The Copenhagen Catalog: Principles for a new direction in tech - <AUTHOR> https://www.copenhagencatalog.org/ <comment><USER2> "Principle: a fundamental truth or proposition that serves as the foundation for a system of belief or behavior or for a chain of reasoning."

These aren't 150 "principles" \- more like "150 feel-good marketing statements". Or perhaps I should say, "virtue-signalling statements"

Taking just one example : "Make business human to human instead of b2b or b2c - let's build companies that have humans at the core"

Consumers are human, and businesses are made up of humans, so what exactly is this saying? It seems like "humanity" and "humans" are bing used as a synonym for "good", which makes the whole thing trivial.

If we were serious about something like this, we would try and find 1, 3 or 5 "principles" out of the 150, _then_ we would actually be doing some real thinking in terms of what things mean, relative importance etc

<comment><USER3> Humans are also consumers. Modern businesses think about people as consumers first and human second. This paves the way to many perversions, such as, huge industries bases on exploiting human weaknesses (e.g. addiction based online gaming) . This is enabled morally by marginalizing the concept of a human to consumer first. In this moral outlook, as long as you get costumers to buy your product, everything is AOK morally. Being human oriented means you don't create a product that which manipulate humans into self or social harm even if it'll turn a profit.

<comment><USER4> The problem with generic principles like that is that they'll be used against you by anyone who doesn't share your opinions on what "manipulate" or "social harm" mean. You'll be harangued for being an hypocrite and going against your own principles, despite never having intended the principle to be applied that way.

</comment></comment></comment><comment><USER5> I don't disapprove, though it does seem a bit out of touch. Maybe developers aren't the most thoughtful people, but the state of things isn't without reason. If you moved to another city, you are paying a lot of rent, you work as a contractor (or other "flexible" employment), you have student loans, potentially a mortgage, you don't know how long you have this career and there isn't any employee organization to back you up then "values" doesn't come first. You should change the way investors, schools, companies and societies work.

<comment><USER6> I mean investors, schools, companies, and societies are all made up of people. It isn't only aimed at developers.

That said, even with those factors, many employees in tech today 100% have ways they can influence the way companies interact with these values, even in small ways. More nuanced yes but I don't think its fair to say it's out of touch. Especially if this hits its goal and is displayed in many places, social pressures can help at both the developer and company level.

</comment></comment><comment><USER7> Many of these resonate with me, but I feel 150 is too many. I try to live by the following:

1\. A corporation must equally serve the three groups that come together to make it possible: investors, customers _and_ employees. Losing the long term goodwill of customers and employees for quarterly (or even annual) targets is ultimately unprofitable.

2\. Technology is not an end in itself. Focus on solving problems. Don't use machine learning where a spreadsheet would suffice. Don't use Redux, GraphQL etc., unless you have the particular problem they try to solve. Don't cram blockchain into everything.

3\. Don't use technology to solve human problems. Use it to make the solution easier. If your team is unhappy, _talk to them_. Don't create apps to manage their sentiment. But do create an app that helps them express themselves to you easier.

4\. Question the prevailing view, especially if it's super-popular: "Fail fast", "Move fast, break things", "Fake it till you make it", "Premature optimization is the root of all evil", "Man days estimates are anti-agile", "Relational DBs constrain your ability to develop quickly" etc.

<comment><USER8> Neat point: "the three groups that come together to make it possible: investors, customers and employees."

But - there are two more entities in direct relationship: suppliers, debtor; and more importantly many externalities, like non-participants, non-customers, the environment etc..

I don't think it's practical to promote this 'arbitrary equality' ideology on everything because it has a 'good sensibility'.

A 'corporation' is just a group of people doing stuff. They can do whatever they want: make profits, not, have fun, make stuff, provide some service, or not. It's entirely up to them how to determine the 'balance' between the various actors.

As for many of the remaining points in the article, I suggest people can do whatever they want as well, so long as they trying to be good people. "Move fast and break things" is a perfectly suitable approach in some situations, though obviously not always.

<comment><USER7> I think you're missing my point. The reason for (1) is the idea that "maximizing shareholder value" is the only goal of a corporation. There are two other stakeholders in a corporation who get shortchanged because of this principle. Of course, suppliers are there, but consider that _we_ are _their_ customers (we being the corporation under consideration).

Also note that this is what _I_ follow personally and it's based on fifteen years of experience working for many companies. I would hardly call that arbitrary, and certainly not arbitrary in quotation marks. Whether that's right for an entire industry, is an open question.

<comment><USER8> I did see your point, I'm trying to get you to consider what those '3 parties' actually are, and that there are actually other participants as you would like to define it.

"There are two other stakeholders in a corporation who get shortchanged because of this principle."

There is at least one other obvious group: suppliers.

There is a buyer/supplier relationship equilibrium on both sides not just one side - is my point.

For example, if you 'contract' for a company, well - you're not an 'employee, shareholder or customer'. But you are 'part of that equation' as a supplier, as important as customers.

The other major party that's missing is the lender - this is very much like the 'investor relationship' and so they can't be left out. Remember that financiers who provide debt to a company have _senior_ rights to assets, above and beyond the investors. They can also have special covenants that give them incredibly control. Those financiers can even be individuals (i.e. many 'bondholders' are individuals).

They are not investors.

So you talk about 'investors getting the advantage' ... that's actually not quite true - many cases it's not the investors, it's the lenders/bond holders who are making bank.

Lastly are the externalities. While a company has 'responsibility' towards it's employees and customers, it absolutely has a relationship with every entity that it doe any kind of business with - and those parties matter.

The 'economy' is basically a big web of those entities: buyers, suppliers, investors, lenders, workers, externalized entities (+government +NGOs).

</comment></comment></comment></comment><comment><USER9> This one of the few that resonated with me: #readpoetry

      It is difficult
      to get the news from poems
        yet men die
      miserably every day

      for lack
      of what is found there.

<comment><USER10> Well, it's good marketing, maybe, but this is an assertion made without evidence, and the author may have been biased.

</comment></comment><comment><USER11> "Principles" should be worded to be clear and unambiguous. The items listed here can be interpreted to mean something, but different people will interpret them to mean different things. They are more like koans. Useful to ponder, but not for people to agree to and think they've agreed to the same thing.</comment>


2021 CO2 targets would generate €34B euros in penalty payments within Europe - <AUTHOR> https://www.jato.com/2021-co2-targets-would-generate-e34-billion-euros-in-penalty-payments-within-europe/ <comment><AUTHOR> The end of the article makes clear that the 34 billion in fines would be only if the auto manufacturers didn't make any changes from present production, but the article still makes clear what pressures they are under to switch to electric cars.</comment>


Pupils could learn to write computer programs at school, good or bad? - <AUTHOR> http://www.happydaddymagazine.com/2011/09/19/pupils-could-learn-to-write-computer-programmes-at-school/

<comment><USER2> I would say that there are strong parallels between programming and math as well as programming and grammar. Programming structures and syntax are just a form of 'grammar' for different languages. Learning these skills at a young age would, in my opinion, strengthen the conceptual understanding of the material. Programming is also rhythmic and ordered, much like thought processes when tackling long or complex math problems. I would like programming to be seen as one of those basic/core curricula by the time that I have children in the school system, but I will teach him/her anyway.

