided against ever using SSR (he didnt say why just acted like it was ridiculous), and that through various clever performance tricks they'd managed to get their page load time down from 30 seconds.. to 15.

</comment></comment></comment><comment><USER29> On-demand Server Side Rendering should be killed for 98% of applications.

SSR->static hosting + client framework is the future.

</comment><comment><USER30> I can't help feeling that edge rendering is greatness personified ... but that it's perhaps not any more useful than just server side rendering. An edge renderer is still going to have to either access a model/controller held centrally (getting our latency times up again) or use some godforsaken distributed/replicated state that's a bitch to debug. Perhaps an edge renderer can hold open a connection to the central logic and knock a hundred millis or so off the set up time as a result, but none of the proposed models for doing this would seem to support that. They don't seem to support stateful _anything_.

</comment><comment><USER31> Yeah this is a little too on the nose.

<comment><USER24> Also probably shouldn't put RoR as the first item in your list of full-stack frameworks if your title says "at scale"

<comment><USER32> Lots of companies successfully use RoR at scale.

<comment><USER33> I think both statements depend on the definition of "at scale". I am no expert, but every RoR thing I have ever seen has been tiny in terms of traffic and still performed terribly. Is there anything in the top 100 sites using RoR?

<comment><USER34> YouTube, No. 2, was still running Python 2.7 as of last year. Python and Ruby are basically the same performance wise.

Instagram is also a Python app, AFAIK. Last year they contributed some memory efficiency improvements to CPython.

Shopify is likely the largest RoR site at 80k requests per second but since it's served as tons of different domains it doesn't really count.

<comment><USER18> Twitter was (originally) also built on RoR. Not to mention GitHub is a rails app.

<comment><USER35> It's also worth noting that Twitter's feature velocity fell off a cliff when they moved to Scala.

<comment><USER36> Oh interesting, I hadn't noticed that pattern.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> The number of use cases that people implement with SPAs is huge while the number of use cases where a SPA is actually better than just rendering some HTML can be counted on one hand.

</comment><comment><USER38> My golang template render in tens of ms. About same time my slow computer browser take for spa.

</comment><comment><USER39> For those saying to forgo Next.js and to also serve templates from a non-Node server, how are sub-views handled? Same as JavaScript but the AJAX call returns a sub-template and data?

</comment><comment><USER40> > _Is this a joke? Sort of, not really._

 _" SimpleSSR: Don't do SSR"_ is as humorous as _" SimpleC++: Don't use C++"_. I'm guessing it's funny to SSR haters? (Related question: Are "SSR haters" a thing?)

So is the essence of this particular hot-take that it's better to render pages per-request with Ruby or PHP than to serve a rendered result that has no additional per-request overhead?

<comment><USER41> It's not that simple. (I say this as a JS dev who develops SPAs for a living).

For one, "no additional per-request overhead" is an oversimplification, that is not the case for most SPAs that grow beyond 'small' size, see 'code- splitting'.

Modern SSR involves re-using the same client-side rendering code on the backend (which typically means a Node backend), and modern SPAs may employ some techniques to code-split the client side app, either by-route or other means.

You can make a decent case that for a lot of 'sites' this whole setup is more complex than the server-side rendered frameworks of old mentioned by this site.

<comment><USER40> > _For one, "no additional per-request overhead" is an oversimplification…_

That's fair, but setting aside packaging decisions like code-splitting (which aren't unique to SPAs), my point is that SSR is typically used to deliver content and app logic that would otherwise require round-trips to code running on a server. It hardly seems like a huge win for "SimpleSSR".

</comment></comment></comment><comment><USER42> NextJS - <USER2>

</comment><comment><USER43> After reading all the comments here... "TRY ALL THE NEW FANCY FRAMEWORKS"

</comment><comment><USER44> Let's make SSR great again</comment>


Self-criticism can take a toll on our minds and bodies - <AUTHOR> https://www.nytimes.com/2018/05/22/smarter-living/why-you-should-stop-being-so-hard-on-yourself.html <comment><USER2> _"Self-criticism ... can lead to ruminative thoughts that interfere with our productivity, and it can impact our bodies by stimulating inflammatory mechanisms that lead to chronic illness and accelerate aging"_

This assertion may sit outside conventional medical science and mainstream accepted wisdom, but it aligns with my own experience.

After trying unsuccessfully for years to overcome depression/anxiety, chronic fatigue and other mysterious illnesses (asthma, skin problems, headaches, back tension/pain) using conventional/material remedies (antidepressants, exercise, diets), I added emotion-based treatments to my regimen about 6 years ago, and have had much greater success.

In particular, I've undertaken practices that identify negative beliefs, traumas and sabotaging behavioural patterns that are held in the subconscious, then allow these issues to be understood and resolved. Self-criticism has been big part of what I've been able to work through.

It's been no quick fix (it seems I've had a lot of baggage to work through), but bit by bit, as my emotional health has improved, my physiological health has steadily improved, as have all the outer-world indicators like relationships, productivity and career.

I'm now comfortable suggesting that this approach is overlooked by mainstream medicine to the great detriment of many people suffering chronic illness, and given the link with inflammation that has been suggested in this article and elsewhere, and that I seem to have experienced myself, far more progress could be made in addressing inflammatory and autoimmune illnesses if this approach were to be taken seriously.

<comment><USER3> Can you please share the details of methods /techniques you used? did you saw a therapist? I am in same boat here and can use some help

<comment><USER4> Sounds like a form of CBT.

<comment><USER5> oh the joys of name overloading. Wasn't sure what abbreviation you meant, went to google, was surprised...

<comment><USER6> To be fair, you're not expected to know random abbreviations from random fields of study. That said, if you're interested in emotion-based therapy you can check out [http://istdpinstitute.com](http://istdpinstitute.com) or [http://www.iseft.org/](http://www.iseft.org/) (they have global lists with therapauts).

</comment></comment></comment></comment></comment><comment><USER7> I recently realized that when I have negative thoughts about myself or the future I feel like I'm listening to my logic and reason, but when the thoughts are positive I just brush it off as wishful thinking. Which has lead me to a life where I dread imaginary events that never happen, and don't let myself look forward to anything or fantasize about possibilities.

I think it started as a measure of self protection after a long string of broken promises when I was a kid, but it's a shitty way to live. My biggest realization was just that pessimism is no more logical than optimism.

My solution has been to give equal time to positive thoughts. So, if I find myself thinking for a couple minutes about how something might go horribly wrong, I spend the next couple minutes imagining what the best case scenario would be like.

I'm basically forcing hope back into my life.

<comment><USER8> I've read that predictions on the future made by pessimists end up closer to reality than by optimists. It might make sense to plan for the worst from a practical perspective, to limit unnecessary risks. But on the other hand, people with really low expectations are usually not super happy when something turns out better than expected, they just find something else to complain about.

Being optimistic, without setting expectations so high that you're constantly disappointed, seems to be a more pleasurable way to live your life. Also, the consequences of failure to meet whatever high standards self-critical people put on themselves are rarely as bad as you think before it happens.

I like your way of finding some balance between being pessimistic and optimistic.

<comment><USER9> > But on the other hand, people with really low expectations are usually not > super happy when something turns out better than expected

I don't know, in my experience having high expectations seems to set you up for a higher fall and a lower upside, thus leading to less happiness. I have generally quite low expectations and am generally quite happy. Some people around me have generally much higher expectations and are generally quite unhappy. The things in life where I do have some higher expectations about are also the things I'm the least happy about.

<comment><USER7> > I don't know, in my experience having high expectations seems to set you up > for a higher fall and a lower upside, thus leading to less happiness.

I used to feel this way, but I no longer think that optimism and expectation have to be that closely linked. To me optimism is about having hope, not expectations. Similarly, my pessimism isn't about what I expect to happen, it's about what I fear happening.

So, I choose to balance my fear and hope.

<comment><USER10> ALso, as an optimist that misses a high goal, you may still end up in a great place. A pessimist that achieves his may not end up where he really wanted to be.

</comment></comment></comment></comment></comment><comment><USER11> From a Christian perspective self criticism is important because its a recognition of reality, that we fall short every day, even of our own standards. We call it confession.

Confession is possible because of the Gospel: God saves sinners not perfect people. " But God demonstrates his own love for us in this: While we were still sinners, Christ died for us." We can admit to our failure because we stand not on our own righteousness but on Christ's.

In it we can find acceptance just as we are and hope for change in the future: "he who began a good work in you will carry it on to completion"

Directed self talk can be very helpful. You arr the person you listen to most in life and what you tell yourself can radically alter your perceptions.

That said, self talk is very hard. We are easily deceived, and you can get trapped in your own thoughts: anxiety, depression, neurosis.

We're not meant to go it alone. Seek help. "Therefore, confess your sins to one another and pray for one another, that you may be healed."

<comment> s-shellfish In Buddhism, compassion is practiced more because, every person you deal with is someone you either have been, or someone you will eventually see in yourself. So there's no point to criticize because you always work towards mutual understanding and compassion.

