ClojureScript 1.10.741 - <AUTHOR> https://clojurescript.org/news/2020-04-24-release <comment><USER2> To the entire ClojureScript team: thank you so much for all the great work that you are putting into ClojureScript!

Without ClojureScript and Clojure, I would not have been able to build and maintain my SaaS app as a solo founder. The incidental complexity would have crushed me. Using a single language to write code, with model (domain) code effortlessly and fluidly shared or moved between "server-side" and "client- side" is a game-changer.

While I don't care that much about NPM, I am extremely happy with the progress that ClojureScript is making. Thank you!

<comment><USER3> I like reading these kind of stories.

I'm trying to learn more about Clojure / CLJS for web development specifically, but there are so many different tools to pick from and as a beginner it can be hard to know where to start.

And then I'm also reading about Phoenix (Elixir) and how that's better for web dev.

If you don't mind - can you tell a bit more about your Clojure story, when you started using it and your setup?

Or maybe you have a blog, where you wrote about this already?

I'm not an experienced programmer, hence the naive questions.

<comment><USER4> I'm building my startup in phoenix.

First of all I wanna say that Clojure is a fantastic language and if the dials on my particular needs were different, I would have gone with Clojure and am considering clojurescript for a subproject paired with an elixir backend.

When I started the project, realtime over WebSockets were a huge consideration. Additionally, we weren't doing anything revolutionary from a computer science perspective. Phoenix came in with a clear story for all the work I wanted to accomplish.

There were well accepted and documented libraries for doing authentication and a really nice library for accessing the database.

The language has few gotchas and is relatively easy to learn. I have no doubt I could take a good js or python developer and have them be proficient within 2-3 weeks. Thats a big deal for when we are ready to onboard more people.

The elixir language feels a lot like clojure with a ruby like syntax. you have maps(structs) and a similar theme of 100 functions on one data structure. When sketching an idea, I can build my data structure out as a map and delegate to functions based on specific properties within the structure just the same as you would in Clojure. The language supports hygenic macros though I have been content with using the ones provided by absinthe and the kernel.

Phoenix itself is Extremely composable. Yes there are some constraints imposed by the language but no where near what you'd find in a more magical framework like ruby. In every case I've run into, I've been able to granularly pull and modify whatever functionality I've needed. middleware for instance is oriented around plug. Plug consists of a struct that contains data pertaining to the http request and response. ALL middleware is a function that takes a plug struct and returns a plug struct. Its about as composable as you're going to get. The end result is a very stable system that is really easy to reason about.

The biggest advantage, however, has been the deployment and infrastructure story. OTP is fantastic and lets us create workers about as easily as you could create a controller in rails. This is big. for our mvp, we don't need to setup redis or rabbitmq nor deal with the headaches of configuring them in prod. I can create a pubsub worker that responds to events and broadcasts data to the users in real-time and stay completely within phoenix.

Of course it has its downsides. For one, its definitely not my language of choice if I was doing image processing or constraint solving. At some point, we are going to create other microservices that handle those kinds of tasks better and when it happens, we'll have to pull in rabbitmq or kafka. Obviously phoenix can't have isomorphic apps like you would find with clojure and javascript.

TLDR: if you're trying to do something really novel, go with clojure. Its a much more flexible language with some really neat libraries that you'll need to learn to integrate yourself. If what you're doing is CRUD but with realtime, elixir will give you a great base ecosystem with sensible defaults to get off the ground fast.

<comment><USER5> There is another type of application where Elixir/Erlang really shines. The most obvious example of this type of application is a web based game where you have thousands of instances of the game running at once. The concurrency and isolation model is pretty much a perfect fit for this.

I was trying to hack something together in Java that wouldn't kill the database. Queries to table x would bottleneck, then table y. Add some caching here and there as each problem cropped up. But the obvious design in Elixir just removed most of the problems - each instance of the game works as its own set of processes and each instance holds what it needs in memory. It's not that I couldn't have arrived at this model with Java eventually, but it doesn't exactly lead you there, and a language like Elixir/Erlang was basically built with this in mind so everything is a lot easier to accomplish than with something like Java.

I really think everyone should learn either Elixir or Erlang. There are certain applications where OTP and BEAM just makes everything so much easier than the alternatives. If you have the right problem it can be an insanely productive language.