I am an idealist though, and what may work for some kids would probably hinder others.</comment>


SmugMug on Amazon S3: Outages, slowdowns, and problems - <AUTHOR> http://blogs.smugmug.com/don/2007/01/30/amazon-s3-outages-slowdowns-and-problems/ <comment><AUTHOR> The way they use S3 for cold storage and their local servers for hot storage is really interesting.... A lot like some of the things people have been discussing regarding memory vs. DB (yes, this link was grabbed from inside the jamglue article)

</comment><comment><USER2> Another interesting post from SmugMug, but this isn't news. It was posted back in January.</comment>


Ben Huh: "The worst candidates focus on money the most" - <AUTHOR> http://www.techflash.com/seattle/2010/02/are_you_what_you_earn.html

<comment><USER2> Wow, $8.55 an hour with no benefits AND self-employment taxes (as a contractor). Even if I loved the work, I couldn't keep up my modest lifestyle on that kind of pay. And no, I don't have any debt and I'm good at managing my finances.

He talks about the candidates who complain about the pay, but he neglects the fact that anyone with a decent head on his shoulders would simply laugh at the job listing and move on. He _never_ even hears from the best candidates. It's simply irrational for someone even moderately skilled to settle for that kind of pay.

If you were talking about $60k vs $90k, I would say the people you want are the ones who don't care about the money. But if you expect a highly educated and motivated person to be happy making minimum wage, you've got serious issues.

<comment><USER3> What he says does make sense, to an extent, in regards to entry-level positions. I'm sure he wouldn't do the same with mid-levels or higher. I bet a lot of the people who've seen his post are more experienced then the entry- level, so of course they would react the same way i initially did, in disgust.

So, seeing that he specifically wants 'entry-level', he's probably looking for some young recent college grad with no long-term commitments. Having considered all that, if I were a recent college grad I'd probably be scared away by the prospect of just dealing with self-employment taxes, which at $8.55/hr, this job would totally not be worth the extra effort required.</comment></comment>


Web Starter Kit - <AUTHOR> https://developers.google.com/web/starter-kit/ <comment><USER2> This somehow reminds me of Inception. We have a perfectly functional computer, then we run a browser on it, we download a bunch of HTML, which in turn will download a whole slew of JavaScript in order to create the illusion of an application running natively that offers a subset of what the computer could offer. The only difference is that this web application supposedly runs on 'all devices' except that every web application is quite brittle once you try to actually run it on all devices. And forget about device access (though that is slowly getting a bit better).

The only plus I see in all this is that in the end we are now free of the API lock-in that OS vendors traditionally required, that we tend to take 'client- server' applications more or less for granted and that because it is server centric you don't have to bug your users to download the latest version every time you improve things (though as was pointed out in another thread, this is _also_ a disadvantage, as a user you lose control and if the company goes out of business you could lose it all).

The web also roams much easier.

If we keep going like this for a little while then we're back where we started, with the graphics terminals from the 80's, (canvas is pretty close actually) only this time across the WAN instead of a lan and with the ability to hyperlink between applications.

<comment><USER3> The shocking, unprecedented, world-changing difference that the web brings is that on the web all you have to do is click a link and your computer downloads, "installs", and runs a program. No manual installation necessary, no upgrades, no installers or wizards. No delay. This process is safe -- the page is sandboxed and can't interfere with the rest of your machine. And these things can be instantly shared! All I have to do is paste a bit of text to my friends and it turns into another clickable link that's only a touch away.

Engineers frequently undervalue this feature, especially considering the things that the web give up in order to achieve it. So yes, it's a pain in the ass to get that div to align correctly but in exchange you get to run _instantly_ and _almost everywhere_ [1].

Relevant: [http://xkcd.com/1367/](http://xkcd.com/1367/)

[1] Depending on your target audience, old browsers might be a major problem (China), but the browser landscape is rapidly improving in terms of a minimum expected set of features.

<comment><USER2> That's the theory.

The practice is that

\- you give your precious data to third parties

\- that the safety problem now shifts from keeping your computer safe to keeping data in the hands of third parties safe (and this does not always play out in the way we would like, see codespaces for a recent example)

\- that even the client side safety is a problem, the 'distribution advantages' have also been recognized widely by the blackhats.

\- that we end up being tracked from here to Tokio and that the web is rapidly turning into a series of silos that try to have as little as possible to do with each other.

\- that the final experience is almost always sub-par.

The theory is fantastic, but the practice leaves much to be desired.

<comment><USER4> But in practice it is much better than any alternative multi-platform instant software installation ecosystem. And in practice, it has led to a thriving ecosystem of applications, most of which can link to each other and will work on a large portion of users' devices.

<comment><USER2> Yes, absolutely true. But I can't help thinking that there must be a better way to achieve these goals than this mess we've made.

We're clearly in 'we should be amazed the pig dances at all' territory rather than in 'look how good the pig can dance'.

<comment><USER5> The better way would have been for the open source community to advance the Linux desktop in the way that OSX has been evolved - i.e. To gradually bring the advantages of the web back to the OS.

<comment><USER6> But if OSX has evolved that way... Why not just use OSX?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The web is now hamstrung by the HTML/CSS layout model more than anything else. The hackery required to attempt to imitate native mobile apps is horrific.

Google would be better off throwing efforts into a new layout engine leveraging raw JS and WebGL, but with a sane API, than these continuous attempts to push HTML into places where it doesn't work. If they don't lead it I can see someone else doing it in such a way that their core money maker of web scraping and indexing ceases to work.

<comment><USER8> This is the same complaining I always hear from people who don't want to learn how to use HTML and CSS. Yes, it is different than what you are used to. Yes, it will take some time to learn and some of that will be uncomfortable. But that does not mean that that HTML and CSS are bad. I know this because I successfully build mobile sites that look and function fine and I assure you it works.

You say "hackery is required to attempt to imitate native mobile apps" and I agree with you. Can I ask why it is so important to copy the styling of native? That seems like a lot of effort for no good reason. Mobile web can be better than native if you let it, but forcing it to be something else purely for reasons of fashion is foolish.

HTML/CSS produces a flexible layout that is usable by many different sizes and types of devices (even audio interfaces) and that is a good thing. It takes effort to get it working for all of the possible ways it could be used, but it is possible. After a little practice, it can even get easy. The hard parts of HTML/CSS would still exist in any flexible layout solution. Making a rigid screen-painted layout solution avoids problem inherent in flexible layouts those, but it gives up so much.

<comment><USER9> > After a little practice, it can even get easy.

Just googling for "vertical align text css" should be enough to tell you that different layout is needed. Why shouldn't there be a layout model that makes it easy to do the things people are trying to do?

The idea that we shouldn't even attempt to create a better one is silly.

<comment><USER10> I think the problem comes from a lack of understand of the complexity of such a task. Vertical align text according to what? The easiest way to vertical align text is exactly how you'd expect it to be, and it solves the problem perfectly.

If you want to align text vertically, you just do

      font-size: 20px;
      line-height: 40px;
      vertical-align: middle;

What's the problem?

<comment><USER11> .. and then, when the content is wrapped over two lines you get a line-height that you set just to vertical align the text. Perfect? No :-)

</comment></comment></comment></comment></comment><comment><USER12> Why does this need to depend on Ruby as well as node.js? As a starter kit shouldn't it aim for the least dependencies to get started?

So for devs who want to use this with another web framework like Python, They need to have node, Ruby and Python installed?

Node is extremely easy to deploy/install that's even self-hostable where you can even check in node.exe (e.g. on Windows) into the repo so no prior installation is necessary. Just run `node install` to pull in all the dependencies and your away. Surely that's the kind of dev experience we should be aiming for?

Are the benefits for SASS over a pure js solution like less that much better to justify the extra infrastructure dependencies?

