Hackers Were Inside Citrix for Five Months - <AUTHOR> https://krebsonsecurity.com/2020/02/hackers-were-inside-citrix-for-five-months/ <comment><USER2> One thing I have learned as a sysadmin who has had the privledge to see the inside of hundreds of companies from medium sized law firms to F500 oil companies:

There is a lot more incompetence than you would ever want to believe, and it's not always where you think. I've traced most of it to a failure of connection/communication between IT departments and C-levels/boards. The CTO/CIO and the person immediately below them (and the person immediately below them) are the "buck stops here" people for these kinds of issues, but often are either one of two types. 1) Too much MBA, not enough tech. 2) Too much tech, not enough MBA.

Both tend to have pretty similar results.

<comment><USER3> I work with a F500 oil company from time to time.

Half of the devs from there that I was in contact with were not capable of:

\- googling a solution to a problem efficiently. When they hit a wall, they turned to me with an empty look like they were lost.

\- read an error message to troubleshoot. A stack trace is utter mystery.

\- use effectively the UI of their laptop. Some can't even Ctrl + S to save, they look up the "save" entry in the menu.

We are talking about people writing code every day, in several programming languages: fortran, c, c++, java, Python...

Because I'm a freelancer, I don't care. I'm paid extremely well to be very nice to them and solve all their problems.

But I'm very glad I don't have to be held responsible for anything those people end up putting in production. And I have no reason to believe it's different in their security department.

However, and this is a good lesson to all of the geeks like me that think work is about doing the right thing: the output they produce is good enough in our society. Its cost/value hits the sweat spot. Business is not about doing things right, it's about being profitable.

If you have one scandal a year, but it costs you less than making sure you have a secure system, and you are not legally challenged, then you are golden.

In fact, the chances to have even one scandal are very low. Actual risks of failure or attack are low. And consequences in case of crisis are low too. People don't care that much about privacy, cyber-security, etc. And policy makers won't enforce their laws anyway, at least not to any extent that will endanger the company.

So if the software allows people to do their job IRL at a reasonable price, under an acceptable deadline, good enough.

In fact, David Goodenough is a very funny French meme: [https://www.youtube.com/watch?v=ho4W5LnFl6s](https://www.youtube.com/watch?v=ho4W5LnFl6s)

<comment><USER4> I used to work with a brilliant chip designer who couldn't find the start button on a Windows machine. We all suck at something. Personally, I think CSS is the devil and should we should nuke it from orbit.

<comment><USER5> True, I have a Ph.D. and am very skilled with electronics and embedded programming. If you handed me an iPhone I would have no idea how to read text messages (actual situation).

Same with the people I help technically at work. They're all brilliant scientists. They get confused by the difference between VGA, DisplayPort, HDMI, and DVI. Or get extremely frustrated when a button on the UI moves.

I think software developers don't quite understand how big a deal it is to a 70 year old when the button to do something moves. Probably a quarter of my day is often just figuring out how to reconfigure things to their liking or else spend an hour retraining them because of some unnecessary UI change in Windows 10, after which they will still forget and ask for help again.

God forbid you break apart an application into multiple programs or have online activation or a license server. I think I hear at least a daily rant about how you can't just _buy_ software anymore and now you can only rent it for a bit.

We have versions of software that are 13 years old because the publisher switched from an unlimited permanent license to a per-seat per-year license model. Rarely worth it when the instructors get confused by new software anyway.

<comment><USER4> > They get confused by the difference between VGA, DisplayPort, HDMI, and DVI

Back when there were RS232 (aka 9 pin) connectors on PCs, my dad's computer had two mail connectors, one CGA and one serial port (I think it was a serial port, but I'm not sure, as those connectors were usually female). I took the VGA cable and accidentally plugged it into the serial port. When I turned on the computer, I heard the startup chirping noises, the screen was black for a few seconds, and then white smoke started pouring out of the power supply. I turned it off REAL fast :) Somehow the computer still worked after that.

EDIT: changed VGA to CGA

<comment><USER6> VGA is DE-15 (3 rows), DE-9 (erroneously called DB-9) is 2 rows. ;) Interestingly, VGA only really needs 6 pins to operate: R G B VSYNC HSYNC & GND, and monochrome only needs 4.

I don't see how that's possible without really crushing it in there. Also, CGA & EGA were the same connector as serial (DE-9), which would've been easier to confuse.

It could've been worse: I knew a guy in high-school who plugged a parallel printer into a Mac classic's SCSI DB-25 (the same physical connector as a parallel port, female on the computer; DB-25 serial is a male connector on a PC) and baked it into "apple pie" with that "lovely" magic smoke aroma.

<comment><USER4> Yup, you are right, it was CGA. Fixed.

</comment></comment></comment></comment></comment></comment></comment><comment> streb-lo > In March 2019, the Federal Bureau of Investigation (FBI) alerted Citrix they > had reason to believe cybercriminals had gained access to the company's > internal network. The FBI told Citrix the hackers likely got in using a > technique called "password spraying," a relatively crude but remarkably > effective attack that attempts to access a large number of employee accounts > (usernames/email addresses) using just a handful of common passwords.

Pretty bad when the FBI has to step in and alert you that someone has brute forced their way into your servers.

<comment><USER7> Weird timing that Dec of 18 they forced a password reset to most of its Sharefile "customers." (aka including anyone who has ever received a file from someone through sharefile, and accidentally signed up for a service they didnt want.)

[https://krebsonsecurity.com/2018/12/a-breach-or-just-a- force...](https://krebsonsecurity.com/2018/12/a-breach-or-just-a-forced- password-reset/)

"This is not in response to a breach of Citrix products or services," wrote spokesperson Jamie Buranich.

I want to know if they knew already in December, and if they lied to the public and their customers. Maybe they could argue that "yes a breach happened, but this password reset was completely unrelated" but thats a load of livestockwash, if thats the case.

Edit: maybe i should read the article. Looks like they were in back in October! Jamie is likely just a sacrificial lamb, who is there so they have a head to roll, but somebody on the executive team should be in trouble for that kind of lie, unless there were government gag orders.

>Citrix's letter was prompted by laws in virtually all U.S. states that require companies to notify affected consumers of any incident that jeopardizes their personal and financial data.

Excuse my French, but thats fucking bullshit that they are just admitting to this a year and a half later.

<comment><USER8> As Matt Levine would say, this is probably securities fraud.

</comment></comment></comment><comment> jens-h On its own website, Citrix is using the real costs of a data breach as an argument to buy its products: [https://www.citrix.com/de-de/products/citrix- workspace/resou...](https://www.citrix.com/de-de/products/citrix- workspace/resources/weighing-the-risks-infographic.html)

But because of the widespread use of the software, a recent Citrix vulnerability puts 80K companies at risk: [https://www.infosecurity- magazine.com/news/citrix-vulnerabil...](https://www.infosecurity- magazine.com/news/citrix-vulnerability-puts-80k/)

It is always dangerous if a single company has a monopoly.

</comment><comment><USER6> I worked at a big name university in the IT department for housing and dining. Long before I got there, one of the Oracle database servers for meal-related activities had been pwned for years because it hadn't been behind a firewall and it had a routed public IP address. It was running Windows so it had accumulated a number of interesting malware including obscure rootkits with no antivirus patterns. I once booted it up off of clean media, ran some forensics tools and found a warez dumpsite on it. This box "couldn't be down" so all the happened to it was it was place behind a bidirectionally-restricted firewall. It still kept limping along with funky malware because they didn't want to spend time or money fixing it. _Sigh._ If it were my box, it would've been an immediate disconnection, image hardening, wipe and reinstall from backups (data-only).

I remember sending some binaries and other deets over to Mark Russinovich at then SysInternals, who's now the CTO of Azure.

<comment><USER9> Wouldn't even do backups, you couldn't trust them.

If a box is hacked, it's hosed. Cast fire and rebuild start again.

</comment></comment><comment><USER10> How much source code was committed in that span? Time to audit it all. Plus the binaries and other resources that are pulled off network shares at build time. Plus the compilers...

<comment><USER11> You already hinted at it, but anyone interested in computer security should read Ken Thompson's short but majestic "Reflections on trusting trust".

</comment></comment><comment><USER12> Well, no official government-supported agency have even stepped in to establish a list of norms involving software security, to force large corporations to abide by them.

While the private sector is the sole responsible for their own cyber security, and while the NSA wants to keep the upper hand in cybersecurity by holding a cyber-weaponry supremacy, events like these will keep happening.

Cyber chaos will continue because the NSA is obviously holding massive advancements in cyber weapons. The day the NSA will have an adversary that can be at least 50% as good as the NSA, you can be sure you will see cyber security standards being passed into law.

If you think about it, having cyber supremacy is a good way to have total power over the world. When you have all the information, you have everything you need to do whatever you want. That sort of describes the US right now.

<comment><USER13> >list of norms involving software security

These norms are already well-known. However they are never followed 100% because they all rest upon a sandy foundation of:

 __" Don't be clueless." __

Social engineering /phishing will always eventually work on _someone_ somewhere in a company with more than 20 employees.

Not to mention the other part, where passwords are allowed to be a vital link in the security chain, yet software vendors like Citrix simultaneously discourage password managers by getting in the way of using them and by forcing perfectly good passwords to be cycled endlessly. Resulting in people using passwords like Citrix20! (will change to Citrix21! in 90 days... iron clad security there guys.)