You don't have to practice the inward neurotic obsession of identifying flaws or the external compulsion of alleviating the burden of knowing yourself - because you'll focus on them when you do. Every person you meet knows you and every person you know is you.

<comment><USER12> I don't consider myself a Buddhist but I've always aligned myself behind that way of thinking. Even in a non-spiritual context, most people have similar struggles in common: nobody asked to be put on this planet, everyone was torn from the safety and comfort of the womb to be thrown into a chaotic world, we're all just trying to get by providing for ourselves and our loved ones, and we're all trying to enjoy life while we have it.

It would seem obvious that when you hurt someone, you are merely hurting a different version of yourself, a version simply displaced in time and space and sitting in another man's shoes.

<comment> s-shellfish I think some people at some points in their life think that it's okay to judge others, because they think they will never be what they judge.

But we always are that, generally, we experience those emotions eventually, in some shape or form. We judge we get judged. Til the end of time, eventually we die, we are alone, with only our thoughts, and a question of what we will become next. And all we have is everything we have ever known and thought, on a deathbed. And all we have ever known and thought are, how we know ourselves and how we know others.

And all of that is in the mind, at the moment of death.

So I think while living, it's important to let go of whatever causes the cycle of wanting to judge and wanting to hurt, people hurt when they feel hurt.

When we feel judged, we judge. But generally, we can never really know if we are being judged or hurt. Because life is an experience, of coming and going, of interacting with a self we think we are not, but we are.

Zen koans can be good to think about (to me), when one dwells too much on what a self means, when one has to interact with other selves in real life. People need a sense of self, because sometimes we are with other selves, sometimes we are with our self.

[https://www.ibiblio.org/zen/cgi-bin/koan- index.pl](https://www.ibiblio.org/zen/cgi-bin/koan-index.pl)

</comment></comment></comment></comment><comment><USER13> I think there's a tendency for overachievers to see self-compassion as "going easy" on yourself.

However, it's very useful to recognize that self-criticism is the _emotional_ self giving feedback, rather than the _logical_ self. Obviously, this is the worst self to receive feedback from!

I think once you can reconceptualize this, you see self-criticism as the dark half of constructive feedback. You can practice self-compassion, yet still independently recognize that you can logically focus on improvement (without the emotional criticism).

<comment><USER14> > self-criticism is the _emotional_ self giving feedback, rather than the > _logical_ self. Obviously, this is the worst self to receive feedback from!

IMHO that's a very unhealthy perspective. Your emotional self is just as important, healthy, and useful as your intellectual side. They are both essential; try to operate using one without the other and you will be crippled.

<comment><USER15> Exactly, the situation for us humans is that emotions are based on our perception of reality, and this perception might be (or, most likely, is) tainted. Lesswrong has some articles on emotions, which were very enlightening to me btw. Emotion is important to listen to! But instead of taking the easy way out of an emotion, like giving in to rage and hitting someone, or running away from a painful situation, we can stop to reflect what view of the world causes this emotion, and find a more rational way to find a more constructive way to deal with the problem at hand. That's btw exactly what cognitive behavioral therapy is about. The hard part is to stop in your tracks and recognize situations that pull "the trigger" for you.

<comment><USER3> Thanks can you please point to the Lesswrong article ?

<comment><USER15> Sure, here are some good ones:

[https://www.lesswrong.com/posts/tNnhxNYcXYdJYtQRh/overcoming...](https://www.lesswrong.com/posts/tNnhxNYcXYdJYtQRh/overcoming- suffering-emotional-acceptance)

[https://www.lesswrong.com/posts/oiGN8fLCqYyk2xJaT/avoid- misi...](https://www.lesswrong.com/posts/oiGN8fLCqYyk2xJaT/avoid- misinterpreting-your-emotions)

[https://www.lesswrong.com/posts/iA6dNPKFNhXd3JiZs/the- peril-...](https://www.lesswrong.com/posts/iA6dNPKFNhXd3JiZs/the-peril-of- ignoring-emotions)

</comment></comment></comment></comment></comment><comment><USER16> For me, the easiest type of self-criticism to slip into is comparing myself to others. What I eventually came to realize though is that I was comparing my individual skills/achievements in a given field against the most accomplished people in that field. Like: I do computers and business but I have not pulled a Steve Jobs so I clearly must suck. And: I do photography but I must be a terrible failure because my work isn't in the Guggenheim.

Although those are comically extreme examples, media and society makes is easy to do this sort of thing on smaller scales. I also realized that even when I did come out on top of any mental comparisons, it did not make me feel any better. So now I try to catch winner think early and instead remember: there will only ever be one me, I should strive to be the best, most complete version of myself I can be. This mindset has been a far more productive

<comment><USER17> I experienced this with Facebook too, but not because I felt envious of other peoples' social highlights and I was comparing myself to that.

Facebook often shows you posts and photos from the same time in previous years, like memories but not particularly authentic. I found myself getting into a worse state of mind when I started comparing who I am now to who I was a year ago, two years ago... because my own highlight reel back then was far more exciting and vibrant than it has been more recently. Or that's what Facebook will have you believe, because it's just a one-dimensional window into a vast and diverse existence. It won't show you anything from your past that doesn't unambiguously register as 'happy'.

It makes it really easy to forget that there are positive notes to things you can't share so easily, so the comparison is as misleading as it is damaging.

<comment><USER18> I've experienced negativity from comparing my past self to the present, but because that self was too similar to the current. As in I wasn't experiencing enough progress as I liked. Fortunately comparing past to present GitHub shows a better trend.

</comment></comment></comment><comment><USER19> I too, have issues from my childhood that have driven self-criticism. Over the past 18 months I have been able to put those things behind me.

For me it was, and is, all about my faith. This article doesn't acknowledge that aspect of healing, but this has been very real in my life. I'd recommend reading the book Wild at Heart by John Eldridge for anyone curious.

</comment><comment><USER20> I am someone who has had to face some very serious physical and mental health consequences as a result of pathological perfectionism (no, it's not a good thing). Learning skills similar to the ones described in this article changed my life. I still have bad days, but mindfulness and self-compassion, validation, kindness, and understanding can be game changers for those with perfectionist tendencies.

It finally clicked for me when someone described how we are seemingly capable of providing compassion/validation/understanding/kindness to and/or seeking them from others. However, we were really bad at giving ourselves those same things.

It made me realize that I was inflicting tiny psychological wounds at every turn, saying things like "You're such an idiot"..."how could you be so stupid to do..."...or the worst one..."You're never going to succeed and everyone will see you as just as much of a failure as you see yourself if you don't do this perfect".

It is not something that can be changed over night and takes consistent practice. It takes about as much effort, for me, as learning a new intellectually challenging skill. However, it has been incredibly worthwhile, valuable, and life-changing in many ways.

<comment><USER21> "It finally clicked for me when someone described how we are seemingly capable of providing compassion/validation/understanding/kindness to and/or seeking them from others. However, we were really bad at giving ourselves those same things."

This is so true. But I do wonder whether this is because when we apply it for others, because it is "distant" to ourselves, we afford a certain amount more "slack". Maybe.

<comment><USER20> That's probably part of it. I think the other part of it is our "inner voice" needs training and practice at it. Having two young children of my own, I can see how upbringing and the way parents punish/praise their children plays a role in this. This is just my opinion and not based on any specific research, but think about how a parent typically curbs a perceived negative behavior. Ex. A child is eating dinner while standing up instead of sitting down. A parent will ask the child to sit down and possibly levy a consequence if they do not do it. Now think about all the other times the child ate at the dinner table and sat down (99% of the time). How many times was the child praised for sitting at the table as they were expected to? Similar examples can be found in how negative/positive reinforcement is implemented within the K-12 education system.

The point being, we are likely trained from an early age to focus on criticizing our negative behavior(s) instead of reinforcing our positive ones.

</comment></comment></comment><comment><USER22> I would like to know whether this happens mostly to people who work in fields that demand some degree of perfectionism and / or black & white thinking, or are in artificial environments with clear answers (like maths, programming).

Mind trained for ubiquitous perfectionism / black-white thinking* -> perfectionist self-criticism -> chronic stress

If this is right, the alternative solution is to not apply the thinking patterns that lead to performing well in those types of work in those many areas of life where there is no clear answer, or no place for such patterns.

<comment><USER23> I've never been a black/white thinker, but I got a big dose of "you're no good" in my childhood, which led to chronic self-criticism.

I finally left that behind around age 40, mostly from just being worn out by it I think.

<comment><USER24> I just turned 30 and the self criticism has gotten stronger. Mostly, I think, because I feel like time's running out to get adult things done like buy a house, get married, etc.

<comment><USER23> Thoughts that have buoyed me:

\- I'm not 'normal'. Expecting life to proceed 'normally' doesn't make sense for me.

\- Other people's expectations are none of my business (related to marriage, property ownership etc).

\- I may die before the end of this sentence, or in 60 years time; 'too late' is relative. (Phew, made it).