<comment><USER13> Ruby is a dependency for SASS, that'd be the only reason

<comment><USER14> There is libsass and sassc [https://github.com/sass/sassc](https://github.com/sass/sassc)

It works for a fairly large project i'm involved in.

Besides being AFAIU significantly faster then the ruby one, it allowed me to continue to refuse to add another scripting environment to our already mile long dependency list.

</comment></comment></comment><comment><USER15> I wish I had this in my tool belt a few months ago when we began working on our web application. The core of our project can be reduced to something like web-starter-kit but we had to get there with many, many hours of hard-earned knowledge. I also like the leanness and cleanliness of web-starter-kit, it's really a nice collection of best-practices and pre-configured tools.

I will definitely incorporate some pieces into our existing project and use it as a base for our next ones.

Thanks guys!

</comment><comment><USER16> Some people hate the idea of shifting everything to Web. Other people hate how unsuitable HTML5/CSS3 is for replicating native appearance.

But I think overall, it's a good middle ground. There will never be a perfect solution in the real world (where resources are limited, and companies are motivated to lock-in).

Web is not a perfect medium, it has it's disadvantages. Web apps were definitely not in mind when developing and designing Web. But on other hand, it works and it's proven, it's been here for a while. There are solid technologies supporting it (nginx, apache, programming languages with their frameworks). Some say why not native? For the reasons we shifted away from native. Could we improve current situation with native applications? Maybe. But it requires a major player to get involved (read: money and skill). Would they be motivated in pursuing something philosophically right and all, while current technologies generate a lot of money? Doubt so.

Yes, HTML and CSS were not meant to be used for mobile apps, mimicking native appearance. As an alternative, we can stick to vendor, and learn vendor specific stuff which doesn't share much in common, not even programming languages. Meanwhile HTML/CSS is something much more developers are familiar. It allows more developers to develop iOS/Android apps. Maybe we should just make it DRYier like we were doing with so many problems? At first, grid frameworks came for CSS layout, then Bootstrap. And in future bootstrap-which- gives-native-iOS/Android look will come? There must be something like that already. We could throw it all away and create some new API (some suggest JS + WebGL). But again. It requires major effort, major resources and current technologies are money machines. So why to stop?

Not everything can be perfect and correct in real world, with real constraints. Some people prove that wrong from time to time. Will someone do this time?

</comment><comment> peter-row Just a stupid question ... what is it?

edit: Answered in other people's comments - it's somewhere between HTML5BoilerPlate and Bootstrap - a basic "hello world" bunch of HTML / SASS / js boilerplate code. This one has an emphasis on mobile.

</comment><comment><USER17> @addy nice!

so what's the goal here.Why would one use this over bootstrap/foundation/x css framework?

Do you intend to integrate this with other frameworks you've written and other Google products like polymer/angularjs? My point is are you developping a coherent ecosystem or are they just independent tools?

thanks.

<comment><USER18> I'll just reply because I know Addy is crazy busy. The goal is to give developers the education and tooling they need to do well out of the box by following all of our best practices straight away. In this case it can complement bootstrap and other frameworks because we are not building out a component library.

</comment></comment><comment><USER19> Its interesting they are using GitHub instead of Google Code.

<comment><USER20> Google Code is great, but I personally love GitHub <3 We've been actively pushing to do more development there across [https://github.com/google](https://github.com/google) [https://github.com/googlechrome](https://github.com/googlechrome) and so on.

<comment><USER21> Google Code has been languishing. You guys could really do some things with it to make it a competitor with Github and Bitbucket.

<comment><USER22> I see Google Code being in the same spot as Google Reader on Google's roadmap.

<comment><USER23> I always begin to think the same thing, but then they open source a new project that is hosted on Google Code.

<comment><USER24> I wondered if Google's internal development infrastructure looks like or hooks into Google Code, making it easy to release code publicly on Google Code.

<comment><USER25> Not really... it's about the same amount of work whether it goes to Google Code or GitHub. The teams that have an easier time of it are those that are using Git+Gerrit internally, since a public release is as simple as `git remote add` and `git push`. A number of teams continue to use tools like [https://code.google.com/p/make-open-easy/](https://code.google.com/p/make- open-easy/) with varying degrees of success.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> >If you are planning to do the same, spend time listing down all your UI elements and test whether the theme supports them.

This is all too important when evaluating a prefab Bootstrap theme. In the past when I have used Wrapbootstrap themes, I've been a few days in frustrated that something isn't working. Then when I dig into the asset files I realize that the theme was poorly written and I've been spinning my wheels for nothing. It's too bad so many themes look nice but simply aren't built the right way.

</comment><comment><USER27> It seems the navigation disappears entirely when you shrink the window. I would think they would implement their "hamburger" icon?

<comment><USER18> Ah, cool I think you have hit an intended design feature. We use min-device- width to know that you started on a smaller screen (or a wide screen). If you are on a wide screen responsive elements are changed slightly to fit the screen. If you start on a small screen you get the hamburger menu.

Can you file an issue on the github project so that we can work on it to see if it is an issue.

<comment><USER28> On the homepage, the 'hamburger' menu doesn't show. Every other page is fine though.

</comment></comment></comment><comment><USER29> Is it just me, or do the fonts on that page look terrible on Windows?

/edit: looks like it's just "Roboto Condensed"

<comment><USER30> No it's not just you, it's everyone using chrome windows, it a bug in their rendering engine that has been unfixed for years.

There are multiple easy ways to fix this (load order, re-rendering font, server config)..you would think a web starter kit would get the basics of fonts right...

The layout is also broken for the icon rows...

Example: [http://i.imgur.com/8DCIsLw.jpg](http://i.imgur.com/8DCIsLw.jpg)

<comment><USER31> It's not a bug, it's just how GDI ClearType renders text. It doesn't perform y-axis antialiasing so almost-horizontal curves look blocky. The solution is to use DirectWrite but Chrome hasn't made the jump yet.

</comment></comment></comment><comment><USER32> How does this compare to Yeoman, and is it meant to be a replacement? I thought Yeoman was made by some Google folks.

<comment><USER33> From the documentation:

"Web Starter Kit is inspired by Mobile HTML5 Boilerplate and Yeoman's generator-gulp-webapp, having taken input from contributors to both projects during development."

<comment><USER18> It's not a replacement. My opinion on this as a stakeholder is that is meant for different audience that Yeoman serves. Ultimately we have produced a highly opinionated stack that developers can start with and customize as they like (or not if they don't want to). This lets developers who are experienced quickly start and manipulate it, and lets developers who don't know what a good workflow looks like be set up for success straight away. Yeoman on the other hand gives you complete control over how you want your project to be started and assumes that you know all the answers to the questions the generator poses.

I also like that Web Starter Kit is just a simple download that you can extract and be good to go with.

</comment></comment></comment><comment><USER34> It's always interesting to see the flurry of Google releases in the month leading up to Google IO. My understanding is that projects hold out on releasing in the hopes of being included in the Google IO line-up, but release just prior to (or after) Google IO if they didn't end up making the cut. I don't mean to belittle these projects (this one looks quite good, for example!), just pointing out that you can potentially get a read of Google's current priorities by comparing the projects released surrounding Google IO versus the projects released at Google IO. There are some other factors to be mindful of, such as Google IO's focus on developers, however.

</comment><comment><USER35> I am a bit confused here. What is the difference between Dart and Angular, and this initiative? I hope this does not sound as a dumb question. I am asking this because people here are comparing it to Twitter Bootstrap.

<comment><USER36> Dart is a programming language that compiles to JavaScript. The project also encompasses APIs like collections, async and a much improved DOM API. Dart also has a node.js-like server VM with IO.