</comment></comment><comment><USER14> Isn't this normal? I mean after you break in keeping a low profile and staying undetected for as long as possible sounds like a no brainer to me. I wouldn't be surprised if some APTs were inside some "worst" companies for even 2 years at a time.

Edit: from the Wikipedia page on Advanced Persistent Threats:

> _The median "dwell-time", the time an APT attack goes undetected, differs > widely between regions. FireEye reports the mean dwell-time for 2018 in the > Americas is 71 days, EMEA is 177 days and APAC is 204 days.[4] This allows > attackers a significant amount of time to go through the attack cycle, > propagate and achieve their objective._

</comment><comment><USER15> What i find particularly embarrassing for Citrix (although only marginally touched in the article) is the amount of time taken for them to close the hole that was in their Netscaler/ADC components.

I mean, this is not a one-man show and an open-source project....

<comment><USER16> How do you know? There are lots of commercial products that have no staffing at all. "1 man" might even be above the median staffing.

<comment><USER17> Citrix had 8200 employees as of 2018 according to Wikipedia.

[https://en.wikipedia.org/wiki/Citrix_Systems](https://en.wikipedia.org/wiki/Citrix_Systems)

<comment><USER16> I meant the NetScaler project in particular.

<comment><USER18> They still have nearly 10k employees and are a big, affluent company. None of their project should be a one-man project, but, even if it were, they should still be able to find enough engineers to work on it in case of emergencies.

If it can be done by a small startup with a total of 3 devs in the entire company (and I have seen it done), it can be done by a company the size of Citrix.

<comment><USER16> I guess you'd be surprised at how easy it is for an organization to just de- staff a launched product.

<comment><USER19> why are we defending gross incompetence and laid back attitudes again?

<comment><USER20> Who is defending, exactly?

thedance is pointing out that we have no idea of the inner workings of Citrix, and how they staff their projects. It's not completely unreasonable to believe a non-core project has minimal staffing levels.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I was relieved to see that only internal employee information was impacted. You don't even want to know how many banks, hospitals, and power plants rely on Citrix Receiver for remote desktop access.

<comment><USER22> _" I was relieved to see that only internal employee information was impacted"_

Believing that puts a lot of credence in their analytical/forensic/security skills. Which doesn't align well with _" inside Citrix for Five Months"_.

</comment></comment><comment><USER23> I have always felt very uneasy about Citrix in the workplace, especially around PHI.

<comment><USER24> I know of...three major HI providers in the midwest using citrix

</comment></comment><comment><USER25> I look forward to seeing this covered on Darknet diaries. Just found the podcast and it rocks!

Having used Citrix this really, really doesn't surprise me.

</comment><comment><USER26> I've always found Citrix perform way better than RDP (feels more responsive, handles multimedia better)

I don't understand how after all these years and being originally based on the same tech, how RDP hasn't caught up.

<comment><USER27> Microsoft does a mediocre job with RDP because windows pc was the cash cow. Pretty sure that Citrix invented RDP and licensed it back.

Now they are changing, and are partnering with Citrix and VMWare in Azure. Eventually, they'll crush both.

<comment><USER28> PCoIP has been a huge shift in the landscape for remote access protocols for this reason.

</comment></comment></comment><comment><USER29> If the hack was conducted through the use of account hijacking then why didn't anybody at Citrix notice. Unless once the hackers got in they migrated within the network using as yet unknown vulnerabilities. Makes one wonder of there are backdoors in all networking equipment. So as the various state security entities can keep an eye on us.

</comment><comment><USER30> So instead of the old days of having a sign that says "We haven't had a workplace accident in XX days" they need "We haven't had a security breach in XX days".

How times change...

<comment><USER31> Not sure if there's more breaches or just more exposure because people started caring. Reading the The Cuckoo's Egg at the moment, apparently it was common in the 1980's for military networks to have guest/guest logins, or even ones with no passwords at all.

</comment></comment><comment><USER32> I hope we can move to a world with ubiquitous two-factor and hardware roots of trust (FIDO2, U2F, etc) across enterprises. That is the only way I see things like this ending.

<comment><USER6> The core of OSes need to be treated more like read-only firmware that only gets updated as-needed and is unable to be over-written by itself, e.g., send a request to the BIOS to look for a valid public-key signed image file to be applied on reboot.

Flash is so cheap, 64 GiB mirrored SSD devices should be available for operating system images on system boards. Leave OS images as signed squashfs files on a dumb flash FS like exFAT. Delta updates can be applied by stripping-out entropic-metadata, patching and recompressing a previous release to arrive at the valid signature of a complete latest release.

Mixing operating systems, configuration, programs and user data in together is a recipe for fail.

</comment></comment><comment><USER33> People still use Citrix?

<comment><USER34> Honestly, you would be surprised how many giant companies still use Citrix. Mostly medical. Terrifying.

<comment><USER35> And financial companies

<comment><USER36> And law firms big and small.

<comment><USER37> And places that use RDP like setups for development because they don't want their employees to walk out with the crown jewels on their laptops.

<comment><USER33> Why not just use RDP? It is because it as hard to get an enterprise to stop paying for a software license as it is to get one to start?

<comment><USER38> Citrix XenApp or whatever it's called this week is a lot better marketed to enterprise and offers a lot more integrations than Windows MultiPoint/Terminal Server. But a lot of is history, Citrix was a close partner of Microsoft and so Citrix essentially _was_ RDP in this context for some time before Microsoft decided to try competing on their own. Microsoft's entries have never really caught up in terms of adoption or features - for one, Citrix supports just about every platform there is for the receiver while Microsoft only has an officially supported RDP client for a couple.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents.

</comment><comment><USER40> From what I've heard their advice on securing servers running their software used to be to 'make good backups'.

I'm not surprised by an incident like this happening to cowboys.

</comment><comment><USER41> Stories like this really show Citrix and Cisco are so far behind Huawei.

If Huawei chips were similarly vulnearable the CIA and FBI would be disclosing this as vocally as possible.

<comment><USER42> The FBI or CIA would keep any vulnerabilities secret. But here is a recent example: [https://www.businessinsider.com/us-accuses-huawei-of- spying-...](https://www.businessinsider.com/us-accuses-huawei-of-spying- through-law-enforcement-backdoors-2020-2)</comment></comment>


Lisp's Revenge - <AUTHOR> https://www.youtube.com/watch?v=MTawgp3SKy8 <comment><USER2> This video is from 2013 so perhaps HN readers have some useful experience using Clojurescript to report by now. Anyone able to comment on its actual use?

<comment><USER3> Saw this video two years ago and have been programming Clojure and ClojureScript professionally for one year. This week I was at EuroClojure and actually met David Nolen.

What do you want to know?

<comment><USER2> I've always been hesitant to delve into front-end programming; JavaScript isn't a language that appeals to me. Is ClojureScript really a practical "replacement"? Is it better in some way than Dart or Typescript or just waiting for ECMAscript 2016+ ?

<comment><USER3> Let me start by aying that I've been a professional web developer since about 10 years. I dabbled in a little Java, but did most of my work first in Python, then Ruby, JavaScript and CoffeeScript.

Ruby on Rails with JavaScript was OK. Clojure and ClojureScript are blowing my mind every day. So yes, I'd say it's a replacement. And not an incremental one, but something that feels solid, is fast and a lot of fun to write in.

Of course this is just my personal opinion that luckily some people share. To go into detail would probably entail writing a book. But I'm definitively not going to write EcmaScript 2016+ in the future. Instead I'll follow Uncle Bob and proclaim the last programming language: [https://skillsmatter.com/skillscasts/2323-bobs-last- language](https://skillsmatter.com/skillscasts/2323-bobs-last-language)

Enjoy the talk^^</comment></comment></comment></comment>


Realism in UI Design - <AUTHOR> http://www.uxmag.com/design/realism-in-ui-design

<comment><USER2> The perfect example of this is an old version of the BlackBerry UI that looked like this:

<http://i.imgur.com/FypcA.jpg>

Fortunately, they wised up and the next version looked like this:

<http://i.imgur.com/3o2CF.jpg>

<comment><USER3> I don't know about you, but I think it still looks shockers.

<comment><USER4> Huge distinction here: picture A was the 'home' screen, picture B is the 'menu' screen. The home screen only has four icons.

</comment></comment></comment><comment><USER5> This article was badly missing the word:

      'skeuomorphism'

<http://en.wikipedia.org/wiki/Skeuomorph>

<comment><USER6> One place where skeuomorphism definitely comes into play is in the realm of digital audio software. If you are building systems to mix digital audio, for instance, you will not ship a single unit if it looks like anything but an old analog mixing table. It may even _be_ an old analog mixing table, except instead of controlling voltages on line-outs it is rigged to spew numbers into a DSP to adjust the gains of various digital signals. The reason why is because there is an entire tradition built up amongst sound engineers of mixing music by _listening_ and _feeling_ , rather than looking. And if you present a different interface to these people, you are throwing that knowledge away.

<comment><USER7> Propellerhead's Reason is great DAW software where everything is designed to look like its analog components. To the point where you actually have to drag and drop wires across different compressors, etc to connect them.

<comment><USER8> In many ways Reason's design limits the efficiency of its use, and it's hardware modelled approach is of no use (and in fact a hindrance) to the majority of users whom have never touched outboard audio gear.