<comment><USER4> I had one case where I needed to store account data and ended up storing it in a gen server object for each account which pushed its state to all devices logged into that account. It was so easy to build I forgot about it but this 4-hour project would have taken over a week if I had done it in any other language.

</comment></comment></comment></comment></comment><comment><USER6> This link explains the new Webpack support in more detail: [https://clojurescript.org/news/2020-04-24-bundle- target](https://clojurescript.org/news/2020-04-24-bundle-target)

Though that post is pretty good, I wish someone could create a more ELI5 version of the post for people who aren't knee-deep in javascript packaging systems. Can someone just answer some newb questions for me?

1\. I know there's a website where people store javascript packages in "npm" which can be viewed here: [https://www.npmjs.com/package/browse](https://www.npmjs.com/package/browse). Does this new clojurescript functionality let me USE all those packages in clojurescript? What are the precise limitations? In what cases do I still want to use cljsjs? (another thing that is confusing to me, tbh)

2\. Does this new clojurescript functionality let me CREATE new npm packages and put them on the main npm site? What is "webpack" exactly and how does it relate to npm? If so, what are the precise limitations?

I swear I know a fair amount of stuff on other programming subjects, I just have a blind spot when it comes to javascript packaging and packages, so this info is really appreciated!

<comment><USER7> 1\. NPM is analogous to Maven for Java. Yes the ClojureScript bundler target lets you use anything you've installed from NPM into your project's `node_modules` directory. Not many limitations because we wash our hands of dealing with this stuff - use whatever popular bundler solution you prefer.

2\. Not for creating NPM packages, just consuming them. Webpack lets you use dependencies from NPM and package them up into a single JS (or code-split) asset to be used on a webpage. Note, we have no integration to any particular bundler. You could just as easily run Metro for React Native on the output and build a mobile app.

<comment><USER8> Have you considered Parcel, going forward? It seems to be a lot lighter and easier than Webpack.

<comment><USER7> We have no specific integration with Webpack, so you can consider anything since we haven't chosen for you :)

</comment></comment></comment></comment><comment><USER9> Somebody please write a book on Clojurescript, reframe and tooling -- its about time. There are so many books on Clojure but very few on Clojurescript and most of the existing Clojurescript books are too old and have not kept up.

I prefer learning new languages by reading books about them.

<comment><USER10> Web Development with Clojure (3rd edition) comes out later this year. It's got both Clojure and ClojureScript in it. In fact, even Clojure books that aren't focused on web development tend to have a ClojureScript section in them.

ClojureScript Unraveled is being updated continuously and is available for free online: [https://funcool.github.io/clojurescript- unraveled/](https://funcool.github.io/clojurescript-unraveled/)

But honestly, you can use Clojure books to learn ClojureScript too. They're basically the same language, with a few minor differences based on underlying differences in the hosts (JS and JVM). I tend to write most of my code in CLJC style, which can be compiled for either platforms.

<comment><USER9> The complexity with Clojurescript is in the tooling ecosystem. With Clojure , you only have the repl. However, with clojurescript, your have figwheel, shadocljs etc etc. I gave up on setting that up correctly with my IDE( Visual Studio).

<comment><USER10> Shadow CLJS is very easy to set up and there's a whole book's worth of documentation: [https://shadow- cljs.github.io/docs/UsersGuide.html](https://shadow- cljs.github.io/docs/UsersGuide.html)

You don't need figwheel (or any other tool) if you just want to write ClojureScript. You can get a ClojureScript browser REPL like this (mac example):

       brew install node

       npm install -g shadow-cljs

       shadow-cljs browser-repl

I get that it's going to be hard if you want to integrate stuff into an IDE that doesn't support ClojureScript. I use IntelliJ with the Cursive plugin (free version) and use `deps.edn` for dependencies since it's supported directly in Cursive.

</comment></comment></comment></comment><comment><USER11> Reading about cljs I ended up watching some videos on youtube. I for one didn't know cljs is so fun: [https://m.youtube.com/watch?v=VbIawuoYAVY](https://m.youtube.com/watch?v=VbIawuoYAVY)

<comment><USER12> Have you seen figwheel? [https://www.youtube.com/watch?v=KZjFVdU8VLI](https://www.youtube.com/watch?v=KZjFVdU8VLI)

</comment></comment><comment><USER13> If Clojurescript can actually work with Webpack and external modules under advanced compilation that is pretty amazing progress. Probably the biggest improvement in half a decade.