Angular is a client-side web framework that provides templating and data- binding. It was originally written in JavaScript, and now has a Dart port as well.

Somewhat relatedly, Google and Mozilla have been working on the web components standards, which bring some of the features Angular popularized, and some more fundamental ones as well, natively into the browser. These include Custom Elements, Shadow DOM, Mutation Observers, Object.observe(), and HTML Imports.

Polymer is a project that helps with building custom elements, it adds some sugar including templating and data-binding, similar to Angular in some ways, but completely focused on modern Web Components related standards, and on elements - not apps or frameworks. You can use Polymer elements in any app with any framework, or without a framework.

Web Starter Kit looks like a bundle tools to help you build a site with modern best practices, like responsive layouts, a local dev server, a build system, mobile-friendly user input, multi-device testing, etc.

Web Starter Kit looks like it's framework agnostic, so you could probably use Angular or other frameworks to fill in the views, though these days you might find you don't really need a framework if you're using Web Components.

<comment><USER35> That's a comprehensive explanation, thanks!

</comment></comment></comment><comment><USER37> I'm curios about the CSS naming conventions.

I'm assuming for example that _component--modifier-name_ denotes a class modifier (ex. _.button--primary_ and _.button--secondary_ ) and _component__descendant-name_ denotes a a descendent node of a component (ex _articles-list__item_ ).

It looks similar to SuitCSS ([https://github.com/suitcss/suit/blob/master/doc/naming- conve...](https://github.com/suitcss/suit/blob/master/doc/naming- conventions.md)). Is there more information about them?

</comment><comment><USER38> I've been working on a similar web builder with Entomic - [https://www.entomic.com](https://www.entomic.com) \- that lets you create sites and get live previews across different browsers and devices as you develop. It's a little rough still, but it does make responsive development a bit easier.

</comment><comment><USER39> I like this tool in theory, but the inital web site for it sucks...

I was interested in learning about their "Live Browser Reloading" but was unable to learn more about it, as I ended up traveling through a Kafkaesque labyrinth of documentation pages.

Google guys/gals: Please keep working on this, but also make the website more friendly!

</comment><comment><USER40> I guess it makes sense that the only library left to have in Google's web stack was an HTML/CSS framework. So now the circle is complete - you can run a website in Chrome on a Chromebook with a Starter Kit layout (all images as WebP of course) on top of AngularJS, running off a Go backend on App Engine.

</comment><comment><USER41> I can't help but notice that the display of <ul> items is broken (current Firefix, 14pt min font size)...

<comment><USER42> Same here!

</comment></comment><comment><USER43> I suppose you could go this route. More realistic is to produce different server side files for each client type and keep it simple.

There are tons of business reasons to make them physically separate as well, special promotions, advertising requirements, conditional scripts, etc.

<comment><USER44> One reason not to use your method: Google's own guidelines. See:

[https://developers.google.com/webmasters/smartphone- sites/de...](https://developers.google.com/webmasters/smartphone- sites/details)

"Sites that use responsive web design, i.e. sites that serve all devices on the same set of URLs, with each URL serving the same HTML to all devices and using just CSS to change how the page is rendered on the device. This is Google's recommended configuration."

Generally I've found that when Google recommends something, their search algo prefers this too. I obviously don't have direct proof that it does, but if SEO matters I'd follow what they suggest.

<comment><USER18> It's an interesting one. Adaptive serving is a reasonable solution when you are a large site and you can't wholesale merge your site in one go into a fully responsive solution. We find that Adaptive (i.e, server side detection of "mobile") leads to way more problems in the long term with maintenance, keeping up with new devices and also ensuring that you have all the correct canonical links etc in place to ensure that your "SEO" is still good.

Our guidance is responsive all the things...

</comment></comment></comment><comment><USER45> Ironically the home page for it looks horrible in the latest version of Chrome under Windows.

<comment><USER46> Same here, with Firefox on Linux. The grid shows gaps like the web page is missing icons when you stretch the window width far enough.

<comment><USER47> For me (Chrome, Win7), the gaps are explained by "PageSpeed Insights Reporting" and "SASS Support" wrapping down to the next row for all but a small range of horizontal viewport widths.

<comment><USER18> Thanks, I'll get the team to look at this.

</comment></comment></comment></comment><comment><USER48> I think if this can be extended to make the changes easy to apply (with real time checking of how the output will be) and understanding the code differences, then many of the wireframe companies out there may lose their appeal....

</comment><comment><USER49> Twitter Bootstrap competitor?

<comment><USER20> Good question. We don't consider ourselves a Bootstrap competitor, but rather a combination of best practices and tooling when it comes to starting work on new multi-device/mobile web projects.

Bootstrap, Zurb and similar libraries provide a great start for prototyping your apps, but one of the biggest challenges with them is that it's (almost too) easy to get stuck using their styles, look and feel for the lifetime of your application. We think this leads to a poorer experience. It's also easy to just end up with 100KB+ of styles (unless you're opting for a modular build) that never get removed.

In Web Starter Kit, we provide you a boilerplate set of base styles and a visual style guide for your components, but we actively encourage you to change these to suit your own app. This may require a little more work, but the reality is that any serious project is going to have it's own look and feel and we want you to feel comfortable changing the kit to suit your own needs.

We also include tooling for removing unused CSS. So, even if you use our styles (or choose to use Bootstrap instead) we should hopefully help keep your pages lean.

<comment><USER50> Is there any way to use the tooling independently of web starter kit? Wasn't able to find a link on the site, are they just warnings you see once you start developing? Can the tooling account for JS changes and navigation between pages?

Sorry for the barrage of questions, just really hoping to find a decent tool to clean up CSS...

<comment><USER51> If it's just cleaning up CSS you're after, I would use UnCSS. Checkout grunt- uncss task or gulp-uncss to hook it up to your build process. We don't currently document using the tooling independent of the kit, but you should be able to pluck the package.json and gulpfile.js and edit per your needs. We'll try to get this documented.

</comment></comment></comment></comment><comment><USER52> That's it. Google now finally owns the web. The decide what people should find on the web, and they define the web standards, so why not use their html templates.

</comment><comment><USER53> This is how their homepage appear in my chrome:

[http://i.imgur.com/UCfMstr.png](http://i.imgur.com/UCfMstr.png)

</comment><comment><USER54> as someone only casually familiar with node and and frontend dev generally, i'm curious about the instructions to install gulp and other things globally instead of local to the project. could someone illuminate the reasoning behind that? my thinking is that you're almost always better off doing things local to the project if possible.

</comment><comment><USER55> Feels like a Bootstrap competitor, with many more cross platform features and shortcuts to optimizations, device access, etc.

</comment><comment><USER56> Will this become an official Yeoman generator?

</comment><comment><USER57> It's a good idea, but it's currently lacking the richness of bootstrap.

<comment><USER20> For sure. This is just a start and we don't intend on competing with Bootstrap in terms of UI components. We spent a long time evaluating many of the existing UI libraries available today and if a developer chooses to use one of them with the kit, they can. That's cool.

</comment></comment><comment><USER58> I wonder what browsers versions they are going to support at launch.

<comment><USER20> We cover this in our browser support section: [https://github.com/google/web- starter-kit#browser-support](https://github.com/google/web-starter- kit#browser-support)

<comment><USER59> I'll be that guy: this seems nice, I'd love to use it, I'll take another look some time around 2018 when I can start to consider pitching dropping IE9 support. IE10+ is simply ridiculously prohibitive for something like this.