I'm glad that companies like Native Instruments are building interfaces that are driven by usability[1], not analog fetishism, and I have high hopes that Apple will do the same with the next version of Logic Pro, if their approach to Final Cut Pro X[2] is anything to go by.

[1] [http://www.creativeobserver.com/img/5238_native_instruments_...](http://www.creativeobserver.com/img/5238_native_instruments_razor_synhesizer_reaktor_plug- in_screenshot_lg.jpg)

[2] [http://vicenteborrell.files.wordpress.com/2011/04/final- cut-...](http://vicenteborrell.files.wordpress.com/2011/04/final-cut-pro- x-b.jpg)

<comment><USER7> Well yeah most of the time I am in Logic or ProTools. Clearly it's less efficient to work in Reason. But it's way more fun :)

</comment></comment></comment></comment></comment><comment><USER9> Invaluable information for a UI designer. As I'm a bit of a novice in the field, I can say it is a struggle at times to pick out the right iconography and dictate what you want the user to accomplish. This article definitely helps to clarify that process. It also mentions a book worth reading which seems quite interesting: <http://en.wikipedia.org/wiki/Understanding_Comics>

<comment><USER10> That book is truly excellent. We used it as a textbook for a drawing class in college.

<comment><USER11> Indeed. It's versatile, too: I actually had to read it for one of my visual/interaction design classes.

<comment><USER8> It's also recommended in the Games Art course at my university, and I've seen it referred to among games industry people several times.

</comment></comment></comment></comment><comment><USER12> This article is pretty decent, but have you seen the homepage for UXMag? <http://uxmag.com>

It has some serious problems. My eyes glared over the entire thing and I didn't really catch much. The boxes don't work and I didn't consume anything. They need some usability testing bad.

<comment><USER13> I emailed them a little while ago about the text in all their articles being justified, (which is a nightmare for certain types of dyslexics, who just end up seeing patterns and losing concentration).

Apparently they've fixed it now, anywhoo my point is they also said they are in the middle of a grand site redesign, so I think, hopefully, they know about the dodgyness of the homepage.

</comment></comment><comment><USER14> Everyone loves the Apple UI, therefore everything the Apple UI does is an axiomatic truth of UI design.

Except... maybe not. The trash can icon on OS X is photo realistic. The HDD icon is photo realistic. Transmits icon is a pretty detailed truck from where I am sitting. I waaay prefer Chrome's shiny & detailed icon to the flat simpler one... et cetera, et cetera.

UI design articles have a tendency to be a little lazy on the science IMO, but I think that's a reflection on the fact that UI design sits between art and engineering and it's hard to be a master of both.

<comment><USER15> He specifically condones the use of photorealism in app icons.

</comment></comment><comment><USER16> I'm no designer (though I have put together a handful of icons in my day), but the part about too much realism in an icon seems fairly obvious. Are overly- realistic icons actually a problem? If so, a few real-world examples might have been more useful than the fully rendered house icon, which seems far- fetched.

Also, I don't really agree with the comment that the icon shouldn't include any details other than the bare minimum needed to convey function. Things like shading/shadows can give icons a more polished look. For example, I wonder if the author would argue that the red/yellow/green indicators in his home button example shouldn't have shading or specular highlights because that's just adding unnecessary detail.

<comment><USER17> Lots of things are intuitively obvious -- but when articulated clearly, it is possible to understand them more precisely. That ay you can use the knowledge in a rigorous way, not just an intuitive way.

<comment><USER16> Maybe so, but this article doesn't even give us enough info to enable anyone to be rigorous. The takeaway was to "make your icons detailed enough, but not too detailed". Whether it's obvious or not, what is actionable about that advice?

Like I said, maybe a few more realistic and/or real-world examples would have made the actionable takeaway clear. As it is, it's just another blog post stating the obvious -- IMO.

</comment></comment></comment><comment><USER18> I find it remarkable that the "Apple toggle button" is shown the wrong way: <http://www.uxmag.com/uploads/realisminuidesign/toggles.png>

The real one is set to the left while the others are on the right, or am I once again misinterpreting this button? I never ever understood their design and they utterly confuse me wherever I encounter them. Is it "On" if it shows "On" or does it mean I can click "On" when it is shown. Aaaargh.

<comment><USER19> Apple's toggle button can be pretty confusing, even with the "on" and "off" labels. Are you suppose to turn it on, or is it already on? This is one instance where I think they should have stayed with the checkbox.

<comment><USER20> Light switches are just as confusing initially- why is up on and down off? Once the convention is established, it becomes more natural.

Plus, since the action is a toggle, it matters less which is which. For the most part I don't care if it's left or right, I just want to toggle it.

Of course radio buttons are explicit, but real estate is also at a premium on an iPhone.

<comment><USER21> The conventional orientation for light switches is opposite in the US and the UK. But it's not a very strong convention because it doesn't apply to multi- switch arrangements as on staircases.

</comment></comment></comment></comment><comment><USER22> The say so at the end of the article, but it's a repost (original: <http://ignco.de/240>). Still all valid points though.

</comment><comment><USER23> Previous discussion from original article: <http://news.ycombinator.com/item?id=1067333>

</comment><comment><USER24> I was just writing a bit about realism for my book the other day. Interfaces, such as Mac OS X's Aqua, actually represent a sort of "hyperrealism," with buttons that are impossibly juicy, reflective, and glowing.

It's funny, because interfaces have always represented reality in a metaphorical sense (desktop, window, document, trash), but now we take it up a notch to represent things that couldn't actually exist.

</comment><comment><USER25> tldr; uncanny valley

</comment><comment><USER26> i learned some great stuff, manny thanks i would love to seemore artcles like this</comment>


Announcing Microsoft Edge for iOS and Android, Microsoft Launcher - <AUTHOR> https://blogs.windows.com/windowsexperience/2017/10/05/announcing-microsoft-edge-for-ios-and-android-microsoft-launcher/ <comment><USER2> TL;DR: it's NOT using its own engine on Android. It uses Blink there.

" _On iOS, we are using the WebKit engine, as provided by iOS in the WKWebView control. That means that from a compatibility perspective, Microsoft Edge for iOS should match the version of Safari that is currently available for iOS._ "

" _On Android, we are using the Blink rendering engine from the Chromium browser project._ "

Source: [https://news.ycombinator.com/item?id=15408882](https://news.ycombinator.com/item?id=15408882) -> [https://blogs.windows.com/msedgedev/2017/10/05/microsoft- edg...](https://blogs.windows.com/msedgedev/2017/10/05/microsoft-edge-ios- android-developer/)

<comment><USER3> This is a capitulation of Microsoft - instead of porting their engine to Android, they made a yet another Chromium/Blink shell. It is not what I expect from a big corporation.

<comment><USER4> I agree, this is about as impressive as some kid that builds his own browser in Visual Basic by drag'n'dropping in an IE control.

</comment></comment></comment><comment><USER5> Edge is a good browser, people seem to default to criticizing it because of its infamous predecessor. We should root for Edge, it is in the open Web best interest to have several browsers sharing the market.

<comment><USER6> Edge is not a good browser. It is holding the web back with its slow adoption of HTML5 standards. (source: [https://html5test.com/compare/browser/chrome-58/edge-12.html](https://html5test.com/compare/browser/chrome-58/edge-12.html))

Edge still has a spoof referrer header vulnerability that's been known for more than 6 months now: [https://www.brokenbrowser.com/referer-spoofing-patch- bypass/](https://www.brokenbrowser.com/referer-spoofing-patch-bypass/)

<comment><USER7> The version of Edge you're linking to on HTML5Test there is two years and four major versions out of date. Edge 16 is more than 100 points higher on HTML5Test.

More generally, there's a lot more to making the web great than a blind sprint to adopt every API. Just because it isn't shipping doesn't mean Microsoft isn't a (very) active participant in the standards conversations, testing behind flags, etc. That is a huge part of moving the web forward.

Take Grid as an example - we were the last browser to ship the updated spec, so you could say we "held it back." But we also originated the first version of the spec and worked closely with the community, standards bodies, and other browser vendors on making sure what ultimately shipped cross-browser this year was great, useful, and interoperable. Is that holding the web back?

(Disclaimer: Edge employee)

<comment><USER5> To add another example, WebVR API cleanup was inspired by Microsoft that joined the group working on this API. Edge isn't yet shipping WebVR, but they are helping with the work.

<comment><USER7> Good example! Though, for the record, WebVR 1.1 is shipping in EdgeHTML 15. Fair to call it a preview, since consumer headsets won't be available until later this month with the Fall Creators Update, at which point end-to-end support will work out of the box.

</comment></comment></comment></comment></comment><comment><USER8> I struggle to get too excited about Edge on iOS because it's not really Edge is it. It will just be like Firefox which uses the built-in iOS WebKit-based rendering. So it's effectively Safari doing the rendering with some wrappers around it like syncing Windows favourites and sharing open windows with your Windows PC?

Maybe some corporations which have Windows on the desktop, but where most employees use iOS devices on the go, will find some use for this.

<comment><USER9> I'm guessing this is the case with Chrome as well?

<comment><USER10> Yes, and it's because of an Apple policy. They don't allow other rendering engines.

<comment><USER11> It is not that they do not allow other render engines. It is that APIs to dynamically execute native code are locked down on platforms such as Windows Mobile and iOS. If you cannot dynamically execute code you cannot build a JIT JS engine which makes your webbrowser too slow compared to the competition.

<comment><USER12> This is a policy who's primary goal is to ban other browser engines. They make exceptions for lots of other app types like games.