<comment><USER14> Unless I'm misunderstanding the ClojureScript team posts, one of the motivations for tight webpack integration is that not every npm module is compatible with advanced compilation.

From the article[0]:

> But after nearly three years since we first shipped Node module processing > via Closure, it's apparent that too few of the most popular libraries can be > subjected to advanced optimizations. While we still believe there's promise > here, the ClojureScript community will have to show the rest of the world > the way by developing compelling JavaScript libraries that can be readily > consumed by popular JavaScript tools, yet still be subjected to Closure's > phenomenal tree shaking and code splitting when building with ClojureScript.

0: [https://clojurescript.org/news/2020-04-24-bundle- target](https://clojurescript.org/news/2020-04-24-bundle-target)

<comment><USER15> Is this likely? Clojurescript comes with a pretty big base bundle size due to the runtime, right? Like hello world is still over 100kb or something before gzip, right? (On my phone, so it's hard to google the exact number.)

<comment> john-shaffer That was a bug. It was fixed with this release, and swannodette added a test to ensure the size stays under 10k bytes: [https://github.com/clojure/clojurescript/commit/5d64c2a142e5...](https://github.com/clojure/clojurescript/commit/5d64c2a142e5b41a4e4390f563d4412502704e23)

<comment><USER15> Swank! That's a massive improvement. I'm going to spin up a Preact project and see how it fares.

</comment></comment></comment></comment></comment><comment><USER16> I've been really thinking about using a functional language that complies to JS to start to learn more FP concepts and paradigms. I'm trying to decide if ClojureScript or ReasonML is better for me. Anyone have experience with both?

<comment><USER17> Both are beautiful in their own ways. I think ReasonML, or even SML or OCaml might be a gentler introduction since they let you write imperative code (more closely to what you probably write already) whenever you need to.

For example, I think there is a gradient from OCaml > Clojure > Haskell about using mutable data structures in your code, from Encourage > Discourage > Disallow. I think learning Haskell as your first FP might turn you off given how strict it is in this regard. So using that as a line of reasoning, using OCaml or ReasonML might be best since it lends an imperative hand whenever you need it, and lets you explore all of the amazing things FP has to offer.

<comment><USER15> I don't know. Having used both, JS to CLJS was a much easier transition for me than JS to Reason. CLJS makes mutation pretty trivial if the thing you're operating on is a JS object.

<comment><USER18> There are built in mutable data structures now too: [https://clojuredocs.org/clojure.core/transient](https://clojuredocs.org/clojure.core/transient)

Though their usage in public interfaces is not idiomatic Clojure and they come closely coupled with functions to transform them back to immutable values.

You can look up eg TransientArrayMap in ClojureScript internals to see how it's implemented on that side: [https://github.com/clojure/clojurescript/blob/799d62fe3bba99...](https://github.com/clojure/clojurescript/blob/799d62fe3bba999287558538ca6b61501de02d49/src/main/cljs/cljs/core.cljs#L7052)

</comment></comment></comment></comment><comment><USER19> Does this enable the possibility of having ClojureScript loaders for Webpack?

Shadow-cljs is great, but from time to time, it seems to be easier to integrate with the ecosystem if it can be loaded as Webpack modules. For example, loading arbitrary image, file, and possibly Rust modules, etc.

<comment><USER7> Honestly not sure, I'm not a Webpack expert and have no wish to be :) But again, as I've said elsewhere, there is no specific integration with Webpack. The bundle feature makes no choices so it's easier for users to fully control the integration with any JS build tool.

<comment><USER19> Thank you for your response! ClojureScript is by far the best target-to- browser solution I have used. The REPL experience is stunning, macros work as expected, and Cljc compilation is seamless. Working with it is pure joy.

Thanks again for everything you did for ClojureScript, and your talks are also really inspiring!

</comment></comment></comment><comment><USER20> This is an exciting release. Congrats to the team for their continued efforts and for being such great stewards of the language and ecosystem.

I did have one (orthogonal) issue when following along with the tutorial linked in the release notes and, since there's a decent chance someone here has worked through this same issue in the last few days, I'd like to float the question: Does anyone know of step-by-step instructions for getting fireplace.vim to evaluate ClojureScript code?