</comment></comment></comment><comment><USER60> isn't this just mostly a copy of Prepros: [http://alphapixels.com/prepros/](http://alphapixels.com/prepros/) :/

</comment><comment><USER61> This seems crude to me compared to my experiences with jQuery Mobile. This also affirms my belief that custom Android and iPhone development is going to go the way of the dinosaur. It's all about the web.

</comment><comment><USER62> for newbies like me this is just to great, cross device webdev can be a nightmare or this just to good to be true?

</comment><comment><USER63> I was really hoping "Delete key friendly" meant that they weren't forcing Chrome to bind delete to the back function any longer.

<comment><USER64> Removing that has been attempted a few times and failed. I would love to see that shortcut removed myself too. :/

<comment><USER65> I'm surprised more people don't know about this BackStop extension that does just that: [https://chrome.google.com/webstore/detail/backstop/pidcjgldc...](https://chrome.google.com/webstore/detail/backstop/pidcjgldchekcoolelhbjfbnccjkckfj)</comment></comment></comment>


Apple Website Running On .Net? - <AUTHOR> http://www.freeimagehosting.net/odmy1 Check the link http://www.apple.com/promo/rebate/status.html, probably the error is fixed. But i got the .Net error. <comment><USER2> it's just an iframe with this url: [https://mrt.moduslink.com/app/AppleStatusSite/AppleStatusSea...](https://mrt.moduslink.com/app/AppleStatusSite/AppleStatusSearch.aspx?Lang=en- US) Just a company they gave the job to create this.

it would have been too good to be true

</comment><comment><USER3> Didn't read the article but I'm going to go right ahead and assume it's just a part of the website hosted on a third party server. MS does the same thing (they have some vendors that handle their site traffic that run linux boxes)

</comment><comment><USER4> So it must be a windows IIS server?</comment>


The Future of Cheap Androids Begins Now - <AUTHOR> http://gigaom.com/mobile/cheap-android-smartphones/ <comment><USER2> The really important thing is is that the phone is $25/mo. as the full usage fee. That's less than half the price of what I'm paying right now on Verizon, and less than a third of what people can pay for the iPhone. I'm considering downgrading to this device right now just because its price is so low.

<comment><USER3> Do you know what kind of network they are? Could you use an iPhone or GSM Android phone on Virgin?

<comment><USER4> Virgin Mobile USA is a Sprint MVNO - in fact they are wholly owned by Sprint. So that means they're CDMA.

</comment></comment></comment><comment><USER5> I bought my wife an Optimus-T for Christmas and, though it may not be as fast as my Nexus-S, it's a solid, well-built little phone that does everything she needs and a lot more. In fact, I tend to think the build quality is higher than the Samsung. I loathe contracts so we just paid list price for the phones (the Optimus-T seemed like a bargain at 240) and we're on a contract-less family plan with T-Mo.

This is really the beginning of the low-cost Android revolution. With more users able to jump into the pool without having to sign up for a ridiculous contract, it'll make what might have otherwise seemed superfluous (Android instead of a "dumb" smart phone) accessible to just about everyone, which is going to be a Very Good Thing for us app developers. The market is going to expand dramatically in the coming year.

</comment><comment><USER6> This is great news for devlopers (or at least me, and I want to be a mobile app developer).

Get an iPhone subsidized, pick up this cheap Android device, and suddenly be able to develop on both platforms while paying <$65 a month for data (plus my regular phone service that I already pay for). A year ago that would have cost a heck of a lot more.

And I'm fine with it being a weak Android phone, I had planned on developing to a low spec device anyway.

<comment><USER7> > And I'm fine with it being a weak Android phone, I had planned on developing > to a low spec device anyway.

I just gave up my iPhone yesterday for a Nexus One. All-in.

Yes, it's not a minimum-spec G1 but I wanted to use it in place of the iPhone. I truly believe if you want to develop for a platform you have to use it everyday. All the quirks, some of the benefits. The iPhone is definitely smoother but I do like the hardware 'back' and 'menu' buttons. Keyboard and screen sensitivity is driving me nuts... The App Market is a mess - took me forever to figure out which Advanced Task Killer was the real monty (tons of title/keyword spam). The lack of scrolling gravity is really noticeable but less annoying now.

I am truly amazed at the quality of the Twitter for Android application (compared to most other apps).

<comment><USER8> Don't use a task killer, it'll just mess things up for you. Either uninstall or stop the services you don't want (using the built-in app manager).

Android ~1.6 did have some issues, plus the slower processor and memory meant that the task management didn't _really_ work out like it was supposed to. But it's absolutely not needed on modern Androids.

<comment><USER9> Unless your provider is anything like mine, Sprint. They load your phone down after each update with apps you don't want (Nascar, Blockbuster, NFL) which cannot be uninstalled without rooting and seem to randomly just appear in running tasks.

Also I've found that a properly-configured task killer can do wonders on battery-starved android phones like the Evo 4G.

</comment></comment></comment></comment><comment><USER10> I just ordered my first Android, a Nexus S for $199 with a 2-year contract cancellable for $200. Best Buy on line was the only place I could get it, the local store couldn't sell it (I'm going to make a blog post about that insanity). Even though it's contract-subsidized it's not carrier locked and seems to expressly permit custom firmware.

Way to go Google! I kind of like having them around. I'd stayed away from smart phones because I found the contracts, carrier locking, and the rooting, jailbreaking, DMCA challenges simply gross. But Google seems to be trying to keep those clowns honest and now I feel comfortable participating in that market.

<comment><USER11> > I just ordered my first Android, a Nexus S for $199 with a 2-year contract > cancellable for $200.

Wait, what? If you buy a Nexus S outright without contract it costs $529. You're telling me that I can buy a Nexus S with a contract for $199, cancel for $200, and thus have a contract-free Nexus S phone for $399?

Can someone else verify this?

<comment><USER10> Yes. I'm sure there are some taxes and other fees that make it not such a huge win. IIRC there was a $35 activation fee that probably isn't refundable.

Personally, I would feel a little gross about doing that kind of thing, mostly from the "this is why we can't have nice things" angle.

So as much as I've regretted cell phone contracts in the past, I'm going to give T-Mobile a fair try. After all, I do need some provider even if I hardly ever use the voice (my previous phone was a prepaid thing I kept in the trunk of the car with the battery out mostly for emergencies).

I know I don't count as "someone else" but see <http://www.bestbuymobile.com/article/google-nexus-s-faqs/> _Are there two different versions of the Nexus S, locked and unlocked? No, the Nexus S is always unlocked, regardless of whether it is sold with a T-Mobile contract or not._

I'll confirm this as soon as I get my phone of course.

<comment><USER10> Yep, the $199 Nexus S (with contract) works great. Not locked. Not even any lame carrier apps pre-installed.

</comment></comment></comment></comment><comment><USER12> Up to now the price difference between iOS devices and Android devices hasn't been decisive but this feels like the point at which Android starts to eat away the bottom 2/3 of the iOS market.

<comment><USER13> I don't think cheap Android phones are going to eat away the bottom two-third of the iOS market. They will be much more attractive to the many people who currently don't own a smartphone and wouldn't buy an iPhone or a high-end Android phone because they are too expensive. (In other words: I expect the market for iOS phones to continue to grow, albeit slower than the overall smartphone market, particularly slower than Android.)

<comment><USER14> He does say iOS rather than iPhone, so he could be talking about expansion into markets that currently have an iPod Touch and a dumbphone, or no phone at all due to youth or poverty.

<comment><USER13> The iPod touch is currently not two-thirds of the overall iOS market, it's 38 percent (10 million units in Q1 2011 vs. 16 million iPhones). Non-iPhone devices (iPod touch and iPad) were a bit more than 50 percent of the overall iOS market.