I'm not making assumptions about them applying in your case, but wanted to share in case they're helpful.

</comment></comment></comment></comment><comment><USER25> its not wrong but its also not easy to do, especially when the issue is bigger than not getting a few items on your todo list done.

i totally messed up my career, i backed myself into a corner by ending up a jack of all trades. I saw it coming, i should have been pushing to ensure i was more employable after my positions ended but i became complacent and now im paying the price. I know hindsight is 20/20 but that doesnt really stop the feeling that i should have been better prepared.

so the moral of the story here is dont let yourself fall into that trap in the first place, no job lasts forever, no matter how much praise is heaped on you for what you do your position can end unexpectedly, be ready for it as its easier to do than forgiving yourself for not doing it

<comment><USER26> Could you expand on this? How wide was your experience? What signs did you see of it coming? And what should you have done in your opinion to stay more employable?

<comment><USER25> i can, my job was something of a grey area skill if you will, i worked for various companies to customize or otherwise alter mobile phones for various purposes be that adding branding or apps, creating store demo units, removing sim and region locks etc

The caveat was that all this was done with no manufacturer approval, i had to be able to make any alterations without damaging the warranty of the device, there was no correct process or list of things i was or wasnt allowed to do, as long as i got the job done the how didnt matter.

this left me using all sorts of various tricks, exploits, scripts and tools to do the job, im not a great coder by any means but i know enough to get what i need done in a few languages, i also dealt with basic IT support and another random requests that came in such as data recovery (i have never had any sort of training for any of this, im entirely self taught, my skill isnt in a particular area really, its my ability to adapt and solve problems that gets me by)

The problem was i knew this job was not going to last, as the years rolled on and the security of mobile devices tightened up it became more and more difficult to achieve what was needed, the advent of efuse protection like Samsungs Knox flag made things even harder and many companies previously requiring these solutions were now having custom budget devices direct from chinese oems rather than customizing off the shelf devices from the likes of samsung or htc etc. it became clear that the job wouldnt last.

However i enjoyed what i did, so i became complacent, i just carried on doing my job ignoring the fact that it would inevitably end, i should have been preparing myself for a new career, either strengthening my coding or obtaining IT certifications, anything to ensure i was able to transition into a new industry more smoothly once the inevitable end came.

when i was finally made redundant i found myself in limbo, i lacked call center/customer service skills to get me into first line support roles usually being told i was too technical and better suited to a second line position, however having no experience in a support role i was not getting second line jobs either, usually being told "there was nothing wrong, the other candidate was just a better fit" or something similar i take this generally to mean they had time served in a previous role so were a better prospect

now after a staggering number of applications, phone screens and interviews i have given up on finding a job in IT, i can understand why few are willing to take a chance, it makes sense to take someone with time served over an unknown quantity. I know there are those who will say i just need to keep applying but eventually you have to start considering if your efforts are wasted, especially as the work gap on my CV grows larger.

almost every significant job ive gotten has been because someone took a chance on me or noticed my potential and when they did i have always excelled usually going from "the new guy" to a key player very quickly. it doesnt matter what i have to do i have an ability to get very good very quickly (likely a quirk of my autism) but this isnt something i can really demonstrate and unless potential employers go to the trouble of contacting my previous employers to confirm my claims they have little but my word to go on.

<comment><USER27> Thanks for explaining! Makes a much more concrete lesson!

</comment></comment></comment></comment><comment><USER28> For me, self-criticism basically came from a place of knowing that I could have done better. If things went wrong I always ask what I could have done to have made it go better.

But that also comes from a mentality of being on the bottom and working your way up. At some point the people on the top get to relax. Is that you? Do you get to relax and not climb all the time? That self criticism can cause you to never enjoy anything because you're always trying to reach the next level.

</comment><comment><USER29> I have the same problem, and the weird thing is,at least for me, self- criticism often goes unnoticed.

When i'm on periods of fatigue and "other mysterious illnesses" i often think:

\- I'm working too hard; \- "It's stress"; \- Sleeping bad or tired and don't know why; \- Just keep going, this will pass;

It takes a lot of time for me to understand that self criticism is causing all the problems.

A real life example is, i'm working on a project, and i've been having a good performance and i've been praised about it, but since i'm working alone my head thinks:

\- "They're just motivating me, this doesn't even have 40% unit test coverage". \- "When the i start working with other people, this won't work". \- "When i integrate react with my api, this will go bananas".

Truth is, i have zero evidence of this, and truth is, it's not that bad, but in my head, i have this deep fear that all of those things will become true.

Generally it hits me when i reach point where i'm out of ideas on why i'm feeling so bad and so stressed and i start exercising and my head relaxes and starts thinking and only then i realise, "hey, chill dude. Remember that you have a tone more stuff important than that project, life, wife , kid, cat, family."

And i keep exercising so i stay with a focused mind.

Until i stop because i started a new project or other cool stuff, only to fall on the same trap all over again.

I hate this, and i haven't been able to overcome this for years. It's up and down.

</comment><comment><USER30> Maybe poor social adaptability is an early marker of future poor health.

</comment><comment><USER31> I've come to the conclusion that most perspectives in life are completely relative and purely in the eye of the beholder. Too much self-criticism is thus an overemphasis of one side of the coin. It is not healthy and in most cases not valid

</comment><comment><USER32> "[Self-criticism] can impact our bodies by stimulating inflammatory mechanisms that lead to chronic illness and accelerate aging..."

Does anyone know where I can learn more about this?

<comment><USER33> I don't know if this will be on-topic for you, but:

I'll speculate that chronic self-criticism is, results from, and/or produces chronic stress. Chronic stress is known to be harmful to health in several ways.

You might start with an interesting article [1]: From Stress to Inflammation and Major Depressive Disorder: A Social Signal Transduction Theory of Depression. Not paywalled, maybe a place to begin looking at connections between self-criticism (which I find immensely stressful and debilitating) and consequent illnesses.

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4006295/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4006295/)

</comment></comment><comment><USER34> Also a good reason to leave a nation here or critical spouse/partner..

</comment><comment><USER35> I hope I'm not alone in feeling I've spent a fair bit of time with negative or doubtful people who take a passing interest in my positive unreasonableness.

Cultivating, maintaining and protecting a healthy and positive inner dialogue is so important, as is avoiding doubt worshipping. It's interesting the type of negativity that positivity attracts.

Recognizing doubt worshipping is incredibly beneficial to learn to recognize.

Little by little, aware, or unaware, doubt worshippers spread seeds of doubt, attempting to validate and plant their own self-doubt by projecting their interpreted self-doubts on others. Some seeds of doubt eventually sprout if they make up too much of the energy and mindset around us.

Many doubt worshippers take things very personally even if someone seems happy or is stretching their own boundaries. Society in many ways supports seeking external validation before inner, and buying back our self-worth through many external forms.

I try to surround and anchor the world around me with as many creators, who are creating, in as many ways as possible. It's helped me to remember that innovation can only exist in a mindset of possibility, and keep a buffer between the negativity that can be around.

People who hang onto positivity much longer than most are also great to learn from. Many have learnt how to demonstrate being genuinely happy or supportive of others - something that doubt worshippers don't do for themselves.

Among doubt worshippers, self-criticisms can be found presented as rational thought, skepticism of thought or logical behavior. One question that reveals individuals practicing negativity is: Does it mean there is no understanding of something if a someone hasn't understood it yet and chooses to be skeptical? It would be interesting to explore if faithless cynicism really is productive.

There's a big difference between thinking less about yourself, and thinking less of yourself. One frees you up, the latter can debilitate.

We all can identify behaviour like this in our lives, and sometimes in ourselves. There's benefit from trying to be aware of this. I don't have any answers or desires to change the behaviour of others, only to be able to be free to be as hopeful, and positive as someone else might want to be doubtful and self-defeating.

Learning how to push forward, with incremental and additive effort is much different than pushing yourself through self-criticism.

It's nice to learn to genuinely not give a f about what the world thinks, only what you think, and how well treat yourself, and as an indicator of that, how well you treat others. By setting our own bar, haters often reveal themselves to be doing little themselves and will see what they want to no matter you may want to show.

</comment><comment><USER36> Let's go out on a limb here and consider that people aren't overly self critical, and the problem is actually that they can't do anything about their failure to meet high self expectations, because they are in effect trapped in a prescribed lifestyle where they have no power to make meaningful change.

Let's go out on a limb and consider that while being less critical of yourself addresses the symptoms of disappointment, it doesn't address the causes of inutility of smart and capable people.

Let's consider that the quote "it is no measure of health to be well adjusted to a profoundly sick society" is actually pretty insightful.

We are, as a culture and a species, failing in myriad ways. In my humble opinion, we should feel bad and we should change as well. We're just powerless to do much because of the strength of institutions that exist out of ritual and not out of rationality.

We're left to hate ourselves, because nature and ignorant humans with money and power do not care what we think, and have an answer for everything we do.

<comment><USER37> So what do we do? How can people force the world to change to utilize talented people? Meritocracy works decently in software, but as a too to manage other humans or other groups of humans, is there any good evidence that it will work?