</comment><comment><USER15> How's the bundle size coming along? Also, I'm curious what back end most of you are using? Node with CLJS, Clojure with???, Elixir, etc?

I'm spinning up a small side project, and started it out with vanilla JS and Node. Bundle sizes are tiny, startup times are fast, lots of concurrent connections, etc... But I really don't enjoy the ecosystem or language, so am probably going to port it over to Clojure. Clojure has spoiled me. :/

<comment><USER21> ClojureScript has a baseline which you cannot go under. Can't remember the exact number but it's something like 250k (advanced compilation but not gzipped).

For this you get the immutable data structures, and a decent chunk of the standard library, which you would use anyway.

On top of that, everything else that you get from the ClojureScript ecosystem, which is run through the Google Closure Compiler, is added incrementally. Use only one function, pay only for one (and its dependencies).

<comment><USER22> I believe this is fixed [0].

[0]: [https://github.com/clojure/clojurescript/commit/5d64c2a142e5...](https://github.com/clojure/clojurescript/commit/5d64c2a142e5b41a4e4390f563d4412502704e23)

<comment><USER21> Well, sure, for hello world! But these days anything you do with CLJS will involve the data structures, which is what brings in the dependencies :)</comment></comment></comment></comment>


Top Start-up books - <AUTHOR>

What are the book that a novice should read before/during his first web start-up attempt? I bought 4 steps to epiphany. What do you think about that book? <comment><USER3> * Getting Real - <USER2>

* Don't make me think! - Steve Krug

* Envisioning Information - Edward Tufte

* Purple Cow - Seth Godin (see TED talk for 15 min summary)

* The Art of the Start - Guy Kawasaki

</comment><comment><USER4> I was actually going to suggest that book before reading your entire post. Its an amazing book - not edited too well (through cafepress) but it has some really great lessons in it. I went to business school, and read that after graduating, and felt like my school's curriculum needed some immediate changes.

</comment><comment><USER5> Just in case anyone else is thinking of getting 4 steps, it's $10 cheaper from here (not an affiliate link) than Amazon:

<http://www.cafepress.com/kandsranch.58024175>

</comment><comment><USER6> * Hackers and Painters

* Founders at Work</comment>


ARM Cortex-M, Interrupts and FreeRTOS - <AUTHOR> https://mcuoneclipse.com/2016/08/14/arm-cortex-m-interrupts-and-freertos-part-1/ <comment><USER2> I think the article is missing important information about how NVIC latches interrupts, or in general the relation between the interrupt signal and the execution of the interrupt. The NVIC supports both "level" and "pulse" type interrupts, and an interesting property of the "pulse" interrupts is that if the interrupt line goes low and high again while the ISR is running, the ISR will be re-executed. More info is provided in the manuals[1].

It is good to understand what is happening between the peripherals and the NVIC. Even though in many cases the device manual fails to specify exactly what type of interrupts are used and the logic in the peripherals that drives the interrupt lines. E.g. they may just say, these bits enable these interrupts which occur on these events, ommitting info such as whether the interrupts are pulsed or level and how/whether the peripheral internally latches the interrupt condition.

There are also little practical tips provided in the article to prevent "messing up" interrupts. Here's a few of mine:

\- Try to get a good understanding of the interrupt logic of the peripheral.

\- Make sure to clear any associated interrupt condition in the interrupt handler, as applicable.

\- Before enabling the interrupt, set all variables exepected by the ISR and do a memory barrier (e.g. gcc's asm volatile with memory clutter; this may be done implicitly with "enable interrupts", i.e. asm volatile ("cpsid i" : : : "memory")).

\- In case of edge-sensitive interrupts be aware they could trigger on ANY edge, including due to transient conditions. E.g. you're filling up a buffer through an interrupt that fires when at least 4 words are available to be written. Say the ISR fires with exactly 4 words available, you write the first word, then the peripheral consumes 1 word before you write the remaining 3 words. With pulse-interrupts that causes another invocation of the ISR, at the start of which you do not necessarily have 4 words of buffer space available. So, generally it is best to understand interrupts as hints only and still verify that a specific event has occurred / condition is satisfied.