In the best case scenario for Android, cheap phones can completely obsolete the iPod touch (I think that's very unlikely), but even then they would only take 38 percent of the iOS market.

</comment></comment></comment></comment><comment><USER15> I have an LG Optimus T on T-Mobile. I got it a while back for $200 with no contract.

My $60 plan through T-Mobile is more expensive then the Virgin one mentioned in the article, but because T-Mobile reduces your bill if you don't take the phone subsidy, it is a lot cheaper than the other options I looked at when buying.

I can't stress enough how great a phone is for the price. The CPU is only 600MHz, but with Android 2.2 it doesn't feel sluggish to me (perhaps because I don't know how fast a phone like the Nexus S feels).

The best part of having no contract is in a year I can just buy a new low end phone with dramatically better specs and hand this one down.

</comment><comment><USER16> Did anyone else just think "cheap testing device?"

<comment><USER17> Yep. Two weeks ago I bought a cheap Huawei Ideos running Froyo at about $100 here in Kenya.

Testing Android apps on a physical device beats using the emulator hands down.

<comment><USER18> I bought a ZTE Blade (Orange San Francisco) for 90 euros in Switzerland for that exact purpose.

</comment></comment></comment><comment><AUTHOR> I don't see the devices in this class of prices as a big threat for Apple. They're not in a race for market shares, what Apple looks for is revenue share.

Apple has always targeted the high-end of the smartphone market, and is using iOS to differentiate their devices from all the other (and they have a strong brand).

This kind of devices speaks trouble for two subjects:

1\. Nokia. There's no future for the Symbian phones, and now that Android phones cost less that the less-capable Nokia smartphones they're in big trouble.

2\. High-end Android smartphones. It's difficult to differentiate for an high- end device when the cheap ones runs the same application with little or no downgrades... this will inevitably shrink the margin of the manufacturers (Motorola has the brand, but what about the others?).

</comment><comment><USER19> I've enjoyed being on the cutting edge with high-end smartphones for a few years (I'm on an iPhone 4 right now), but I could see settling into one of these in the near future. Most of my phone usage is fairly simple and probably won't change - map searches, social networking, Rdio for music, web news reading. In short, I have little doubt that these phones would work for me and I'm an early adopter. With Google voice commands, even a resistive screen device might be surprisingly useful.

</comment><comment><USER20> Hrm... I'd rather see an article about full prices, no gimmicks. It's much easier to compare phone prices here in Italy, as they're basically all unlocked and full price.

<comment><USER21> The full price for the phone in question is $150, no gimmicks.

Though from the Archos in my pocket that goes for $150, touchscreens have a ways to go before I'm going to care to use a $150 unsubsidized touchscreen on a phone. (Though throw on a keyboard and it might be different.)

Of course, I got the Archos as a testing device, not as something to rely on.

<comment><USER22> Don't put LG down for Archos's poor screens.

</comment></comment></comment><comment><USER23> Non-contract prepaid phones are also subsidized in the US.

There have been billboards in Austin, among other places I'm sure, for: <http://www.stopcellphonetrafficking.com/>

I haven't considered the math yet, but I suspect that the rate of price decline cited in this article is too aggressive, and that truly subsidy free Android phones for $99 are some time away yet.

<comment><USER24> I once washed my phone, and I didn't want to renew my contract.

The guy in the store suggested that the cheapest way for me to get a working phone was to buy a prepaid phone and swap the SIM card from the one I washed.

</comment></comment><comment><USER25> This is the device that could have saved Nokia in the smartphone market.

<comment><USER26> Nokia has devices very much like this, just not in the USA.

<comment><USER27> for the same price? I spent more than that (150 Euros) for a C5, which is basically an almost dumb phone + ovi maps.

<comment><USER26> Ok, so it's not exactly the same, but the C3 had a nice screen + QWERTY for 130 euros retail. Do realize that's without subsidies, I'm sure you can find something and knock about 30 euros off the price (which happens with prepaid, you never pay full market price with the bundles) and fine something very similar.

</comment></comment></comment></comment><comment><USER28> I was really hoping this was cheap mechanical slave labor.

</comment><comment><USER29> this is how android will eat symbian's market share

</comment><comment><USER30> Cheap androids have been here for a while now... 69€

[http://www.elpais.com/corporativos/elpais/coleccionables/201...](http://www.elpais.com/corporativos/elpais/coleccionables/2010/videopromos- pais/index2.html)

</comment><comment><USER27> 89 Euros with no contract in Italy (and a new sim card with 5 Euros) <http://www.wind.it/shop/prodotto133.phtml>

</comment><comment><USER31> Tried one in the shops, nice but the resistive touch screen is something I'm not used to!

<comment><USER15> Perhaps you're thinking of a different phone? I believe the Optimus T/S/V line all have capacitive screens.

</comment></comment><comment><USER32> has anyone bought the optimus v at a radio shack yet? i've tried tracking one down for the last day, and no one seems to have it in seattle; the stores haven't received shipment of them yet.

<comment><USER33> I got mine at Target this past weekend. Call ahead and they can put one on hold for you if it's in stock.

<comment><USER32> cool, thanks

</comment></comment></comment><comment><USER34> Nevermind the cheap device. The $25 per month service that includes 300 minutes, unlimited text, and unlimited data is the real story here.

[http://www.virginmobileusa.com/cell-phone-plans/beyond- talk-...](http://www.virginmobileusa.com/cell-phone-plans/beyond-talk- plans.jsp)

Of course, you get what you pay for in coverage

<http://www.virginmobileusa.com/check-cell-phone-coverage>

Meanwhile in Canada you can't even get unlimited data over wired internet.

<comment><USER35> In Canada I have unlimited data (with fair use policy), unlimited text and unlimited minutes (North America) for $40/month. The existence of such plans is quite new.

Concerning the introduction of "mandatory" metered internet in Canada: it appears the big guys may have been so greedy they over-reached. The consumer backlash is strong and the decision is now under review by government.

<comment><USER36> Could you explain the "fair use policy"?

<comment><USER35> Max speed to 5GB per month after which they reserve the right to slow down your connection.

<comment><USER37> Can you then explain the use of the term "unlimited"

<comment><USER38> The carrier has an unlimited license to distort the English language.</comment></comment></comment></comment></comment></comment>


Spotify Beat Apple to the Podcasting Boom - <AUTHOR> https://www.forbes.com/sites/andyswan/2020/07/01/how-spotify-beat-apple-to-the-podcasting-boom/#15f9863a6702 <comment><USER2> IMO a "podcast" is sound files stored on a server, indexed by a RSS/Atom feed, consumable by any client over HTTP. Spotify exclusive content should not be called podcasts.