<comment><USER9> I guess in theory you could build a browser on top of a game engine, or is that just insane?

<comment><USER13> Tribes 2 had a full web browser in the game. It was a continuation of having a full IRC client in the first game, Starsiege: Tribes.

(Tribes 2 also had the IRC client. The IRC client initially drove players into chat channels to help them find ongoing games, and dropped a link when someone left IRC to join a game. It was decent matchmaking in 1998, and helped build the community as well.)

The browser itself wasn't as insane as writing the entire game menu in OpenGL, which at the time was uncommon. Game devs cited this choice (instead of using a simpler menu) as causing a 6-month delay in the project, leading to much less testing and a game that crashed frequently for the first few months after release. The ubiquitous "Unhanded Exception" pop-up became a meme for years after.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> The performance of Edge is comparable to Chrome or Firefox. It is a really great product. The sad part is, that they were keeping it Win10-only for several years. I think, that if they made Edge available for every platform and every OS earlier, they could have 20 - 50 % of the market by now.

The funny part is, that there is NO EDGE FOR WINDOWS. Precisely, Edge is for Windows 10 only, which is the minority of all Windows devices today. There is no Microsoft browser for Windows 7 (by a browser I mean the one that is regularly updated). MS announced the halting of IE development a long time ago.

<comment><USER15> There is Edge for Windows. It's called Edge. Windows 10, is believe it or not, Windows. Any computer running Windows 7 or 8.1 can still (yes, it can) be upgraded to Windows 10 for free. So the only Windows PCs which cannot run Edge were those manufactured prior to 2009.

Contrary to popular belief, there is no good reason to be running Windows 7 or 8.1. All of the telemetry anti-features were backported into those versions, Windows 10 is inherently better at security, and trust me, if I can get the legacy software I have running at work running on Windows 10, legacy app issues aren't a problem either.

<comment><USER14> 90 percent of Windows 10 users that I know updated from Windows 7 unintentionally and most of them complained about it. Such updates form Microsoft have quite bad reputation. You can't just say "Hey do this irreversible software change and trust us, that you will be satisfied". I am ready to accept it e.g. from Chrome OS, but not from Microsoft.

<comment><USER16> While I agree that most users (of Windows, Chrome, OSX, iOS etc) are forced/tricked onto the auto-update treadmill, atleast with Windows and OSX I can re-install the older version. With iOS and such it is _impossible_ to downgrade. With Chrome I suppose if you get some kind of non-web installer, you can go back and then disable the update service, but that probably is an unsupported configuration and very likely going to break at some point.

To your last point, I would say I am ready to accept it from anyone except an advertising company whose only primary means of making money is by sifting through my personal data and spying on my online activities. With MS, I have little doubt that they "would if they could", but at-least for now, they wont, since they're making more money selling actual products.

</comment></comment></comment></comment><comment><USER17> Had to happen sooner or later. I just wish Microsoft had not tied Edge so deeply into Windows 10 (did they not learn from doing the same with Internet Explorer?) as at the moment it is limited to updates as part of the OS (Windows Update) and not the Microsoft Store.

<comment><USER12> I think part of the reason for this is that you shouldn't be web browsing with old software. It's unsafe for you and others that your hardware could damage.

<comment><USER18> But apps should be update-able separately, not as part of an operating system update. That doesn't make much sense. Especially on mobile when you might want to only update single app currently relevant to you without blocking your phone for 40 minutes doing a huge update of everything. Also limited bandwidth.

<comment><USER12> We've not been in a world where the web browser can be separated from the OS for at least 7 years.

</comment></comment></comment></comment><comment><AUTHOR> More information about Edge Mobile is available here, however not many technical details (e.g. whether the Android version is just a WebView or if it's the real Edge)

[https://www.microsoft.com/en-us/windows/microsoft-edge- mobil...](https://www.microsoft.com/en-us/windows/microsoft-edge-mobile)

<comment><USER19> "On iOS, we are using the WebKit engine, as provided by iOS in the WKWebView control. That means that from a compatibility perspective, Microsoft Edge for iOS should match the version of Safari that is currently available for iOS.

On Android, we are using the Blink rendering engine from the Chromium browser project."

<comment><USER20> So it's more like Faux-Edge. I guess it still provides a benefit for Edge users who want to sync their data and whatnot. It's just not too interesting beyond that.

At least Firefox Focus (based on Chromium, too) is a "private by default" kind of browser, who those who care about that experience and don't want to mess with settings or don't know how to set it up so that it has maximum privacy. Speaking of which, it would be nice if Firefox Focus also provided an easy-to- use option to enable browsing over Tor.

<comment><USER21> All browsers on iOS are not using their own render engine, Apple doesn't allow it.

</comment></comment></comment></comment><comment><USER22> It'd be nice if they made it open source too.

And it'd be nice if iOS allowed real browser alternatives instead of requiring everyone to use WKWebView.

</comment><comment><USER23> Back in the days of the Acid tests and when vendor prefixes for experimental features were the norm, and a visit to caniuse.com was often met with disappointment, discretionary users cared as much about a browser's layout engine as the application's surrounding chrome and features.

But as web engines have been moving closer to feature parity (as well as Chrome and Firefox's combined dominance of marketshare), the bonus features of the application are rising in importance. (Some) people want their bookmarks, their synced passwords, their addons, their (sometimes-captive) integrations; this is the space that Edge competes in now.

The same applies on iOS, for slightly different reasons. On iOS everything is slightly different, you get the same rendering engine every which way. There, the only way to differentiate yourself is by extra features.

</comment><comment><USER24> I wonder if Microsoft will ever pull a Kindle and rollout custom Android device that replaces Google services and and apps with Microsoft equivalents.

<comment><USER25> They already sell a Samsung Galaxy S8 "Microsoft Edition" in their stores, which comes with their apps pre-installed. I wouldn't be surprised to see them push that even further.

</comment></comment><comment><USER26> I shall add it's funny they keep saying "Microsoft Loves Linux" but refuses to release any of their major desktop client software for Desktop Linux.

<comment><USER27> "Refuse" is a fairly strong word and suggests there is a Linux version available and just withheld. Software and features don't just appear out of nowhere.

<comment><USER28> Indeed. Not to mention that Office Online works just fine in a browser under Linux.

</comment></comment></comment><comment><USER29> Can Edge for iOS be selected as "default browser" in iOS so it is by default used in all the places Safari normally handles? The "send to PC" thing _is_ nice, but only if available everywhere and consistently.

<comment><USER30> No, App developers are able to find out if Edge (or Chrome or Firefox) is installed on your device to give you an option to open links inside it, but most apps don't do that and you still can not change the default browser.

<comment><USER29> Shame.

Then maybe Microsoft could create a share extension that uses this new Windows feature to "collect" URLs from an iPhone?

</comment></comment></comment><comment><USER31> Alas, visiting the signup page [https://www.microsoft.com/en- us/windows/microsoft-edge-mobil...](https://www.microsoft.com/en- us/windows/microsoft-edge-mobile) from Edge on Windows 10 asks me to visit the page using Edge on Windows 10: [https://pbs.twimg.com/media/DLYLTmHWsAEnlPF.jpg](https://pbs.twimg.com/media/DLYLTmHWsAEnlPF.jpg)

Update: they're looking into it: [https://twitter.com/MSEdgeDev/status/915934723754516481](https://twitter.com/MSEdgeDev/status/915934723754516481)

</comment><comment><USER32> Mobile browsers could use a shakeup, but Edge is not super interesting to me. The Microsoft Launcher (which is implied to just be a re-branded Arrow launcher) on the other hand is fucking great. For me it's been Arrow or Nova for the past few years.

</comment><comment><USER33> When we have Firefox focus for Android, I wonder why would anyone use this. Microsoft can dream about capturing the user base unless they open source it (which won't happen anyway).

</comment><comment><USER34> Why would a user use Edge on iOS/Android when they are using platform native rendering engines (webkit/blink). what is the value add here (Working with a windows 10 PC?)

<comment><USER35> > Microsoft Edge for iOS and Android brings familiar features like your > Favorites, Reading List, New Tab Page and Reading View across your PC and > phone, so, no matter the device, your browsing goes with you. But what makes > Microsoft Edge really stand out is the ability to continue on your PC, which > enables you to immediately open the page you're looking at right on your > PC—or save it to work on later.

This is for people who use Edge on their PC and want everything to sync with their phone.

</comment></comment><comment><USER36> Installed, got temperature in Farenheit in the weather widget, found no settings to use Celsius, concluded it's not near polished enough.

Back to Google Now Launcher.

<comment><USER7> Per the blog post, we're not localized broadly in the preview, but will be adding more locales/languages as we head towards a stable release. Hope you'll try it again!

</comment></comment><comment><USER37> Does it make use edgeHTML or Chakra though?

</comment><comment><USER38> if firefox can't do it, there's no way ms can

<comment><USER39> It's no different than Chrome or Firefox on iOS. Standard WebKit rendering with an MS GUI and syncing features to feel more like edge and integrate with the rest of their stuff better.

Sounds like it's the same on Android too (only using Chromium).

<comment><USER40> Chrome on iOS is starting to diverge from Safari, sorta: they inject a bunch of JS to each page to essentially polyfill a bunch of stuff that iOS doesn't provide.