\- Specific to clocks, I found a very practical way to time different events though interrupts is by running timers in simple "overflowing" mode and just set the output compare units to fire whenever you want them to - treat time as modulo 2^N and deal with overflow right (by only ever looking at differences of times). It's not a problem if you want more range than the N-bit timers can provide because you can simulate that by handling counter-overflow. Also, if you need to synchronize more events than you have compare units on one timer, typically it is possible to run multiple timers synchronzied (set same clock, start them very quickly in succession).

\- Some peripherals are just badly designed and you need to read every single piece of the documentation while specifically looking for behavior that's going to bite you. Specifically notable cases is when reading some register implicitly clears some interrupt flags, so you may accidentally acknowledge an interrupt outside of the ISR.

[1] [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0337h/CH...](http://infocenter.arm.com/help/topic/com.arm.doc.ddi0337h/CHDJFGJE.html)

<comment><USER3> Its missing a ton of information and it seems poorly presented. I found that surprising given that the author teaches the topic.

In general I agree that the most confusing part with these chips are that the ARM interrupts are all very well defined and they have clear semantics, but the vendor specific interrupts are kind of all over the place as the vendors use licensed IP from a variety of vendors and attach them to the interrupt structure in different ways.

That said, interrupts have the inherent complexity of "you were doing something and POW! now you're doing something else." which starts out weird to new programmers and then when nested interrupts are brought up their head explodes. I can imagine it is a tough topic to teach.

<comment><USER4> It is missing some detail about how the interrupts operate, but:

a) It's a blog post not a reference manual. It's aim appears to be clear up some confusion about terminology (and having been using a Cortex M4 for a year I've spent a fair amount of time trying to reconcile conflicting documentation).

b) It's only the first blog post in an intended series. Who knows what's going to get covered next.

Even though I've got most of this sorted out in my head by now, it's still helpful to me to have it put clearly in one place (even if it's just so that I have a link to give to newer members of my team).

</comment></comment></comment><comment><USER5> Excellent introduction! That implementations sometimes don't implement the full range of priorities has bit me in the past with really hard to debug issues. Not knowing much about FreeRTOS, I look forward to the next part in the series.

</comment><comment><USER6> Cool, but what does the "nested" part mean? That handlers can themselves be interrupted?

<comment><USER7> Yes. That's exactly what it means. You can have priorities for different interrupt sources. It has utility in many critical RTOS situations.

Imagine you have a factory machine. The micro has an IRQ for your communication interface. This goes off when there is a packet. Obviously you want this to be handled so there is not backlog of packets, however there is another interrupt for a limit switch that goes off when the door to a chamber in the device has been opened. You want to handle that interrupt above all else so you can shut off the rotating blade in that chamber before a human hand can get in there.

<comment><USER8> 1) You should expect lost , delayed and garbled comms. Your app layer or stacks should handle this.

2) A limit switch will still need debounce. If it's the sort of limit switch that will keep people's hand attached to their arm, I would be loathe to depend on interrupt priority for it.

<comment><USER2> I suppose this was just an example of when you want to do safety-critical control in software. For something as simple, hardware measures are probably more appropriate, but your particular problem may be far too complex to solve with simple hardware-based logic. For example, consider a system in a radiation therapy machine which ensures the patient does not receive too much dose or at the wrong spots.</comment></comment></comment></comment>


Nweb: a tiny, safe web server (static pages only) - <AUTHOR> http://www.ibm.com/developerworks/systems/library/es-nweb/index.html <comment><USER2> A few months ago, I wrote httpdito, a tiny web server that serves static pages only. It's about the same amount of code as nweb, but less functionality, and I have more confidence in its security: [http://canonical.org/~kragen/sw/dev3/server.s](http://canonical.org/~kragen/sw/dev3/server.s), with README at [http://canonical.org/~kragen/sw/dev3/httpdito- readme](http://canonical.org/~kragen/sw/dev3/httpdito-readme). It's 296 instructions.

I'm not saying it's secure, but I certainly intended it to be, and it doesn't suffer from the particular problems tptacek, evmar, kedean, and nknighthb identify in nweb. I'd like to think I'm not naïve enough to have written problems like that, but that's probably not true.

(I'm pretty sure that "Try my new secure software!" is something that should not be followed with "I wrote it in C!" but usually assembly language is not going to be an improvement. In this case I think it happens to be.)

httpdito was discussed on HN a bit before it was finished; for example, it's no longer completely trivial to DoS it, although I could do more to protect it against that.