</comment><comment><USER3> This was bound to happen. When Joe regan signed that deal, It was a big thing.</comment>


A floating holographic plasma display that you can touch - <AUTHOR> http://arstechnica.co.uk/gadgets/2015/07/a-floating-holographic-plasma-display-that-you-can-touch/ "Fairy Lights in Femtoseconds: Aerial and Volumetric Graphics Rendered by Focused Femtosecond Laser Combined with Computational Holographic Fields" <comment><AUTHOR> The abstract of the paper being discussed, "Fairy Lights in Femtoseconds: Aerial and Volumetric Graphics Rendered by Focused Femtosecond Laser Combined with Computational Holographic Fields":

"We present a method of rendering aerial and volumetric graphics using femtosecond lasers. A high-intensity laser excites a physical matter to emit light at an arbitrary 3D position. Popular applications can then be explored especially since plasma induced by a femtosecond laser is safer than that generated by a nanosecond laser. There are two methods of rendering graphics with a femtosecond laser in air: Producing holograms using spatial light modulation technology, and scanning of a laser beam by a galvano mirror. The holograms and workspace of the system proposed here occupy a volume of up to 1 cm^3; however, this size is scalable depending on the optical devices and their setup. This paper provides details of the principles, system setup, and experimental evaluation, and discussions on scalability, design space, and applications of this system. We tested two laser sources: an adjustable (30-100 fs) laser which projects up to 1,000 pulses per second at energy up to 7 mJ per pulse, and a 269-fs laser which projects up to 200,000 pulses per second at an energy up to 50 uJ per pulse. We confirmed that the spatiotemporal resolution of volumetric displays, implemented with these laser sources, is 4,000 and 200,000 dots per second. Although we focus on laser- induced plasma in air, the discussion presented here is also applicable to other rendering principles such as fluorescence and microbubble in solid/liquid materials."

Full paper: [http://arxiv.org/abs/1506.06668](http://arxiv.org/abs/1506.06668)</comment>


Turn your lights off at dusk to enjoy the deep, mystical sleep of our ancestors - <AUTHOR> http://www.washingtonpost.com/news/inspired-life/wp/2015/05/19/want-to-experience-the-deep-mystical-sleep-of-our-ancestors-turn-your-lights-off-at-dusk/

<comment><USER2> I've heard about this before, that prior to ubiquitous artificial lighting, people slept in two blocks of time. What fascinates me is that we seem to have collectively forgotten about it. Only now are researchers going back, as the article says, to old journals and stories, which often mention "second sleep". As someone who has trouble sleeping enough, I'm tempted to try this out some day.

<comment><USER3> I suspect that a lot of the stuff we take as "natural" these days where actually artificially introduced during the industrial revolution to help the factory owners get as much bang as possible out of the workforce.

For example there was the enclosure movement in England that possibly lead many a former farmer to move to the city to get a job. This because they no longer had access to enough common grazing land and such.

</comment></comment><comment><USER4> > in about three week's time, beginning around six hours after sunset each > evening

At the height of summer the night doesn't even last five hours (northern europe), how would you cope with that?

</comment><comment><USER5> The article implies that this is some sort of replacement for meditation, yet meditation predates one cycle sleep.

Anecdotally I've found that different people need different amounts of sleep, but many people benefit sleeping sooner rather than later. Most people will strongly defend their late sleeping, that they've "tried early sleeping" and it's just not for them. Usually they haven't committed long enough for their body to get used to it.

Personally I would rather wake early than stay up late to work on something. At least you're approaching the problem with a clear mind and well rested. Many hours are wasted in the night where people aren't thinking clearly, spinning their wheels on problems which could be solved with a different approach. This only gets worse with age.

I'm sure I'll hear accounts of people who are "not morning people". A little exercise in the morning will wake you right up.

<comment><USER6> I would think that there are several evolutionary advantages for a species with non-homogenous sleeping patterns. Someone has to be mentally alert through the night.</comment></comment>


Ask HN: Do you still use dial-up? If so, why? - <AUTHOR> <comment><USER2> Not me personally but I have relatives in Northern Michigan that do not even have dial-up. Because of where they live their choices for internet are dial- up or cell phone providers hotspot. This normally isn't a problem for them though as they have cell phones with a few gigs of data a month so they can check emails and do some shopping.

However they've pretty much had to go back to playing older video game systems because of this. Video games used to be the perfect answer when it came to entertainment for them living out in a rural area. An Xbox One for example requires an internet connection for initial setup and with the size of day one patches for games they would eat through over a months worth of data on one patch if they tethered. I'm actually in the process of helping them price out and then build a modest mid tier computer because at least then they buy a DRM free game from a site like Gog then drive into town to the local library to download the installers on a flash drive. It's a shame neither Sony or Microsoft have come up with an offline patching system for games yet.

<comment><USER3> why not satellite download with mobile upload?

<comment><USER2> They have considered it but Dish is about ~$50 a month if I recall from the last I talked to them and that's just too much for downloading and patching games.

</comment></comment></comment><comment><USER4> I'm not on dial-up right now, but I have almost been in situation where I would be. Most of rural america relies on dialup, satellite internet, or maybe microwave based connections with speeds comparable to 2002 DSL. If you don't live within some kind of city limits, you're almost guaranteed not to have broadband access.

I got really lucky and ended up living in the vicinity of a midwest fiber hub.

</comment><comment><USER5> Still have a dial up failover at home, it gets used for testing that it still works (i am a little amazed each time) more than any actual use. I am back to an oldschool external now, as it is still compatible with a dongle.

</comment><comment><USER6> I have a few university friends that are on dial up, thanks to me.

A provider in the area supplies dial up @ $1/month.

Compared to the $45/month for ADSL.

Great for people who can't afford 'net, but need it.

It's enough for email and downloading references.</comment>


Show HN: ~85% automated cleanup of Windows systems - <AUTHOR> https://www.reddit.com/r/TronScript/comments/4ziqu5/tron_v930_20160825_aq_add_automatic_substage_code/ <comment><AUTHOR> I built this tool for myself one day after looking around and not finding any commercial or open-source solutions for what I wanted to do (automate tedious/repetitive parts of system cleanup). On a whim I posted it to reddit/r/sysadmin and it sort of blew up. 2 years later it has ~12k followers and has had hundreds of contributions and volunteers. If you can spare any time to look over the general "flow" and approach of the project, or even the code, I'd be hugely in your debt.</comment>


Phishing Has Gotten Very Good - <AUTHOR> http://www.schneier.com/blog/archives/2013/03/phishing_has_go.html?utm_source=twitterfeed&utm_medium=twitter <comment><USER2> While hill staffers and other washington movers and shakers were being carpet bombed two years ago during budget negotiations, it was really eye opening how much individual effort was put forth. They were exploiting a flash 0-day that was embedded in various .xlsx .docx and .pdfs - pretty slick as it got them around noscript policies and outside any sandboxes.

The turn around time was crazy - on at least two occasions the workflow went:

recent victim gets first/early copy of policy paper written that day --> document is taken, translated to a different format and has 0 day inserted --> emails with exploit are sent to no more than 10-15 people the victim frequently discusses the topics covered in the paper with. --> Many include personalized notes that include observations the victim had sent to the author --> Time from initial email receipt to exploits all mailed: around 3 hours

Now that's how you get a 95% open rate.

related: <http://contagiodump.blogspot.com/search/label/CVE-2011-0611>

<comment><USER3> Citation needed? If true, that's a pretty crazy story.

<comment><USER4> Yeah, what? Who is sponsoring 0-day exploit attacks against Hill staffers? Do the parties go that far to get an edge against each other in negotiations? That seems like it would be front page NYTimes material.

<comment><USER5> Political parties in this country would _never_ stoop to criminal activity to gain strategic information. Why, if such a thing were to happen, and to involve high-ranking government officials, I bet it would be a major national scandal and maybe even lead to some unprecedented resignations!

</comment></comment></comment></comment><comment><USER6> I love how everyone here is extremely focused on the security of different technologies (Chromebook, Office, Java, etc.), when really the point of the article is that regardless of what technology is used, the weakest link in any system will always be _people_.

Schneier stated this explicitly: "Amateurs target systems, professionals target people." It doesn't matter if your money is behind a five-foot-thick reinforced-concrete safe if the banker can be convinced to open it for an attacker.