</comment></comment></comment><comment><USER41> _One of the most common requests we hear from people who use Microsoft Edge on Windows 10 PCs is "we want our browser experience to move to our phones"._

That's funny, my most common request is "IT'S BEEN LIKE 5 YEARS, CAN YOU GUYS FINALLY SUPPORT ALL OF THE INDEXEDDB API? EVEN SAFARI DOES IT NOW!"

So sad when poor multinational corporations simply don't have the resources to compete with obscenely wealthy organizations like Mozilla. Maybe they should try open sourcing their browser so the community can pitch in?

<comment><USER26> > most common requests we hear from people who use Microsoft Edge on Windows > 10 PCs

Are there really people using Microsoft Edge out there? I mean, because they want to, not because they have to?

<comment><USER42> I've been using it almost exclusively on my laptop for the past few month as an experiment. And honestly it's a perfectly fine browser that basically just works as well as any other browser. That being said I cannot come up with any good argument why you should switch to using it instead of whatever you are currently using.

<comment><USER43> Yeah, I've been really impressed with Edge. If I had started using Edge instead of having all my stuff in Firefox, I probably never would have bothered switching.

<comment><USER44> The developer tools on Edge are not on par with Chrome or Firefox. That is one reason I stay away. I don't mind using the browser once in a while when I need more sessions than my Chrome profiles.

</comment></comment></comment></comment></comment><comment><USER45> Stop trying to make Edge happen.. its not going to happen..

<comment><USER46> [http://caniuse.com/fetch](http://caniuse.com/fetch)

</comment></comment><comment><USER47> No tiles in launcher? Garbage.

</comment><comment><USER48> lol

<comment><USER49> Could you please not post if it's not going to be civil and substantive, like the guidelines ask?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER50> Powered by Bing?

<comment><USER51> It allows custom default search engines.</comment></comment>


AirBook Not a Macbook Air - <AUTHOR> http://store.kogadget.com/product.php?id_product=20

<comment><USER2> ... and no monitor out. Apart from that, it looks pretty cool if you want a Windows PC (of course, my macbook air is about to explode if I keep writing about that :) )

</comment><comment><USER3> First thought: How could they screw up the keyboard?

Delete right above Return! Seriously.

<comment><USER4> Macs with international keyboard have Delete (Backspace) right above Return: [http://en.newinstance.it/wp-content/uploads/2009/09/mac- inte...](http://en.newinstance.it/wp-content/uploads/2009/09/mac- international-keyboard.png) Not an issue.

</comment></comment><comment><USER5> lol. lawsuit in 10... 9... 8...

<comment><USER6> is it a Samsung...?

<comment><AUTHOR> considering galaxy might as well be samsung lol

<comment><USER6> at least 1 person got the joke</comment></comment></comment></comment>


Selling stuff on Twitter - <AUTHOR> http://tuy.im/

<comment><USER2> I hadn't really thought about using Twitter to sell anything, but now the the idea is in front of me I like it. I think you could take the intergration with Twitter fruther, but I'm not sure I have the best ideas on how to do that.

My only initial concern was that in reading your footer text on your PSP ad (You can contact me on Twitter or email me....) I found myself looking for your Twitter handle down there as well and was confused that I couldn't find it. It actually took me a few seconds to realize it was up top. Would be worth knowing if other people are experiencing the same confusion.

<comment><AUTHOR> Yeah, I guess I need to put it there as well!

</comment></comment><comment><USER3> Interesting idea, but the periods and commas in the example price are in the wrong order. Is it going to mis-format something I try to sell as well? Edit: apparently not, it's just a text field in the listing.

<comment><USER4> It's not really misformatted. The roles of periods and commas are swapped in some countries. In fact, all of these countries in green use commas for the decimal separator rather than periods:

<http://en.wikipedia.org/wiki/File:DecimalSeparator.png>

</comment></comment><comment><AUTHOR> My blog post about it <http://www.eberfdias.com/blog/tuy-im/358/>

<comment><USER5> link to that example for-sale page from the homepage, or show some kind of example there. from just reading the text, it's not clear at all how it works or looks.

<comment><AUTHOR> Done!

</comment></comment></comment><comment><USER6> Small suggestion. Change #2 and #3 paragraph positions. It will be easier to read.</comment>


Cars, newspapers and permissionless innovation - <AUTHOR> http://ben-evans.com/benedictevans/2015/9/1/permissionless-innovation <comment><USER2> Agreed. The world simply becomes different.

I had volunteered, as I studied engineering in the past to give 3d classes to kids for free. We have PhDs like ObiJuan making videos and releasing them over the net teaching FreeCad, OpenScad, how to do robots and so on.

The children we teach today (10 ,11,12,13 years old and older) are incredible. They do create their own toys.

When this people get to 18 or 20 years old, "real engineers" but with no real experience prototyping because it was simply too expensive to fail, will not be able to compete against them.

People will be able to prototype their own small cars soon thanks o sharing sites like thingiverse, youmagine or github.

There will be Linus Torvals of hardware soon.</comment>


Computational Propaganda in Poland: False Amplifiers and the Public Sphere - <AUTHOR> http://comprop.oii.ox.ac.uk/publishing/working-papers/computational-propaganda-in-poland-false-amplifiers-and-the-digital-public-sphere/ <comment><AUTHOR> The section on manually controlled false accounts starting on p. 15 is interesting in regards to tradecraft:

 _An employee of The Firm then starts by creating an email address via a large provider (such as Gmail). ... [T]hey create accounts on multiple platforms and portals. A suitable profile photo is found via an image search and modified in Photoshop so that it will not appear in a Google image search, and the employee begins posting on various platforms and building a comment history. ... They use a modified VPN to spoof IP addresses so that their accounts will have a series of associated addresses, allowing them to post from multiple locations in a predictable way._

as well as strategy:

 _the firm's strategy is to target "opinion leaders", including journalists, politicians, bloggers, and key activists. By infiltrating influential Facebook groups, mining comment sections, and directly striking up conversations with these opinion leaders, the goal is to try to convince the target that their followers sincerely believe a certain argument and to provide long-term nudges towards certain strategically devised positions. ... An entire thread on such a platform can feature dozens of fake accounts all posing as users, down- voting unsympathetic points of view, and generally steering a conversation_</comment>


The iBooks 2.0 textbook format - <AUTHOR> http://www.baldurbjarnason.com/notes/the-ibooks-textbook-format/

<comment><USER2> So slots appear to be like text frames that the content flows through?

That would be a useful extension if it got more widespread usage.

The thought that occurs to me though is whether this will appear in webkit at some stage or if it is just for the closed source iBooks side of things.

The list posting at W3C suggests that at least some of it may appear in the public webkit at some stage.

</comment><comment><USER3> I guess the dream of a fully EPUB 3 standards compliant authoring tool was too good to be true. The devil is in the CSS.</comment>


Show HN: Kerning.js — Take control of your web typography - <AUTHOR> http://endtwist.github.com/kerning.js/ <comment><USER2> This library is misusing vendor prefixes :(... -webkit-* should be an area for WebKit to define custom CSS property, not for this library to tag things "only if using WebKit". If WebKit eventually decides to experiment with a word-color CSS property this is just going to cause problems.

Instead, to fit with the standard way people define CSS properties, this library should be taking a prefix for itself, like -kerning-*, and then defining any of its extensions to CSS within that namespace: that way it is almost guaranteed to not cause problems going forward.

</comment><comment><USER3> Nice work. I like how it all stays declarative in the CSS too.

I would recommend outsourcing your parsing though. It's a tough job and things like CSS hacks can really take your regexes for a loop.

I'd recommend trying out <http://glazman.org/JSCSSP/> or <https://github.com/nzakas/parser-lib/tree/master/src/css> which Nicholas uses for CSSLint.

<comment><AUTHOR> I evaluated JSCSSP (didn't know about Parser-lib), but was trying to keep the file size down to a minimum.

Though perhaps not the most robust, the library I'm using now (<http://bililite.com/blog/2009/01/16/jquery-css-parser/>) seems to work fine with all of what I've thrown at it. It is also, by far, the smallest of the three CSS parsing libraries (14kb vs JSCSSP's 165kb).

</comment></comment><comment><USER4> Do people use things like this?

I recently read Robert Bringhurst's excellent _Elements_ _of_ _Typographic_ _Style_ , but have no idea how to apply it to the web.

(There is an effort to translate the work at webtypography.net, but frankly, most of the sections are some equivalent of "you should do X, but X is not possible right now, but maybe with some CSS extension in the future X will be possible.")

It seems like maybe we have choice of fonts now (through TypeKit, Google Web Fonts). But kerning and justification seem to be mostly accomplished through these sorts of JavaScript hacks, and text figures seem outright impossible. What is a wannabe typographer supposed to do on the web with current tools? Are lettering.js, kerning.js, kern.js, linebreak.js and similar usable or just experiments?

More generally, what does the current web typographer's toolbox look like at the moment?

<comment><USER5> Don't use this for anything more then a playful lib. It's fun, and it's helpful for defining what browsers might want to do in the future, but its a toy, like a fisher price hammer.

<comment><AUTHOR> Actually, there's no reason you can't use this on a real site. Sure, you don't want to use it on a long block of text, but it's great for headers and short copy. It doesn't break anything and the "fallback" if it doesn't work is just unkerned copy.

<comment><USER5> Yea, but there is flash of un-styled content. There is no way around it because the style has to be applied by the javascript. That is not production ready in my opinion. The way standards bodies work now though I think this a great way to demo what browsers should be able to do.