Furthermore, is there evidence that mankind is meant to be well? I've heard native Americans talk about how nobody went hungry and nobody was broke before the concepts that colonialism brought to reality, but isn't that part of the cost of a modern world?

It's horrific that human history reveals that periods of conflict are usually actually pretty helpful for advancing technology (ww2, middle east, Internet to some extent), but there's no obvious alternative.

It seems that humans are invested in not going collectively backwards, technologically and this the possibilities created by new things becomes a sort of ew cursive expectation that we are trying to meet.

Folks a hair older than I am remember a time when man had not gone to space, much less landed on the moon. Now we are within several decades of having permanent structures on the moon that human beings will live on. It took us tens of thousands of years, but now we are here.

Humans being have to go forward until there's a better alternative.

Personally, I think we'll all be better off when AI surpasses us. If we behave, maybe it will fix our planet and leave us somewhere safe while it explores the cosmos.

I don't hate myself, either. I used to, but I had to stop when I put the bottle down. I'm not a psychologist, but self loathing is very often linked to some sort of addiction or disruptive emotional condition, just by my experience with other addicts and other miscreants like myself.

<comment><USER38> Approach, friend.

<comment><USER37> If you have time, would you care to expand?

<comment><USER38> Sorry for not having some deep meaning, it just came to me when I read:

 _I don 't hate myself, either. I used to, but I had to stop when I put the bottle down. I'm not a psychologist, but self loathing is very often linked to some sort of addiction or disruptive emotional condition, just by my experience with other addicts and other miscreants like myself._

I can relate to that - not exactly "putting down the bottle" but with the self loathing, being a miscreant and at the same time letting go of the self loathing. Not suddenly, but bit by bit in different scenarios of life, as I hopefully become a more mature person.

The phrase "Approach, friend" is from a song lyric that stuck with me.

A soldier calls out into the night:

\- Halt! Who goes there?!

\- ... Death

\- Approach, friend.

[http://www.lyricsfreak.com/m/marillion/forgotten+sons_200889...](http://www.lyricsfreak.com/m/marillion/forgotten+sons_20088912.html)

</comment></comment></comment></comment></comment><comment><USER39> NYT trying to inculcate a philosophy of non-critical thinking in a time when there is so little. They're hoping that your valid overstressing concerns will translate into forgiveness for your national identity as well. They're also hoping that you'll feel sympathy for powerful figures, such as when they advocate war and get criticism for it.

Please keep those two things seperable in your mind. Harsh criticism in nearly unlimited quantities is very healthy when directed at the powerful.</comment>


Down the Rabbit Hole and Back Again: The Story of Flowtown - <AUTHOR> http://maplebutter.com/down-the-rabbit-hole-and-back-again-the-story-of-flowtown

<comment><USER2> For me, the exciting thing here is not so much the story of what these guys went through (though it's amazing and totally an inspiration!), but once again the headsmacking move of taking an old offline idea, and pulling it online with a twist (free promotional materials as marketing materials).

What I'd be really interested in is this:

1\. What's the growth strategy longer term?

2\. Has anyone on the team got any offline old-school marketing experience (direct mail etc)?

3\. What related activities could be pulled in with this as a value-add to the consumer? A blog category interviewing users of the service and how they've used it would be invaluable, and a great way of generating great testimonials, for example.

4\. You could potentially end up with a massively valuable data set in terms of looking at what is resonating with consumers, which could be collated and published in some form quarterly. This'd be a huge boon to market researchers, and marketers who deal with broad selections of clients across dozens of market sectors. Hell, I'd pay for it.

5\. I'd be interested in knowing how the 60% reduction was made, and what decisions were taken at that point, plus the rational behind those choices.

</braindump>

(To clarify re. old ideas moved online, I'm thinking LinkedIn, MailChimp, Google Maps style services, which traditionally existed, being pivoted on)

<comment><USER3> Pete,

Thanks for the comment and great questions.

In regards to the future and what we're planning - we try and let the product speak for itself. That way if were wrong, no one knows ;), and it gives us an opportunity to delight and surprise our customers.

re: background - my first startup was MaritimeVacation.com and I used direct mail as my primary marketing channel. Our team has deep DNA in marketing in general - kind of my area of study. <http://www.udemy.com/social-marketing- for-startups/>

re: 60% reduction \- Let go of our customer coaches / contractors \- Everyone took 50% pay cut \- Cancelled any accounts that weren't critical \- Stopped any payable = no money out unless needed to keep the lights on.

I've been doing startups for a while, and from experience, if you need to cut - make it quick and deep.

Hope that answers some of the questions.

<comment><USER2> Thanks for taking the time to reply! Best of luck with the new venture!

</comment></comment></comment><comment><USER4> Great story; definitely an example of why many investors focus on teams rather than ideas.

I'd be curious to learn more about the company's current plans and product; if any of the company's founders are here and willing to share.

<comment><USER3> sawyer, we've always let our product explain itself so not much to add (easier that way ;). if you've registered to join - I'll be sure to send over an invite.

our investors definitely invested in the team and were grateful for having them on board. super supportive and amazing.

</comment></comment><comment><USER5> Hi Dan, I remember listening to you on Mixergy many months ago. One day you should go back and discuss why you pivoted (when you get through this patch).

Small businesses are difficult customers. They are difficult to acquire.

</comment><comment><USER6> 'product gifting will become a dominant channel for finding new customers'... interesting premise.</comment>


Bay Area Cold Snap Rough On San Francisco's Homeless - <AUTHOR> http://sanfrancisco.cbslocal.com/2013/01/11/bay-area-cold-snap-rough-on-san-franciscos-homeless/ <comment><USER2> The cold is always tough on the homeless, but we have a fair amount of shelters so the people on the streets usually don't want to be in them or can't abide by the rules. It is extremely easy to get help if you're homeless in the SFBA, there's no good reason to be on the street. Every once in a while the local news does a story about the homeless, and many things become immediately clear.</comment>


It took less than a minute of satellite time to catch illegal fishing vessels - <AUTHOR> https://arstechnica.com/tech-policy/2017/02/to-catch-a-thief-with-satellite-data/ <comment><USER2> Good work. We'll never use resources sustainably if we can't properly account their usage.

> Plus, unregulated fishing boats often use incredibly dangerous equipment to > fish, like trawlers. Dolphins, turtles, and seals get caught up in these > nets along with the target species and are ultimately killed and thrown > away. "It's not like a guy with a rod and reel," Hammerschlag said. "Trawls > are basically underwater bulldozers. When they take up shrimp or crabs, they > pretty much bulldoze bottom of ocean and pull up everything. That creates an > uninhabitable area for other organisms. You're kind of putting salt in the > fields, and it takes hundreds or thousands of years to grow things there > again."

I'm curious why they focus on these illegal fishers being trawlers as if that's something unusual. Trawlers are very common in legal fishing, including in western countries. But I don't see much focus on curtailing their use there. Are they as bad as the article makes them out, or are these trawlers somehow especially bad?

</comment><comment><USER3> Title seems to be wrong. Article discusses fishing, not shipping.

<comment><AUTHOR> My bad, corrected, thanks for pointing it!</comment></comment>


It's 2015 and drawing text is still hard - <AUTHOR> https://engineering.eventbrite.com/its-2015-and-drawing-text-is-still-hard-webgl-threejs/ <comment><USER2> I have been working a lot with WebGL text in the past several months. Our current solution uses SDF with standard derivatives (crisp anti-aliasing regardless of zoom level) and supports kerning (depending on the font), batched glyphs, and word wrapping. It's not perfect, but it's pretty good for common use cases.

Since the OP is using modules already, they might enjoy some of the libraries and tools here:

[https://www.npmjs.com/package/text- modules](https://www.npmjs.com/package/text-modules)

Or a ThreeJS specific implementation of bitmap / SDF:

[https://github.com/Jam3/three-bmfont-text](https://github.com/Jam3/three- bmfont-text)

And lots more reading on the subject:

[http://mattdesl.svbtle.com/material-design-on-the- gpu](http://mattdesl.svbtle.com/material-design-on-the-gpu)

Some practical implementations of it:

\- npm dataviz: [http://mattdesl.github.io/npm- names/](http://mattdesl.github.io/npm-names/) (over 40k glyphs, could go higher)

\- physical text: [http://mattdesl.github.io/physical- text/index.html](http://mattdesl.github.io/physical-text/index.html)

<comment><AUTHOR> Whoa that's really cool!

</comment></comment><comment><USER3> Drawing text _is_ hard, and not something that should be solved at the OpenGL level. It involves coordinating with the window manager and user settings.

But I'm just responding to the gimmicky title. It looks like the article has some interesting technical content to it.

<comment><USER4> > Drawing text is hard, and not something that should be solved at the OpenGL > level.

Agree completely with the first part, less sure about the second. Almost everything needs to do it. Text rendering _was_ included in OpenVG, which seems to have flopped completely. And rendering _anything_ to the screen with OpenGL will involve coordinating with the window manager.