</comment><comment><USER3> Adding to what everyone else has said, this also "how not" to write socket code; for instance, the assumption that you can read a whole HTTP request "in one go" with a single large read call is false.

Also, casting function calls to (void) is nonsensical.

You can perhaps forgive the sprintf() call because, AIX. (Believe it or not, there was a time when snprintf was a portability problem). You can't forgive the log() function that doesn't explicitly bounds check its argument (though it's not exploitable in this code).

<comment><USER4> > Also, casting function calls to (void) is nonsensical.

This is an older convention to indicate that the programmer knows the function returns a value but has chosen to ignore it. It got around the false positives generated by lint.

This code uses SIGCLD which I don't think is supported by BSD, where it is called SIGCHLD and is slightly different (someone please correct me if I'm wrong). If that's the case, then the author's assertion that it "should run unchanged on AIX, Linux®, or any other UNIX version" is incorrect - it will only run on System V varieties.

<comment><USER5> Confirmed the SIGCLD problem.

I had to change it to SIGCHLD to get it to compile on my Mac.

</comment></comment></comment><comment><USER6> This crowd is always tough to please. There's a description at the top which says, about the 200 loc http server:

You can see exactly what it can and can't do.

Thank you Mr. Griffiths. Your example will help extend my understanding of an http server, even if I don't intend on writing one. I would never read through the 90 klocs of httpd.

</comment><comment><USER7> My C is a little rusty, but it seems like this web server is definitely not safe. The very first function in the code has a local stack variable and uses sprintf() to fill it. That's almost a textbook example of a buffer overflow vulnerability, if I'm not mistaken. Even if they try and compensate for that by checking the data length before it's passed to that function, it's still scary to see someone using sprintf() instead of snprintf() these days. It's like walking a tightrope without a net.

<comment><USER8> It's scary style (and speaking of style, this code is really inconsistent in its formatting), but from a quick search of the usages of the logger function, I didn't see any way to overflow the buffer.

* BUFSIZE is 8096.

* logbuffer (the local variable) is BUFSIZEx2

* s1 looks like it's always trusted and an order of magnitude smaller than BUFSIZE.

* The format strings and numbers are nowhere near big enough to make up the difference.

* Where s2 is untrusted data, I _think_ it's always guaranteed to be <=BUFSIZE and zero-terminated.

But there are definitely other possible issues I haven't looked at closely, and I'm certainly troubled that this mess has showed up on an IBM site as an example of a "safe" web server.

</comment></comment><comment><USER9> I always enjoy articles that reiterate how the simple stuff really is pretty simple. I like thttpd for that reason, its a really simple (and a bit more featureful) webserver than this one, but not by a lot. Easy to comprehend, easy to keep all the moving pieces in your head in one piece.

Folks building embedded stuff have been using this stuff to create their UIs for like forever it seems, and this kind of web server works pretty well in that capacity.

[1] [http://www.acme.com/software/thttpd/](http://www.acme.com/software/thttpd/)

</comment><comment><USER10> This code is really not good, and certainly not worth learning from.

It appears that if you request a path like "//etc/foobar" with two slashes at the front it'll allow traversal outside the starting directory, though it's mitigated by checking file extensions.

<comment><USER11> That may be, but the docs are quite nice; people who can write better code might still gain from considering how they can make their documentation this instructive.

</comment></comment><comment><USER12> I am always on the look out for a small, lightweight and secure web server for impromptu file sharing. Right now I use publicfile from djb.[^1] My only complaint is that there is no debian package for publicfile so I have to build my own package. I would love to find an equivalent (ftp not necessary) daemon that is included in debian. Is anyone aware of a something in debian repos that I am overlooking?

[^1]: [http://cr.yp.to/publicfile.html](http://cr.yp.to/publicfile.html)

<comment><USER13> This is hardly in the category of "lightweight and secure", but for impromptu stuff, this Ruby+Rack one-liner serves directory listings and static files from the current directory:

        ruby -e 'require "rack"; include Rack; \
          Server.start :app => Directory.new(".", \
          Static.new(nil, :urls => ["/"], :root => "."))'

<comment><USER14>
        python -m SimpleHTTPServer

<comment><USER15> although that server is very horrible

<comment><USER16> Works fine for some tests, but it's single threaded. If you need concurrency:

        twistd -no web --path=.