<comment><AUTHOR> I should note this in the documentation, but if you add "visibility: hidden" to your content, it will automatically be set to "visibility: inherit" after it's ready.

</comment></comment></comment></comment></comment><comment><USER6> So, just to get this right; to use this script, you'd have to know your content, right down to how many words each text element contains and so forth? The exception being the pairings and repeats. If you already know your content that well (ie. it's static and not any form of user input), you could just add some extra inline elements to your markup, I mean, you're already heavily customizing the text elements.

This is perhaps more elegant, but it makes your CSS too tightly bound to your content. Add a word in the markup, and you'll have to update your CSS as well, with a _none_ or whatnot.

By all means, nice work, I just rarely work with pages where I know how the content will turn out.

 _Edit: Fixed a typo._

<comment><USER7> my thoughts, some of the examples are way more elegantly solved using markup than with complex CSS rules. That is not to say that you cannot do that with this library: just define a few extra classes and wrap the individual words, letters etc. in spans or something. I think they just went a little overboard with their examples.

</comment></comment><comment><USER8> Speaking of kerning, here's a simple CSS declaration for modern browsers:

        text-rendering: optimizeLegibility;

... which will give you improved handling of kerning pairs and ligatures.

see: [http://www.aestheticallyloyal.com/public/optimize- legibility...](http://www.aestheticallyloyal.com/public/optimize-legibility/)

</comment><comment><USER9> Completely broken in Firefox, takes ages to load in Chrome. Can't imagine why anyone sane would want to use this library if the cost is so severe.

Doing it declaratively through css is nice, but it would be nicer if it used vendor prefixes correctly to avoid namespace collisions instead of misusing them the way it does.

</comment><comment><USER10> What's the performance penalty for wrapping every character in a span? Is it meant for titles only (honest question)?

<comment><USER11> Pretty sure everything about this library is terrible for performance. I cringe to say this, but I might even recommend using images of text over this.

</comment></comment><comment><USER12> So, to style the 235th word in a text, I'd have to do #main { -letter-size: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .... 0.5em; }

Why wouldn't I simply wrap it in a span, then it even works on browser with JS switched off. Uh, and once I have to edit the copy and add a single word somewhere, everything breaks.

<comment><USER13> Is there some reason you wouldn't just put it in a span and style that? Just because you CAN specifically target the 235th word in a text doesn't mean that you have to, or that you necessarily should.

I can think of a few instances where I could have used the ability to target a specific letter in the past, specifically as it relates to logotypes or branding, but none that involved targeting the 235th letter.

</comment></comment><comment><USER14> Does wrapping everything in spans and divs impede SEO in any way?

i.e. Google aside, does Bing and other crawlers interpret:

Perfect

To be the same as:

 perfect.

Also...

SPANNITY SPANNNN SPANNITY SPANNNN

<comment><USER15> Google's crawlers don't really interpret JS, so they won't see all the extra span tags that this script applies. In other words, Google should interpret the header on the demo page as:

Kerning.js

Take control of your web typography.

Check out [http://stackoverflow.com/questions/2061844/does-googles- craw...](http://stackoverflow.com/questions/2061844/does-googles-crawlers- have-javascript-what-if-i-load-a-page-through-ajax) for the usual caveats.

<comment><USER16> Search engines certainly _should_ interpret it that way, but I think the point was to question whether they all (for someone value of "all") really do do it that way in practice.

</comment></comment></comment><comment><USER17> Great library, great work - kudos to you for tackling a very tricky subject (I'm staying well away from CSS parsing and typography ... for now)

My only concern is whether this is (in startup lingo) a painkiller or a vitamin - as in, this is really nice to have, if you're that worried about kerning, but perhaps not enough of a pain-point for designers and developers to warrant learning a new set of nested and prefixed CSS rules, just to do something that's possible to hack together on a case-by-case basis with something like lettering.js...

Perhaps if there's a way to simplify the syntax or provide easy copy-paste examples, it'll remove the barrier to entry?

Still, applaud the work and the code looks great.

</comment><comment><USER18> Not very cross-browser, is it? Even the page itself lays out entirely wrong on Opera.

<comment><USER19> I'm not surprised it doesn't work in Opera, and I wouldn't hold it against the library. I don't (personally) know a single user of opera or developer who tests on it. This is a shame, but somewhere along the line, opera dropped the ball and fell into obscurity.

</comment></comment><comment> loup-vaillant Apparently doesn't work with no-script, even when allowing the whole page. I suppose there is some cross scripting going on? Or is it because my iceweasel 3.5.16 from Debian-stable is too old?

</comment><comment><USER20> While pretty, this really messes up screen readers: as each letter gets wrapped in a span, the letters are read out one at a time.

</comment><comment><USER8> How does this differ from <http://www.kernjs.com/> ?

<comment><USER21> How are they similar? That link goes to a bookmarklet that lets you drag letters apart to produce a stylesheet adding extra margins to those letters. This story's link goes to a JavaScript library that provides a dozen new CSS rules for selecting and transforming words and letter spacing, rotation, color...

<comment><USER22> In this way "kerning.js" doesn't seem to be the most descriptive name for this project. Everything but the first example is not related to kerning, just typography. My first thought, when I read the title of this post, was "but we already have kernjs..."

</comment></comment></comment><comment><USER22> I'm working on a fine-grained typography control JS library myself, very interesting work.

Designers/front-ends, what things would you like to control about your type now, that you can't yet?</comment>


ESP 8266 Wi-Fi Repeater with Mesh Networking - <AUTHOR> https://github.com/martin-ger/esp_wifi_repeater <comment><USER2> Very cool. Most of you probably already know this, but the ESP8266 is a glorious microcontroller that costs about $7 in a nice package. It has Wifi and a bunch of GPIO ports, and the newer model ESP32 has bluetooth too. They can be programmed like an Arduino (using Arduino IDE among other tools) and are a really interesting way to get a bunch of very cheap, highly connected things going on.

For instance, I have one rigged up across a zone valve on my mom's "dumb" furnace and it's now smart furnace that heats the house up before she wakes up and controls the temperature to whatever tolerance she wants. I have another one running the stepper motor that turns the screw of my $30 DIY star-tracking camera mount. Another is hooked up to a thermocouple that transmits readings from wherever through a MQTT server to processing equipment to characterize oven temperatures, water heaters, or anything else you want to measure. I have other ones hooked to reed sensors that tell my security system when things get opened or closed.

The possibilities with this kind of cheap SoC are nearly endless. I love how many fun ideas become really practical (as in, "Ooh, I could set this up right now using my drawer of ESPs! Here I go...") with this kind of thing.

<comment><USER3> I think these are great for people with experience using embedded electronics and comfortabke with soldering and low level programming (I.e probably a significant portion of HN readers).

However for those that don't have a background other than simple programming experience, I strongly recommend paying g more for a platform with good infrastructure. For example , I'm really impressed with particle.io.

Board costs are <$20 but come with cloud infrastructure and lots of examples and documentation. For those that value time over money I recommend them.

<comment><USER4> Are these particle.io kits completely soldering-free? I've been looking to experiment a bit with some embedded projects purely for fun and I don't mind low level programming at all (if it has a C compiler or at least a decent assembly manual, I'm good), but soldering (presumably, the smell of the flux, but I've never cared to investigate and would rather just avoid it) is a strong migraine trigger for me.

<comment><USER5> There are some other devices out there that are made to allow alligator clips onto leads or to use conductive thread, so no soldering is required. Adafruit makes several great little boards, but if you're getting started I'd recommend the "Circuit Playground" board: [https://www.adafruit.com/product/3333](https://www.adafruit.com/product/3333) It has a number of sensors and LEDs built in already as well and supports CircuitPython, Microsoft MakeCode, and the Arduino framework.

</comment></comment></comment></comment><comment><USER6> Here's a quick question I hope somebody can shed some light on. I live in a small-ish town in Yorkshire, probably a couple of miles square and was wondering about the feasibility of using these little devices to create a mesh network to extend my home network.

The reason being is that I have lots of Internet connected devices which watch over me whilst I'm in the house, being Quadriplegic it's much more comforting to have a computer watch over my health and do things for me than it is to have a potentially tired, angry and/or bored person doing it. However, that bubble ends as soon as I pass out of Wi-Fi range.

So obviously I would like to extend coverage to cover my smalltown, but everything I've seen so far has been prohibitively expensive. It wouldn't need to have a massive amount of bandwidth available as it would be just me using it, but it would need to be fairly cheap and as near to 100% reliable as possible.

Any insights, questions, comments? TIA

Edited To Add: I've just measured it using Google Earth and I need to cover a circle with an area of about one square kilometre.

<comment><USER7> Maby contact these guys: [https://wlan-si.net/en/](https://wlan-si.net/en/)

They are(were) deploying wifi mesh networks on the cheap in Slovenia. They've covered entire towns that did not have internet access in the past (mesh network in the town + string of directed antenna to get an uplink from a bigger town). Routers they used cost in the range of 15€ each, but the last time I talked to them they had trouble supplying new routers.

<comment><USER6> Thanks for the link, I will definitely get in touch with them. Paying for the equipment isn't the issue I don't think, it's the expertise and looking for.

</comment></comment></comment><comment><USER8> Two limitations here are worth keeping in mind:

\- Throughput is not stellar (less than 1 mbit/s in a realistic setup);

\- This is not a real IEEE 802.11s mesh, but rather some clever mechanism on how a node can select an "uplink".