Mark Kilgard's gigantic NV_path_rendering extension included a LOT of font/glyph support. It surprised me as well when I first read it, but there's some interesting discussion of the rationale in the second item of the Issues list at the end of the spec [1].

[1] [https://www.opengl.org/registry/specs/NV/path_rendering.txt](https://www.opengl.org/registry/specs/NV/path_rendering.txt)

</comment></comment><comment><USER5> Google "loop blinn". There are a few papers by those guys on the topic of rendering smooth anti aliased cubic bezier paths, which is really what you want.

You can read font data directly from ttf e.g. And render text nicely with few polygons and shaders taking care of very nice accurate edge rendering.

I wrote a half finished c implementation a couple of years ago that might be useful as a reference if you want to look into this more : [https://github.com/hansent/lbfont](https://github.com/hansent/lbfont)

It's mainly based on the paper/article inter book GPU gems 3.

Accelerated 2D Vector graphics are hard, when I was working on this nvidia was announcing the nv_path_rendering extension; don't know how widely this is supported these days. But I doubt it's available in webgl.

Edit: few typos...writing on mobile

</comment><comment><USER6> Feel free to do a PR with your solution, just so no one has to write a "It's 2016 and drawing text is still hard" blog post next year ;)

<comment><AUTHOR> Ha! I might split out the code into its own repo so it can be used as an add- on library for ThreeJS. I think the code here might push it over the 100kb limit. We'd also need to get a license to SDF'ify a default font (possibly Helvetiker). We had to get permission to do it with our font "Benton Sans".

</comment></comment><comment><USER7> I have been building a tool for interactive data visualization using panda3d. Running absurd amounts hideously complex static geometry? No problem. Want to render short labels on a couple thousand objects? Draw calls aside, renderer slows to a crawl because it also uses the text geometry approach. Does anyone know if there are other approaches that work aside from the the SDF described in the article?

<comment><USER2> If you are OK with (a) processing font atlases offline and (b) simple languages (no complex text layout) then SDF fonts is a really great solution. It's fast, memory efficient, easy to anti-alias, and real-time effects (shadows, edge fuzz, etc) are easy to add.

</comment></comment><comment><USER8> This site looks terrible in chrome.

[https://i.imgur.com/39warVl.png](https://i.imgur.com/39warVl.png)

<comment><USER9> Did a quick check and it looks fine in Chrome v44 on OSX 10.11, Windows10 and Android.

More on-topic: text rendering _is_ a hard problem, kerning and UNICODE support is only the beginning of the rabbit hole. Once you need to render Arabic, you also need bi-directional text rendering (normal text is RTL, number and latin- characters-strings are LTR), and you also need context-sensitive glyph-shaping (the same character is rendered differently depending on whether it stands alone, at the beginning, end or middle of a word).

</comment></comment><comment><USER10> Who or what says it should easy?</comment>


Show HN: A marketing directory for channels, activities and requirement specs - <AUTHOR> https://www.actioncy.io/ <comment><USER2> Looks super helpful</comment>


Beware surfers: cyberspace is filling up - <AUTHOR> http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article6169488.ece

<comment><USER2> I thought this was a joke, but I think the author is serious.</comment>


Science: Sequestered and Shut Down - <AUTHOR> http://discovermagazine.com/2014/jan-feb/65-science-sequestered-and-shut-down

<comment><USER2> "The full text of this article is available to Discover Magazine subscribers only."

I'll just close the tab, then.</comment>


Working on anything cool that'll get traction? You'll get cloned in China. - <AUTHOR> http://twitter.com/#!/christinelu Tweet from  @christinelu: ...so that no one's surprised. i've heard of a clone for AirBnB, Uber, Gilte, Instagram, and [insert your favorite new app] in China. <comment><AUTHOR> @christinelu tweets: ...so that no one's surprised. i've heard of a clone for AirBnB, Uber, Gilte, Instagram, and [insert your favorite new app] in China.

</comment><comment><USER2> Bad link - it'll be out-of-date as soon as the subject tweets a few more times.</comment>


How cheap does solar power need to get before it takes over the world? - <AUTHOR> http://www.vox.com/2016/4/18/11415510/solar-power-costs-innovation <comment><USER2> I think the issue is that OK, say we managed to get to 100% electricity being solar when the sun is shining.

You'd still have the time the sun is not shining, which would likely be more expensive than before (a gas powered plant would only be running half the time - effectively doubling its capital/construction cost per kWh).

So you'd definitely have an improvement on some levels but I'm not sure that would really help that much.

The real big breakthrough would be somme big improvement on storage. I'm not convinced this will happen quickly (at least not in anyway similar to the declining cost of PV panels). The consumer electronics industry has been paying $$$ for decades for better batteries/battery r&d and has seen pretty poor gains.

I think Tesla and the electric car manufacturers will definitely rapidly get the price down by say 30% because of economies of scale but will then hit a brick wall as more of the cost becomes raw materials, transport, etc which will set a floor on the cost of batteries.

Happy to be proved wrong though :)

<comment><USER3> Everyone seems a bit obsessed by batteries as a storage method, when we have more traditional methods:

\- Pumped-storage hydroelectricity - [https://en.wikipedia.org/wiki/Pumped- storage_hydroelectricit...](https://en.wikipedia.org/wiki/Pumped- storage_hydroelectricity). Sure it's not suitable everywhere.

\- There's always Molten Salt as well - [http://www.solarreserve.com/en/technology/molten-salt- energy...](http://www.solarreserve.com/en/technology/molten-salt-energy- storage).

Also, solar isn't the be all and end all of renewable energy generation. Wind, Solar, Hydro, and Geothermal all have different strengths and weaknesses, and flexibility of generation is important.

But above all, I think security of supply is probably the number 1 requirement (unless you're a big fan of load shedding - [https://en.wikipedia.org/wiki/Rolling_blackout](https://en.wikipedia.org/wiki/Rolling_blackout)), and therefore, we'll still need energy sources that are reliable.

I predict a move away from coal towards natural gas. Sure it's not perfect, but it's not the worst either.

<comment><USER4> Similar to pumped water storage I wonder if we could do a household version with weight. Something like the gravity light (gravitylight.org) but on larger scale. I wonder if we could see a resurgence of chimneys on houses except now instead of letting smoke out they contain a XY ton weights that gets pushed up by excess solar capacity during the day, and then drops by evening powering the house.

I have no idea if that's realistic. Does someone know what the weight/distance to power output would be limited at...

<comment><USER5> A much better and denser option for storing energy mechanically is flywheels. I haven't researched what happened to this option since but when I was looking into it 15 years ago it seemed like a good option that needed more R&D into frictionless axles and vacuum chambers.

<comment><USER6> Excellent rapid response, second only to capacitors. But pretty poor densities, and hugely significant engineering challenges.

Flywheels that don't become fly-apart wheels is one problem.

Containment of fly-apart wheels another. Buried concrete pipes are usually what you're looking at. You need _mass_ to contain these things.

The per-kg energy densities just aren't all that high. If you want reactive load to soak up very short-term demand / supply fluctuations, you can get that. And you've got crazy charge-discharge cycles.

Bearings are mostly solvable with magnets, as I understand. But you still lose a given percentage of storage over short time -- ~1% per hour or so, within a few powers of 2. Enough that long-term storage isn't viable.

And the thing that really screws you over is that the Earth moves. Geometric precession of your flywheel is something you've got to deal with.

There's a place, but I don't think it's large-scale, long-term grid storage.

</comment></comment></comment></comment></comment><comment><USER7> Installation has to get much cheaper. Installation is now more than the cost of the panels for most single family home installations. Home roofs are poor support surfaces.

Panels which _are_ the roof have potential. The "solar shingle" vendors are making progress.[1]

[1] [http://msdssearch.dow.com/PublishedLiteratureDOWCOM/dh_0944/...](http://msdssearch.dow.com/PublishedLiteratureDOWCOM/dh_0944/0901b80380944dfa.pdf)

<comment><USER8> I'm amazed that they aren't integrated much more. Roof materials already have a cost. For example, one could create big roof tiles that are mostly solar panel. Edges have to overlap so it's a good idea to not have the panel extend there. One could lay them like other traditional flat panels, in an overlapping fashion. Since the actual panel is so cheap, that shouldn't bring up the cost of the roof panel much.

The wiring can be on the underside and can be then connected after construction. (By some other team than roof constructors). After 30 years, they can be swapped. There might be some new technology then.

Another alternative would be roll-out plastic panels on ordinary roof materials. External wiring.

Everything should be laughably easy if you don't need to deal with snow and ice. They are a whole new design problem. To best limit CO2 emissions, the manufactured panels should be installed in places with best production ability, so freezing tends not to be among the first problems.

</comment></comment><comment><USER9> Storage is the /only/ way for solar to provide baseload power. Pumped water storage is vastly cheaper than batteries, and a better example of grid scale storage today. I should add that battery prices are coming down as volume increases (manufacturing learning curve), but not as fast as photovoltaic cells.