<comment><USER7> > It doesn't matter if your money is behind a five-foot-thick reinforced- > concrete safe if the banker can be convinced to open it for an attacker.

So we should use thinner walls or none at all?

Don't be obtuse.

We talk about the walls, because stronger walls reduce the chances of a break- in.

<comment><USER6> >>So we should use thinner walls or none at all?

This is the textbook definition of a strawman.

What I am pointing out is that nobody is discussing how to train/educate humans to be more resistant to social engineering attacks. Instead there seems to be an echo chamber of "X system is so much secure than Y system!" which is really banal.

</comment></comment></comment><comment><USER8> I wonder how many of these exploits are simply the result of the following five factors:

o Windows o Internet Explorer o Java o Flash o Office

People can whine all they want about Chromebooks not running non-cloud stuff, but IMHO, diplomats, executives, et al should be required to use locked down machines for communications, and training to educate people about opening email links should be widespread.

I get emails all the time from my bank and credit card companies, but even if I visually inspect the link targets, I don't trust them, I always type in the location myself if it is a site that I know I'm going to enter important credentials into.

<comment><USER9> You can get them all to stop using Java/flash/office etc but then the attackers will just start to target whatever they switch to.

<comment><USER10> If "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation favorites. Sure, it's not impossible, but at least making exploitation more expensive will put the little guys out of business. And Google has sufficient money to throw at Chrome security that it will become more expensive over time, not less.

<comment><USER11> web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.

<comment><USER10> Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1].

[1]: <https://www.mozilla.org/en-US/persona/>

<comment><USER12> >plus anything else where the user used the same password

Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?

<comment><USER13> If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> This is not new. Government officials and corporate executives have always been targets of espionage. That spies would disguise their attempts as common spam/phishing is unremarkable; as is the notion that some ordinary hackers might also preferentially target this class of people.

<comment><USER15> Exactly. The term the article should be using for it is "social engineering." It would only take a minimal amount of research to create a legitimate-looking email to a Coca-Cola executive or whoever. Emails claiming to contain coupons for free sexual performance enhancers won't exactly work for most people, so a little research isn't a stretch at all.

<comment><USER16> A well-worded email claiming to contain a PDF CV of an ambitious graduate could easily be opened by a CTO.

Or "Check out my blog... (I specialise in Javascript so please turn NoScript off.)" The possibilities of social engineering are scary.

<comment><USER17> You might want to put a link to your blog somewhere.. :)

</comment></comment></comment></comment><comment><USER18> It's 2013, and clicking on an evil link can still compromise your machine? I'd say the failure is much larger than just the anti-virus industry.

<comment><USER19> A lot can happen when you click a link. You download content like images, run plugins, open up third party apps (like iTunes or a chat client). You render images, you can start the hardware accelerated canvas stuff. You're downloading all of this content onto your computer and then your computer processes it. It's not like you're using a remote viewer to view something not on your computer. Going to a website is downloading files.

<comment><USER20> A lot of things _that I don't want to happen_ occur when I click on a link. Cookies are sent to foreign servers without my knowledge or consent. Advertisements are displayed. Audio can be played without my consent. Powerful flash and javascript plugins can run without my consent that can hijack my browser and deny me the use of my computer until I restart it.

When I click on a link, I _want_ a remote text and image viewer. Sometimes I'll allow certain sites like youtube to run flash, even automatically. This computer is my tool, not someone else's, and in 2013 clicking on a link shouldn't be a wildly uncontrolled and dangerous experience.

<comment><USER21> I'm sorry that the web isn't what you want it to be. Unfortunately for you, the web never was what you want it to be.

Maybe switch to gopher?

<comment><USER20> The web is what it is. In theory, my processors would only run the code I want them to -- not the selection of code, scripting, and plugins that any random website may have. I work very hard to make that theory into reality.

</comment></comment></comment></comment></comment><comment><USER22> So how do you protect yourself from these highly-targeted attacks?

How about running the browser in a sandbox that resets all changes on exit? I've actually set up Firefox (hardened) + Sandboxie on Win7 but exactly how good is this setup?

<comment><USER23> Use a browser that's not on your machine.

See, for example, <https://www.authentic8.com>

<comment><USER24> So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?

</comment></comment></comment><comment><USER25> This is one of the reasons I'm pretty happy about the new execution model being discussed by the W3C's System Applications Working Group. The move of sensitive information from the desktop to the browser is leading to a "sandbox" everything approach, which may not be safer, but should at least mitigate the damage done. Nowadays if you compromise the machine of an individual, you own everything they use and everything they do. With some sort of sandboxing between tabs and between privileged user resources (contacts, messages, email, calendaring), the amount of resources an attacker can control is reduced. The problem on the desktop is that the default M.O. has always been to trust the user entirely with respect to everything, but machine administrative (root) actions. With sandboxing and new security models around the user's own data, the M.O. now becomes only trust the user within one area of their life, but not between areas of their life (so a PDF document can't affect their email without explicit user action)

Sandbox all the things.

<comment><USER26> >This is one of the reasons I'm pretty happy about the new execution model being discussed by the W3C's System Applications Working Group.

What would make me even happier is a way for me to _read_ the _writings_ of my favorite authors without relying on many millions of lines of source code (i.e., a "modern" browser) and the inevitable security holes in those millions of lines.

<comment><USER25> Well, Mozilla is starting afresh with its Servo browser engine based on its Rust language. Given the design choices for Rust and Servo, I imagine that it's going to be a lot more secure and stable than the current crop of browser engines (Webkit, Gecko, Trident, etc.)

</comment></comment></comment><comment><USER27> Anyone come across Bromium before ( <http://www.bromium.com/> )? I think some of the 'micro-virtualization' ideas they describe sound really interesting. I believe it was founded by some of the people behind Xen.

</comment><comment><USER28> While this is interesting it shouldn't really be surprising. Whatever happens in the real world is inevitable in the cyber (ugh, dislike that word) world. Government and commercial espionage is fairly common and employs the use of sophisticated infiltration, sabotage and subversion techniques; this is just its parallel on the Internet.

</comment><comment><USER29> Don't you all know what this means? Someone gone and caught the big phish.

Bruce's site is hacked.

Clever self-referential hackers. We're all done for.

</comment><comment><USER30> I think many of these attacks could be prevented if we controlled outbound connections more carefully.</comment>


The Mysterious Color Patterns on Jupiter Are Finally Explained - <AUTHOR> https://advocator.ca/news/the-mysterious-color-patterns-on-jupiter-are-finally-explained/4531 <comment><USER2> WOW!</comment>


Presenting: The New Dialtone (a Documentary Series) - <AUTHOR> http://siliconangle.net/ver2/2009/10/23/presenting-the-new-dialtone-a-documentary-series/ <comment><USER3> Michael I wrote up a post about this over at The Inquisitr praising your work on this .. the video was excellent and well worth watching and I really hope to see some more of this type of video both content and quality.

<comment><AUTHOR> Steven's post: www.inquisitr.com/44153/the-new-dial-tone-a-snapshot-of-of- bloggings-future/

</comment></comment><comment><USER4> Feeling a bit overwhelmed by the response. Thank you for posting and sharing the film. - <USER2>

<comment><AUTHOR> No worries, chief. A truly well constructed piece, and particularly cool given it was ready for release only a few days after the event.

When's the sequels coming out?</comment></comment>


Checkpoint chap's hack whacks air-gaps flat - <AUTHOR> http://www.theregister.co.uk/2016/01/08/checkpoint_chaps_hack_whacks_airgaps_flat/ <comment><USER2> That article title should be taken out and shot.</comment>