<comment><USER9> It's a shame the Wi-Fi Alliance is showing no interest in long-range mesh capabilities for its Wi-Fi standards.

The mesh-like standards it does have currently are mainly focused on home automation, and they only cared about developing those because Bluetooth was becoming the de-factor standard for IoT, and now 6LoWPAN seems to be taking over.

802.11ax promised 5x the range of 802.11n _in theory_ , but implementers will go up to 2x, at most, likely preferring to focus on increased performance/bandwidth instead.

I think it would be really cool if we could have a Wi-Fi standard that would go through buildings over 1 mile even at 1Mbps speeds. And I think we now have the technology and know-how for how to deal with interference from similar Wi- Fi emitters.

It would be nice if something like this was made by the Wi-Fi Alliance because then we could all have that capability in our phones within 5 years after release. Think how much that would help in cases of disaster: earthquakes, tsunamis, hurricanes, wars, and so on.

<comment><USER10> >long-range mesh capabilities for its Wi-Fi standards

>go through buildings over 1 mile even at 1Mbps speeds

That sounds like a nightmare. WiFi is already nearly unusuable in high density situations. A recent trip to help a friend living in a medium density part of a large city showed ~100 access points, using the lousy WiFi antenna on my smartphone. Even every single 5GHz channel (which really doesnt travel well through objects) was taken, usually twice or more, including all the DFS channels. Mind you, this was inside.

I cant begin to imagine how unusable WiFi (and its related unlicenced spectrum) would become if had 5x the range. Even in low-density suburban areas, 2.4GHz is crowded to the point of degraded performance (although 5GHz is pretty clear for now).

</comment></comment></comment><comment><USER11> Has anyone actually tried to mesh a large number of ESP8266 chips in practice? I tried it, hooked a 7-seg display to each 8266 and started adding nodes 1 at a time. Each node would display the number of additional nodes available in the mesh (on the 7-seg). I found the mesh became unstable around 12+ nodes and would auto arrange into 2+ separate meshed networks. This was a while ago and maybe it's more stable today. I'm interested in anyone actually getting 20+ nodes working reliably.

<comment><USER12> This solution was limited to 8. \- Due to the limitations of the ESP's SoftAP implementation, there is a maximum of 8 simultaniously connected stations. (from the README)

<comment><USER11> Interesting, I remember reading some documentation from Espressif's website early on that claimed 50+, but can't seem to find it now.

</comment></comment></comment><comment><USER13> This sounds like a really fun thing to play with and could be useful for extending covered range where bandwidth requirements are low.

Where I usually struggle is making it all small and robust enough. Does anyone know of any products which integrate power supply (mains or battery) and the esp8266 into a small, cheap enclosed product. The best candidate I have found so far would be the Sonoff products.

<comment><USER8> Battery would probably be a no-go here.

You can't put repeater into sleep mode[#], and in active AP+STA mode ESP8266 takes 70mA @3.3v, which is 3-4 times lower than best purpose-made wifi repeaters, but will still drain 3000mA*h battery in couple of days.

[#] ...unless whole sensor network has scheduled "data upload" internals, something like 1-minute window twice a day. But even that is going to be very tricky due to notoriously poor precision of ESP's real-time clock - see for example [https://github.com/micropython/micropython/issues/2724](https://github.com/micropython/micropython/issues/2724)

<comment><USER14> Schedule it more often than once per day and when it triggers, resync the clock with your neighbours? If you wake up and nobody else seems to be awake, go into degraded mode where you continually listen for the next scheduled interval.

<comment><USER8> > when it triggers, resync the clock with your neighbours?

Indeed. Periodic clock resync is a must here. Better from external NTP though, as neighbours have their clock badly drifting as well.

> If you wake up and nobody else seems to be awake, go into degraded mode > where you continually listen for the next scheduled interval.

That'll defeat the purpose completely. Here's why:

\- "Listen" consumes full 70mA;

\- "wake up and no neighbours awake" will happen very, very often. Let's take simplest example of two nodes with drifting clock. When they both wake up (each by local clock), inevitably one will wake up first. That node will discover there's no neighbours awake. I a mesh, statistically this will happen to 1/N nodes each wake-up, where N is average number of neighbours. If we tighten requirement from "anybody awake" to "enough nodes awake to reach uplink" (so to make use of external NTP) probability of "not enough neighbours awake" even will come close to 100% on each wakeup.

Slightly better approach would be - when each node wakes up, it stays awake for long enough to cover worst-case all neighbour's clock drift. Average clock drift seem to be +/-2%. Let's say +/-5% would be worst case. That means, all nodes have to be awake 10% of the time just to re-sync clock so that next wake-up will be not worse off than current one.

And staying awake 10% of the time means average power draw of 70mA * 10% = 7mA, which is pretty darn high (3 weeks on a 3000mA*h Lithium cell. Even less if there is payload data transmitted on this mesh.)

<comment><USER15> External high accuracy RTCs with builtin alarms like the ds3231 can be had for cheap

</comment></comment></comment></comment></comment><comment><USER16> I'm trying to view the recent FCC Net Neutrality reversal in a positive light; will it finally force us to abandon traditional ISPs? Building a mesh seems like the proper solution to ISPs that won't treat our packets with respect. Given the correct cost/performance ratio I think we could see a mass of tiny devices scattered around the neighborhood/town/city/state/country with backhauls in as many places as possible.

If they are cheap enough and self configuring then we could just plug them in to any available electrical outlet and go. Put a couple in your house and put a couple in your parent's/sister's/cousin's house. Talk to your neighbors and have them plug a couple in. Head to the local taco place and have them plug a couple in. It shouldn't be hard to get everyone on board: "Plug this in and get free {libre|beer} Internet access!"

<comment><USER17> Did you hear about Freifunk? [https://en.m.wikipedia.org/wiki/Freifunk](https://en.m.wikipedia.org/wiki/Freifunk) It's more or less what you described.

</comment></comment><comment><USER16> For those of you, like me, who don't know exactly what an ESP8266 is or how it might be used, check out this video by EEVBlog[0]. It gives a brief background on the chip and its alternatives and shows some simple programming examples.

[0] [https://www.youtube.com/watch?v=Q6NBnPfPhWE](https://www.youtube.com/watch?v=Q6NBnPfPhWE)

</comment><comment><USER18> Do Wi-Fi repeaters work in general? It would seem that if you had two AP's broadcasting with the same SSID, one of which is relaying back to the other, the computer or the AP's or both would get confused. I only saw it tried once and it didn't really work but what is the state of the art? Is this a solved problem?

</comment><comment><USER19> It's been quite a few years since my college networking class, but am I wrong to expect this to just kinda work out of the box? The ESPs can already act as routers and the MAC/IP protocols should already insure packets get routed around correctly. How is it different from, for instance, hooking up several WiFi routers at home?

I'm curious about the challenges b/c I've been wanting to try to get a more long-distance mesh going with Lora. Some of the newer chips are incredibly affordable:

[https://www.cnx-software.com/2017/10/13/this-ttgo-board- comb...](https://www.cnx-software.com/2017/10/13/this-ttgo-board-combines- esp32-lora-radio-and-oled-display-for-just-10/)

<comment><USER20> That's nice, but it would seem more useful at 915 mhz...

<comment><USER19> why?

<comment><USER20> 433 mhz isn't open for unlicensed use in North America.

</comment></comment></comment></comment><comment><USER21> Why v4 NAT instead of IPv6?

<comment><USER8> Dynamic routing is the hardest part of mesh network. By using NAT _martin-ger_ has side-stepped need to have routing altogether (it's just default gateway for each node like that). But that of course comes at cost - reaching your device from "outside" becomes much harder.

Also, ESP8266's official SDK doesn't support IPv6.

<comment><USER22> Could you elucidate on that? I don't get how a message is somehow routed through a thicket of say 1000 of these things to get from one node to another, because NAT?

<comment><USER8> "Mesh" (in thick air-quotes) here is just a way for self-organizing for shortest uplink hop count.

Strict uplink-downlink hierarchy still stays regardless of whether "manual uplink" or "mesh" mode is in use. Each repeater doing Source NAT still stays. Lack of "sideways" connectivity still stays (unless you configure manual DNAT which is incompatible with "mesh" mode to begin with).

I.e., if you have 3 of those ESP8266 repeaters with two clients connected to different repeaters, there is no (easy) way to have those two clients talk to each other. Let's say this is our network diagram:

            {The Internet}----[Cloud Server]
                  |
              [Wired AP]----[Local Server]
                  |
             [ESP8266-R1]
               |      |
      [ESP8266-R2]  [ESP8266-R3]
            |            |
       [Clinet 1]    [Client 2]

...then, we have two options how to make Client 1 and Client 2 talk to each other:

\- each client talks to the same server (local or cloud) and server takes care of passing the message;

or

\- we configure _static_ destination NAT (option _portmap add_ ) on both ESP8266-R2 and ESP8266-R3, and disable "mesh" mode (i.e. manually configure uplinks for all 3 repeaters);

...and arranging 1000 of those in a single string and routing a single packet through that is better avoided. "Mesh" mode helps a lot with this, by selecting shorter path to the internet and bringing topology closer to a tree, where possible.

<comment><USER22> Thanks! Will peruse over coffee

</comment></comment></comment></comment></comment><comment><USER23> Is this interesting (or at least relevant) for the freifunk project?