Elon Musk's goal with tesla is to boost battery production volume significantly to reduce the cost of batteries.

This is a really low quality article.

<comment><USER10> Pumped water storage is awesome where you have the geography to support it.

Alas, that's not everywhere.

<comment><USER11> Furthermore, mountains, canyons, and valleys are beautiful and valuable as they are.

<comment><USER12> That hasn't stopped us digging them up for coal though.

</comment></comment></comment></comment><comment><USER13> There's another large effect that is left out of this story. As solar gets cheaper, and as we get more of it, it reduces the marginal pressure on fossil fuel production. That, in turn, makes fossil fuels cheaper and forces solar to get cheaper still to compete.

<comment><USER6> Solar doesn't much compete with petroleum. Its main effect is to reduce prices for coal. You'd expect that this might start to affect the profitability of coal companies eventualy....

For solar to affect _petroleum_ , whose primary use is _transport_ , we'll need to solve the storage problem. _Tesla notwithstanding that has not happened._ Electric vehicle sales were 0.66% of _unit_ auto sales in 2015, and actually represented a sharp numeric _decrease_ from 2014.

(The _dollar_ volume is higher given the higher price of electrics, but it's unit sales you want to watch.)

<comment><USER14> _> For solar to affect petroleum, whose primary use is transport, we'll need to solve the storage problem._

The obvious solution here is solar-generated biofuel, such as the algae projects now being investigated.

<comment><USER15> That's not necessarily the correct solution - there's competing chemical processes like Fischer-Tropsch.

<comment><USER6> Once you've got electricity, FT appears to win. Though again, there's the ages of investigation without large-scale application, on a power-to-fuels basis.

Sasol, the South African energy company, did run commercial coal-to-liquids via Fischer-Tropsch, since the 1950s, and I believe may still do so. The US tried but ran into technical issues.

</comment></comment></comment></comment></comment><comment><USER16> My biggest concern with solar power (which, by the way, may be based on outdated information) is that the production of photovoltaic cells produce more greenhouse gasses than will be spared in the cell's operational lifetime.

To ask an actual question: is this still the case? (Was it ever?)

<comment><USER17> This is directly tied to EROEI. If the EROEI of a cell is greater than 1X, it will produce more energy that it took to manufacture it. In that case it's net-negative -- over time it replaces fossil fuels in a net sense.

Lately I've read EROEI numbers for solar PV from 10-15X.

So no, this is not true, and likely has not been true for a long time. It might have been true back when PV was kind of a lab curiosity and niche item.

<comment><USER18> The interesting thing is the EROEI (energy returned on energy invested) for oil and gas has been falling for a century. I remember reading somewhere a claim that historical EROEI for crude oil.

        Year   EROEI
        1920     125
        1970      30
        2010      15

Things like tar sands are less than 10.

<comment><USER19> Some tar sands are below 1 once you include refining and transportation.

<comment><USER18> Everything I've read about tar sands leads me to propose, 'yeah lets just not do that'

</comment></comment></comment></comment></comment><comment><USER20> There's an economics caveat to interpreting solar prices, which I think may have put a lot of people on the wrong track.

Suppose solar panels were priced such that, after accounting for installation costs and subsidies and everything else, solar was much cheaper than grid power and paid off quickly. Then pretty much everyone would want one, and the manufacturer would have a huge backorder. So the manufacturers wouldn't do that; instead, they'd price the panels a little higher, sell everything they could produce but not have the backorder, and invest the extra money into expanding their production capacity.

I think this is where we're currently at; solar power is in fact cheaper than grid power, it's just priced to support investment into expanding the manufacturing/installation capacity to properly take over.

<comment><USER21> > _Suppose solar panels were priced such that, after accounting for > installation costs and subsidies and everything else, solar was much cheaper > than grid power and paid off quickly. Then pretty much everyone would want > one, and the manufacturer would have a huge backorder. So the manufacturers > wouldn 't do that; instead, they'd price the panels a little higher, sell > everything they could produce but not have the backorder, and invest the > extra money into expanding their production capacity._

That's what finance is for. I assume if this were actually the case, wouldn't the manufacturers _take_ the backorders and separately raise money for expanding their production capacity? I don't buy it.

<comment><USER10> Manufacturers will sell as expensive as they can get away with. Of course, there's decent competition in this market to counteract that.

jimrandomh's scheme would require a significant amount of collusion between all major producers.

<comment><USER20> No, it's just that building a solar-panel factory is really expensive and has a longer lead time than customers will wait.

<comment><USER10> Isn't that the same with almost any kind of factory? If I was in the market for a car or computer, I wouldn't want to wait for a new factory to be build, either.

Is that anything special about the solar-panel industry?

</comment></comment></comment></comment></comment><comment><USER22> It says a lot about the progress of solar if the big worry is that it won't provide 100% of all energy by itself.

Even cheaper solar would be nice but I'm not sure why it would be better than a radical battery breakthrough or some cheap and cheerful fusion thing or some mix of different solutions.

<comment><USER18> If you run the numbers pumped heat storage can likely do the job of time shifting electric power from daylight hours to night time.

The pricing structure will flip though, electricity at night costing probably 2-3 times peek daytime rates. One would expect industrial users would adjust and avoid using power at night[1]. That would reduce demand.

[1] Think of a mini-mill (steel) that currently runs its electric furnaces at night when rates are cheap. If rates are cheaper in the day they'll switch to daytime operation.

<comment><USER23> I thought blast furnaces ran 24/7 and if they shut down you need to effectively rebuild parts of them.

<comment><USER18> You are correct integrated mills use blast furnaces and thus can't stop. However Mini mills are secondary producers. They process scrap into finished steel. Since they use electric furnaces they can start and stop production.

</comment></comment></comment></comment><comment><USER24> A significant impediment is handling peak usage power. Maybe solar can provide most of our energy needs, but for those times where peak power is needed, it's probably more sensible to take a more balanced/mixed approach.

*edit looks like the article has a convenient link to another article talking about this exact problem:

[http://www.vox.com/2016/2/12/10970858/flattening-duck- curve-...](http://www.vox.com/2016/2/12/10970858/flattening-duck-curve- renewable-energy)

</comment><comment><USER25> People are comparing the wrong things when it comes to solar, and that leads to solar not showing how expensive it truly is.

For one, there is nowhere where solar is the baseload power, because it can't be, so it gets a bit of a "free rider" advantage. For another, solar plants depreciate like any other, but those costs aren't really factored in to a lot of solar power costs yet.

We'd need to build out a significant amount of energy storage capacity and change a lot of the grid as well in order to fully adopt solar as a baseload power source. And that would increase its cost by non-trivial factors. Would it still be worthwhile? Maybe?

</comment><comment><USER26> This is a poorly researched article with many inaccuracies.

(1) Utility Scale Solar is already less <$1/W installed in India, and heading for sub $1.5/W in US.

(2) The price of Solar PV panels is already at $0.40/W. US-based $FSLR is has a roadmap to get to $0.25/W by _2019_. In addition PV efficiency is increasing by 10% yoy. This is just from purely riding the 'industrial learning curve'. See [1].

(3) "Value deflation" is a policy issue that has a simple policy solution. As a tech that produces an intermittent product, but has high fixed-costs but zero-marginal costs - solar (like wind) should be financed (and paid for) via a fixed tariff (feed-in tariff or FiT). See [2]. This is how Solar is financed in the rest of the world outside the US. If 'value deflation actually became an issue - then my guess is that regulators in the US would step in (but one can never say with US regulators who tend to get captured by various lobby groups).

(4) Solar will account for 30% of all new capacity power additions going forward globally. This is happening - now. There is over 100,000MW installed globally already.

In addition - every time solar or wind comes up for discussion on HN or elsewhere, the same misconceptions and confusions about baseload, intermittency and costs arise.

To summarise the counter-points again:

(1) Renewables does not need to be base-load or compared to 'base-load'. 'Base-load' is spectrum not a point. See [3]

(2) There is a difference between intermittent and 'unplanned'. Planned vs unplanned is the main issue. Even nuclear has unplanned shut-downs - no tech has a 100% 'capacity factory' running 24/7 365 days. see [4]

(3) Renewables can get to 60-80% penetration via:

(a) increasing efficiencies (happening now)

(b) increasing energy storage efficiencies with declining prices (happening now)

(c) geographical grid-integration (happening slowly)

(d) more flexible software-led demand-side and supply-side management (happening). See [5]

[1] [http://www.bloomberg.com/news/articles/2016-04-14/first- sola...](http://www.bloomberg.com/news/articles/2016-04-14/first-solar-making- panels-more-cheaply-than-china-s-top-supplier)

[2] [http://www.greentechmedia.com/articles/read/3-ways- renewable...](http://www.greentechmedia.com/articles/read/3-ways-renewable- energy-can-grow-in-a-21st-century-grid)

[3] [http://cleantechnica.com/2016/03/02/base-load-power-is-a- myt...](http://cleantechnica.com/2016/03/02/base-load-power-is-a-myth-used- for-defending-the-fossil-fuel-industry/)

and [http://cleantechnica.com/2014/08/08/rmi-blows-lid- baseload-p...](http://cleantechnica.com/2014/08/08/rmi-blows-lid-baseload- power-myth-video/) [short video in article]

[4] [http://www.energypost.eu/dispelling-nuclear-baseload-myth- no...](http://www.energypost.eu/dispelling-nuclear-baseload-myth-nothing- renewables-cant-better/)

[5] Links on renewable energy penetration potential

\- NREL Analysis of how to achieve high-penetration renewables in US [http://www.nrel.gov/analysis/re_futures/](http://www.nrel.gov/analysis/re_futures/)

\- Ramez Naam [http://rameznaam.com/2016/01/31/how-far-can-renewables-go- pr...](http://rameznaam.com/2016/01/31/how-far-can-renewables-go-pretty-darn- far/)

\- California [http://ww2.kqed.org/science/2016/04/04/what-will- california-...](http://ww2.kqed.org/science/2016/04/04/what-will-california- do-with-too-much-solar/)

</comment><comment><USER27> I think the biggest impediment to widescale solar adoption is legeslative.

If you follow hackernews, you'll regularly see articles about places like Florida (and possibly Nevada if memory serves) where solar could easily power homes, but disingenuous legislative instruments and manipulativly worded ballot initiatives are housed to effectively block solar adoption.

This is an example of the top result in Google news [http://www.miamiherald.com/news/local/news-columns- blogs/fre...](http://www.miamiherald.com/news/local/news-columns-blogs/fred- grimm/article69905142.html)

Not the greatest example I've seen, but again, if you follow HN you've seen variations on this story dozens of times.

Lobbyists protect big utilities instead of facilitate solar.

It's tragic to think how much further along we could be.

<comment><USER28> Another example of what you mentioned: [http://arstechnica.com/science/2015/12/north-carolina- citize...](http://arstechnica.com/science/2015/12/north-carolina-citizenry- defeat-pernicious-big-solar-plan-to-suck-up-the-sun/)

<comment><USER27> That reads like satire.

</comment></comment></comment><comment><USER29> A: It needs to get efficient enough and paired with storage to survive the regulatory kickback.

Power companies and non-solar ratepayers will get increasingly unhappy with net metering customers. That joyride will end.

<comment><USER30> Next up: taxes on solar cells?

<comment><USER31> Hopefully not before taxes on greenhouse gas emissions.

</comment></comment></comment><comment> alok-g >> 25 cents per watt by 2050 — down from around $3 per watt today

Can I trust a report that does not even have the units right?! Price should be proportional to energy (i.e., Joules or Watt-seconds) not power (Watts).

<comment><USER32> Huh? What's wrong with measuring in price/watt? Price/watt is actually the standard for comparing electricity generation due to not having to create arbitrary units of time to compare with</comment></comment>


X86 MMU fault handling is turing complete - <AUTHOR> https://github.com/jbangert/trapcc <comment><USER2> This is more or less the greatest thing I've learned about in the last couple years.

What's happening here is that they're getting computation _without executing any instructions_ , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to.

This works because when you attempt to resolve an invalid address, the CPU generates a trap (#PF), and the handling of that trap pushes information on the "stack". Each time you push data to the stack, you decrement the stack pointer. Eventually, the stack pointer underflows; when that happens, a different trap (#DF) fires. This mechanism put together gives you:

        if x < 4 { goto b } else { x = x - 4 ; goto a }

also known as "subtract and branch if less than or equal to zero", also known as "an instruction adequate to construct a one-instruction computer".

The virtual machine "runs" by generating an unending series of traps: in the "goto a" case, the result of translation is another address generating a trap. And so on.

The details of how this computer has "memory" and addresses instructions is even headachier. They're using the x86 TSS as "memory" and for technical reasons they get 16 slots (and thus instructions) to work with, but they have a compiler that builds arbitrary programs into 16-colored graphs to use those slots to express generic programs. Every emulator they could find crashes when they abuse the hardware task switching system this way.

Here's it running Conway's Life:

[http://youtubedoubler.com/?video1=E2VCwBzGdPM&start1=0&#...
Here's their talk for a few months back:
http://www.youtube.com/watch?v=NGXvJ1GKBKM
The talk is great, but if you're not super interested in X86/X64 memory corruption countermeasures, you might want to skip the first 30 minutes.

<comment><USER3> The slides in the github repo ( [https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s...](https://github.com/jbangert/trapcc/blob/master/slides/PFLA- shmoocon.pdf) ) also have a few interesting points, like "No publicly available simulator implements this correctly" (how did they record the youtube video?) and a few vague hints about exploiting this for doing VM escapes.

<comment><USER4> > how did they record the youtube video?

By running it on a physical machine. Unless there is a requirement that the processor not be multitasking that I am missing.

<comment><USER5> The Life video pretty clearly shows it running in Bochs. I assume they fixed it up.

<comment><USER6> Author here: Actually, the slide 'no publically available simulator implements this correctly' is somewhat misleading (it had a follow up slide that I cut and replaced by verbal comments - I should re-add it to the PDF). What I meant is that the entire mechanism (Task switching, page fault handling, etc.) is not implemented correctly on any sim, i.e. you have subtly different behavior. This was quite a challenge in debugging this in the first place, so I actually wrote the code to work around any bochs quirks I encountered -- just so that I have a debug environment.

</comment></comment></comment></comment></comment><comment><USER6> Author here: While it is true that with the current implementation, memory access is extremely limited (essentially one DWORD per page, or about 0.1% of the available physical RAM) that limitation can certainly be avoided. For one, you could shift how the TSS is aligned (and align them differently for different instructions), multiplying your address space by a factor of 10 or so. Furthermore, you could also place another TSS somewhere in memory (only a few of the variables need to actually contain sane values) with an invalid EIP and use that as a 'load' instruction.

The easiest way however would be to use the TrapCC mechanism to transfer control between bits of normal assembler code (perhaps repurposed from other functions already in your kernel), doing something similar to ROP. Of course, for additional fun, feel free to throw in BX's Brainfuck interpreter in ELF and James Oakley's DWARF exception handler. We might drop a demo of this soon, i.e. implementing a self-decrypting binary via page faults.

<comment><USER7> "memory access is extremely limited (essentially one DWORD per page" – referring to non-code addresses, yes? In the current (simplest) implementation, each instruction (a TSS) must be aligned across a page boundary. You do comment below that altering alignment could increase the available code space.

I'm wondering what method PFLA uses to read/write non-code addresses. Only one address per page can be addressed? I'll take a look at the compiler.

By simply expanding the addressing capability, a very tiny program could emulate an instruction stream from memory, overcoming the limited code space (at the cost of execution speed).

Cheers!

</comment></comment><comment><USER8> >Move, Branch if Zero, Decrement

This is basically the canonical instruction for OISCs (one instruction set computers). Wikipedia describes it pretty well: [https://en.wikipedia.org/wiki/One_instruction_set_computer#S...](https://en.wikipedia.org/wiki/One_instruction_set_computer#Subtract_and_branch_if_less_than_or_equal_to_zero).

</comment><comment><USER9> There was a talk on 29c3 about this. Abstract:

[https://events.ccc.de/congress/2012/Fahrplan/events/5265.en....](https://events.ccc.de/congress/2012/Fahrplan/events/5265.en.html)

video:

<https://www.youtube.com/watch?v=NGXvJ1GKBKM>

</comment><comment><USER10> Another place for root kits to hide.

<comment><USER11> Could one write a preemptive rootkit that sniffs for other rootkits?

Would that slow things down incredibly?

<comment><USER12> That's called an antivirus :)

</comment></comment></comment><comment><USER13> How fast (slow) is this relative to the host CPU?

<comment><USER12> Probably incredibly slow given the reduced instruction set and that it relies on context switches/pushing stuff on the stack for functioning.

</comment></comment><comment><USER14> This is really interesting. In a way, it's a form of computer self- replication. Could the virtual machine created by the computer be considered offspring?

Is there a way the virtual machine might spawn another virtual machine child of its own?

</comment><comment><USER15> if you like this kind of things there is also:

[http://www.cs.dartmouth.edu/~bx/elf-bf-tools/slides/ELF- berl...](http://www.cs.dartmouth.edu/~bx/elf-bf-tools/slides/ELF- berlinsides-0x3.pdf)

</comment><comment><USER16> That the hardware version of the brainfuck philosophy.

<comment><USER17> Best explanation ever. I second this. lol

</comment></comment><comment><USER18> Expect this technique in the future malwares and software protection DRM systems for making code analyzing harder.

</comment><comment><USER19> somebody checked in vim backup files :-)</comment>


Who's Left to Embarrass Silicon Valley Now That Peter Thiel Has Killed Gawker? - <AUTHOR> http://www.slate.com/blogs/moneybox/2016/08/19/gawker_and_valleywag_are_dead_who_s_left_to_embarrass_silicon_valley.html <comment><USER2> Peter Thiel didn't kill Gawker. Gawker killed Gawker.