</comment><comment><USER24> Whats up with NodeUSB? It was in Kickstarter some years ago. Anyone here have one?

It is ESP8266 and can be programmed without grahical IDE, using only GCC toolchain and Lua?

</comment><comment><USER25> The amount of possible chained NATs gave me an aneurysm.

</comment><comment><USER26> Why can it only do about 5mbps?

<comment><USER8> 5mbps is about the best case (all 3 nodes on the same table). In more realistic deployment, it'll be much less.

So, why so slow?

TL;DR: Too little RAM on ESP8266.

WiFi is half-duplex, i.e. in basic scenario (no MIMO; all stations close enough that each can hear at least some other), only one node can transmit at a time. [CSMA/CA] protocol is used to enforce this limitation. This protocol is susceptible to [Hidden node problem], which absolutely will be present for wifi repeater. Meaning that data in a single burst is transmitted fast, but any switch-over of who's transmitting is going to be really slow, with collisions, pauses, etc. In turn, that means that to achieve any decent throughput, WiFi repeater should buffer as much data as possible to minimize number of transmitter switch-overs. And that requites RAM - say to buffer half-second data burst at 54Mbps you'll need 3.5MB of RAM. Alas, ESP8266 only has 96KB of data RAM, out of which just 32KB is used as packet buffer with standard SDK.

[CSMA/CA] [https://en.wikipedia.org/wiki/CSMA/CA](https://en.wikipedia.org/wiki/CSMA/CA)

[Hidden node problem] [https://en.wikipedia.org/wiki/Hidden_node_problem](https://en.wikipedia.org/wiki/Hidden_node_problem)

</comment></comment><comment><USER27> Could you integrate a bitcoin address that I can pay to for bandwidth? Have the operator set the kB/satoshi and the rate at which withdrawls occur over the lightning network? When the address is empty the connection is terminated?

<comment><USER28> IUNGO is a blockchain based project to do exactly this:

[https://medium.com/@iungo/iungo-global-wifi-networks-is- abou...](https://medium.com/@iungo/iungo-global-wifi-networks-is-about-to- disrupt-the-old-standards-d856880e04a4)</comment></comment>


Scientists Have Shown There's No 'Butterfly Effect' in the Quantum World - <AUTHOR> https://www.vice.com/en_us/article/889ejg/scientists-have-shown-theres-no-butterfly-effect-in-the-quantum-world <comment><USER2> Quite a big discussion a few days ago of another source, [https://news.ycombinator.com/item?id=24167691](https://news.ycombinator.com/item?id=24167691) (80 points, 3 days ago, 54 comments)but I think this article is better and has a good discussion about the chaos and the problem.

But as I said in a previous comment, they did't show that all quantum systems have no butterfly effect, they only show that in one quantum system the butterfly effect is small.</comment>


Why so much hatred? - <AUTHOR> I was looking to integrate payments on my website and contacted Stripe. Stripe referred me to another payment processor named PaymentCloud Inc.
A senior account manager, Mr. R, sent me an email asking to fill out an application.
Yesterday evening I got a call from Mr. R's office. I picked the phone and realized that he had made the call by mistake, I also realized that Mr. R and his two women colleagues are having a conversation about my application. What followed was a real surprise to me. I heard them making racial and derogatory comments about India, Cricket, IT and my background.
The incident left me with couple of questions:
- Why so much hatred against someone who you haven't met or even talked to for God's sake.
- While filling the application I gave them my personal information including EIN, SSN, License. Now I am worried about that, is there anything I can do? <comment><USER2> Good Morning ankitsoni,

My name is Michael Wright, I am the VP of Sales at PaymentCloud Inc. I was alerted to your thread and wanted to take a minute to respond. This incident is absolutely not in line with our corporate philosophy and an issue that we take very seriously.

I would implore you to call our main office and request to be directed to me so we can discuss the issue and take appropriate action. I agree with PaulHoule below that "hate is not good for business" on many different levels.

Just to touch on your second point, I can assure you that your personal information is secure. We do not share, transmit, or distribute any personal data from our merchants and is only accessed inside our secure underwriting and risk environment.

I look forward to speaking with you and taking the necessary steps to resolve this issue.

<comment><USER3> Curious, what are the possible steps that you can take? Can this be a valid reason for firing someone?

</comment></comment><comment><USER4> Saying "hate is everywhere, it's life" isn't the right approach. If I were you and if this story happens to be true, I'd simply pick up the phone and call their office. I'd ask to talk to Mr. R directly. Then I'd simply tell him that someone butt-dialed you the other day and that you heard racist comments about you. Ask him if he's aware of that.

What does it do? Well, next time Mr. R will make racist comments, he will always remember this embarrassing moment. Racism will be tied to an embarrassing moment and that is exactly how you want him to feel like. Who knows? Maybe he'll think twice next time before opening his mouth. React and go straight at the source of the problem, don't be passive...

<comment><USER5> Nice idea in theory. I'd add the caveat though that being abused very likely is a humiliating experience, one which might induce feelings of powerlessness and self-consciousness, which might in turn make it difficult to confront the aggressor in the tone you are advocating. If the OP wants to do this, great, but I'd say that, if he chooses not to, he could be forgiven for being "passive" in this case.

</comment></comment><comment><USER6> It's sounds like plain racism. It will probably hurt your odds of getting a job, but I wouldn't worry too much about personal info.

What I've noticed is that India is a really big place and the spectrum consists of some of the smartest people you'll ever meet and some of the absolute dumbest people.

Unfortunately, most people only really have access to the dumb ones. So they extrapolate that into a stereotype of all Indians.

I guess there's not much to do but keep going. I'm not sure whether you can report the incident to anyone, but it sounds awfully difficult without evidence.

<comment><USER7> > spectrum consists of some of the smartest people you'll ever meet and some > of the absolute dumbest people

Wouldn't that be true for every country ?

<comment><USER8> "Lake Woebegone - where every child is above average" \- Garrison Keillor

<comment><USER7> Wouldn't that be true for every country ?

</comment></comment></comment></comment><comment><USER9> You will find hate everywhere. The US, UK, India and Czech Republics are, broadly, multicultural success stories, but you can find absurd hate, murder, and terrorism in all of those places.

Despite the talk that "coders are masters of the universe", "girls should learn to code", "Mark Cuban wants you to learn machine learning", software development is a labor intensive business (I see managers with a $120k a month payroll wringing their hands over a $9k a month AWS spend) and labor- management conflict as real as it is for coal miners, longshoremen, hotel workers, fast-food workers, etc.

IT workers in many parts of the U.S. have seen operations and jobs go to India. Some Indian companies execute very well, but some do not and then we see the double whammy that IT workers lose their jobs and then system failures have a negative impact on remaining workers, customers, investors, etc.

In terms of call centers, sometimes you talk to an Indian person for customer support and you get great results, but often you don't. Worse, I have received many calls in the last two years from people from India who want to steal my money on the pretense of being the U.S. tax authority or take over my computer and I read that this experience is common. Now many call centers are moving to the Philippines because U.S. citizens can't place the accent.

(Note it is a big labor conflict because displaced coal miners and manufacturing workers and their families could be doing this sort of work. I think of many black people who got into call centers in the south in the 1980s who are great at what they do.)

That said, hate is not good for business. Should you hate your customers, employees, suppliers, partners, community, government? No. There is not profit in that.

If I were you I would contact the supervisors of those people and tell them what happened. That kind of behavior hurts their business directly, probably more than it hurts you.

If I was the supervisor I would probably not fire the people immediately but I would put them on warning, let everyone know this behavior is unacceptable, and if it happened again they would be out.

What they do is up to them, but you should put the ball in their court.

<comment><USER10> Czech republic is a multicultural success story?

There ain't a lot of terrorism in CZ, though the country is filled with hatred mainly towards gipsies and now muslims. Even the government in order to remain elected boycotts EU's directives about accepting migrants and anyone who's not white. I kid you not.

</comment></comment><comment><USER11> In reaction to the majority of the conversation below being centered around the swift implementation of stern retaliation, if I were at the table of this conversation, I would introduce the following idea to the multiifaceted conversation. Not to be confused with the right way but an additional one.

What was said? Why is that not part of the conversation we are having?

Cultures meeting takes time. Think world history. Resist the urge to fight fire with fire. Cook meals on them or put them out.

Who's to say that these derogatory comments were not actually based on a documentary is about India that only highlighted the bad parts? Or who's to say that these peoples limited interactions were simply poor so far. A stern talking to is in order but not without further conversation about WHAT was said and WHY. Let these individuals walk away with a positive, personal interaction not a story about being caught.

Fix your PR problem by using this as an opportunity to put that person on the plane to India for the same price that it would cost for you to fire them and re-train someone else.

I would say in general, in America, Indian culture here is just catching on and it's going to take the persistant exploration of people's comments, and pulling them apart and not saying "all racial comments or bad or wrong" or "any comment that hurts anyone is wrong or bad" but what if we said: Can we talk about it?

Call the manager. We don't know enough about the situation to assume that those people are hateful. So far, just ignorant!

PS I am Ankit's classmate and he asked for my opinion.

</comment><comment><USER8> "Hate is not good for business"

 _That 's_ the takeaway here? Are we aiming so low these days?

If three employees at a company are sitting around a table making derogatory and racist remarks _during_ business hours, that's symptomatic of a much deeper issue at PaymentCloud.</comment>