</comment><comment><USER3> The answer is slate.com, clearly.

</comment><comment><USER4> Mike Judge and Silicon Valley.</comment>


Basketball boxscores in HD - <AUTHOR> http://statsheet.com/blog/statsheet-boxscores-in-hd-now-with-plus-minus

<comment><AUTHOR> A little off topic for HN, but I'm been working to make the standard basketball boxscore more visually appealing and information rich. Appreciate any feedback.</comment>


Meteor dropped the ball with Galaxy - <AUTHOR> http://blog.andreipolmolea.com/meteor-dropped-the-ball-with-galaxy/ <comment><USER2> I think maybe not so much, reading the original blog post announcing Galaxy:

"What about a free option? We've always offered free hosting to every Meteor developer through our meteor deploy feature. It's never going away. Now that we've had a chance to shake out key parts of Galaxy's technology stack with large production apps, we're ready to transition that free meteor deploy service to Galaxy. We've already started on that work, so that every developer can use Galaxy free of charge for simple apps, or purchase smaller plans for projects that aren't a fit for a full commercial plan."</comment>


Apache web server bug grants root access on shared hosting environments - <AUTHOR> https://www.zdnet.com/article/apache-web-server-bug-grants-root-access-on-shared-hosting-environments/ <comment><USER2> Found this, looks like a more detailed writeup of whats going on. [https://cfreal.github.io/carpe-diem-cve-2019-0211-apache- loc...](https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local- root.html)

<comment><USER3> This part is concerning:

> Apache's team has been prompt to respond and patch, and nice as hell. Really > good experience. _PHP never answered regarding the UAF._

<comment><USER4> FWIW I reported it to PHPs bugtracker: [https://bugs.php.net/bug.php?id=77843](https://bugs.php.net/bug.php?id=77843)

I expect that it'll be fixed, not not handled as a security issue, as it doesn't fit within PHPs model of security vulns.

<comment><USER5> > This looks like it requires specially crafted code, therefore not a security > issue.

I'm not sure how I feel about such a response. Many exploits require odd, but valid code, and more often than not it exists out there.

Also, it feels weird for this to be tagged as a JSON issue?

<comment><USER6> Basically they don't consider the engineer exploiting the interpreter to be a security vulnerability. That seems a bit dubious, but I can see where they are coming from in treating the script author as a trusted party.

</comment></comment></comment></comment></comment><comment><USER7> > Because on most Unix systems Apache httpd runs under the root user, any > threat actor who has planted a malicious CGI script on an Apache server can > use CVE-2019-0211 to take over the underlying system running the Apache > httpd process, and inherently control the entire machine.

Maybe I am conflating things or mixing something up, but I was under the impression that it only used root-privileges to obtain access to restricted ports and immediately afterwords lowered its privileges lever to something sane/non-risky.

And if that is how it operates, then this exploit should not be effective.

Is that wrong? Have I been misled?

<comment><USER8> > Because on most Unix systems Apache httpd runs under the root user

This hasn't been true for what, 10+ years? Apache runs as user www-data on Ubuntu/Debian and as user httpd on Redhat / SUSE based distributions.

You're entirely right, but this is a bit of embellishment on the part of the exploit author (even though it is serious!)

<comment><USER9> Lots of people install from source and just sudo everything because that's all they know.

<comment><USER10> The vanilla APACHE_RUN_USER/_GROUP is daemon/daemon so they're fine. daemon and nobody are users that by definition have no permissions on the host.

</comment></comment></comment></comment><comment><USER11> Wouldn't SELinux disallow writing to the cgi folder, unless that attribute were explicitly set?

<comment><USER12> Almost everywhere I've worked ends up turning off Selinux rather than learn how to actually configure/use it properly, which of course is ridiculous when it's not actually that hard to learn or configure at all generally, but such is the reality of many places it seems.

</comment></comment><comment><USER13> For something this severe, there doesn't appear to have been coordination with large shared hosting providers to ensure the patch was applied before public disclosure of a PoC. Is there a system in place for this?

<comment><USER14> It doesn't effect CentOS 7, which is what most hosting providers run on.

<comment><USER15> How do you know it doesn't affect CentOS 7? Please provide a citation for your claim. :)

<comment><USER16> I'm not the person you're replying to, but:

[https://access.redhat.com/security/cve/cve-2019-0211](https://access.redhat.com/security/cve/cve-2019-0211)

My guess is because they're on an older version (2.4.6) that isn't affected. But that all depends on what patches have been applied to the RHEL/CentOS version.

</comment></comment></comment></comment><comment><USER17> >> less-privileged Apache child processes (such as CGI scripts) can execute malicious code with the privileges of the parent process.

Vulnerabilities always seem to be related to CGI scripts somehow.

<comment><USER18> Something that makes the cgi process not a child of the Apache process wouldn't be subject to this. Like a fcgi process.

<comment><USER19> I'm surprised FastCGI isn't more popular for that reason. Using PHP as an example, Apache + mod_php executes all code under Apache's user/group. If, instead, you use PHP-FPM, you can lock down the execution environment much more.

PHP-FPM supports an arbitrary number of named pools, each of which may be configured with its own user/group pair. Ideally, each virtual host gets its own pool.

e.g.,

        [poolname]
        user = poolowner
        group = poolgroup

        listen = /run/php/php7.2-fpm-poolname.sock
        listen.owner = www-data
        listen.group = www-data
        ...

<comment><USER20> _> I'm surprised FastCGI isn't more popular for that reason._

FastCGI is more faf to configure where mod_php is more likely to be configured out of the box. Most shared hosting environment are configured entirely out- of-the-box as the market is so saturated and margins so low there is no way to justify anything else. Potential customers who care much about security will most likely be looking for their own dedicated server or VM instead so there isn't really much of a market for a more secure shared host.

Also if packing as many users as possible into as little hardware as possible, which is the only way to make any margin in shared hosting these days, you'll find mod_php more efficient by this measure. You don't have a pool of processes that only specific users can take advantage of, taking up an amount of RAM (however small) each even when not actively in use.

So FastCGI tends to be used less. When I ran PHP I used it, usually as you suggest one pool per vhost, but I was only hosting my own projects and some bits for friends & family, so I didn't need to justify the setup effort against any "bottom line".

<comment><USER21> I've noticed the opposite.

More people are starting to realize that FastCGI is one of the keys to good and consistent performance (as much as PHP will allow, anyway) and are recognizing that mod_php for the disaster that it is.

So now more and more popular environments support it - cPanel gained native PHP-FPM support, and commercial shared web hosts are mostly using Litespeed (drop-in replacement for Apache httpd that is evented and invented its own FCGI-like called "LSAPI").

Not sure if I totally agree with mod_php being more efficient for a greedy host either - attaching the PHP runtime to the threaded/forked httpd request handler is very expensive.

You can set the per-pool minimum worker size to 0 with FCGI with a short keepalive, which allows you to keep a low average per-tenant memory footprint, but better performance when many requests arrive at once. That's also basically what Litespeed does.

<comment><USER18> _" one of the keys to good and consistent performance (as much as PHP will allow, anyway)"_

I've found that caching any results of logic that's repeated per request makes PHP pretty damn fast. I use apcu, it saves state with an mmap backed cache.

</comment></comment></comment></comment></comment></comment><comment><USER22> Who's still using Apache?

<comment><USER23> I use it. On purpose. It's a good general purpose web server and does a good job.

<comment><USER24> It's also copiously documented and extremely well-understood. There will always be bugs in software but you can usually fix problems quickly, there's few surprises or gotchas. I trust it.</comment></comment></comment>


Let's discuss: Will IE8 follow IE6 footsteps? - <AUTHOR>

Microsoft left out XP users from IE9. 50% of population use XP. No ways to upgrade to better browser. What are your thoughts and development plans? <comment><USER2> I'm not worried about it. Browsers are more fragmented that they've ever been. I'm going to leave the compatibility stuff to library writers like socket.io, persistance.js, etc. And when those aren't available or are too complicated, I'm just going to write to the most modern browsers and concede a certain segment of web users (the least valuable, in my opinion), won't be able to use my app.

</comment><comment><USER3> At least IE6 was good in its day. IE8 has always sucked so it's probably going to be as much of a burden even if the time that XP lingers on is less than the time that IE6 stagnated after they disbanded the development team.

It doesn't help that browser innovation elsewhere is accelerating. IE8 will still be around and competing with Firefox 10 and Chrome 27.</comment>


Apple burns developer goodwill with surprise release of iOS 14 - <AUTHOR> https://techcrunch.com/2020/09/16/apple-burns-developer-goodwill-with-surprise-release-of-ios-14/ <comment><USER2> Surprise? The first beta was released 3 months ago.

<comment><USER3> Follow the discussion here.

[https://news.ycombinator.com/item?id=24490326](https://news.ycombinator.com/item?id=24490326)

saagarjha's comment nails it.</comment></comment>