<comment><USER17> Perhaps, but the use case it usually finds is "I need a webserver, here. Now."

Python is nearly always installed, and that depends on nothing but the standard library. You can stick an alias in your dotfiles (I have, it's called "serve-this") and not have to worry about having twisted¹ getting to wherever your dotfiles get put. (I distribute my dotfiles over git/github, so it's really easy to move them around. More work to get Twisted.)

¹Or Ruby… or Go…

<comment><USER16> Twisted is pre-installed on OS X and various Linux distributions...

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I want to learn a bit about web servers and I think that study the source code of a functional one may worth more than try to build something from scratch at first glance. Since I'm seeing too many comments on the security issues of this particular project, can you guys recommend something more reliable?

Thanks in advance.

Edit: I "know" C and C++ and would like to remain in one of these languages, if it's not asking too much.

<comment><USER19> If you care about security then C and C++ are out of the game, specially if there is a team of different skill sets involved.

Having said this, have a look at Wt and Poco

[http://www.webtoolkit.eu/wt](http://www.webtoolkit.eu/wt)

[http://pocoproject.org](http://pocoproject.org)

</comment></comment><comment><USER20> [http://www.ibm.com/developerworks/systems/library/es- nweb/si...](http://www.ibm.com/developerworks/systems/library/es- nweb/sidefile1.html) Direct link to the (200 lines of) source code. I can't speak to the security, but it is a nice little read.

</comment><comment><USER21> The only thing safer about this that I see is it is extremely small. No high assurance design, etc. What am I missing here that makes them advertise its safety?

</comment><comment><USER22> Does this do SSL ? If not, there is no reason to use this instead of the (excellent) thttpd.

thttpd is a very, very nice tool. It's very handy sometimes to just fire up thttpd -d /some/dir because you want to look at the contents of the dir in a web browser but don't want to spin up the whole environment and server, etc.

I put thttpd on a lot of informal servers just to have it around when I need something like that...

<comment><USER5> This is not intended for real world usage. Its purpose is to help others learn how web servers work.

</comment></comment><comment><USER23> Just because the code is tiny doesn't mean that it is safe. How do we know that the code is not vulnerable to e.g. buffer overflow exploit?

<comment><USER24> I find your comment particularly funny, because in the information security course I took for my masters degree, we had to perform remote buffer overflow exploits using an older version of this exact software.

</comment></comment><comment><USER25> The code is ugly, checkout [https://github.com/cesanta/mongoose](https://github.com/cesanta/mongoose) (GPL & MIT) or [https://github.com/sunsetbrew/civetweb](https://github.com/sunsetbrew/civetweb) (GPL)

</comment><comment><USER26> If I had infinite time and patience, I'd tinker with this to show the differences in socket code, specifically with the approaches outlined in the C10k document.

Although it was largely unfinished, the approach outlined in C10m would be interesting to see implemented here (via the intel user-space driver).

</comment><comment><USER27> For those of you who are interested in a tiny, safe, static file server that provides secure, public URLs from any machine (ngrok-style), I have a simple project called srvdir that will probably be useful to you: [https://srvdir.net](https://srvdir.net)

<comment><USER28> Nice, but the writing suggests that it's secure as in end-to-end encryption, what people expect from HTTPS, while in fact you tunnel everything in plain through a central server. You should make this clear on the site.

</comment></comment><comment><USER29> > if LINUX sleep for one second to ensure the data arrives at the browser

can someone explain that please?

<comment><USER5> It's explained further down:

 _After the last byte of the file is sent, the nweb web server web() function stops for one second. This is to enable the file contents to be sent down the socket. If it immediately closes the socket, some operating systems do not wait for the socket to finish sending the data but drops the connection very abruptly. This would mean that some of the file content would not get to the browser, and this confuses the browser by waiting forever for the last bit of the file and often results in a blank web page being displayed._

<comment><USER2> This text has an error rate of about one factual error per sentence, as you'd expect from someone who capitalizes "Linux" as if it were an acronym.

<comment><USER5> We're definitely in "works on my machine" territory here.

Still it's good for building your confidence as a programmer, no?

</comment></comment></comment></comment><comment><USER30> This is a great example of how to clearly document a project.

The technical criticisms are confirmation of that. How many HN submissions to open source projects are as well explained?

</comment><comment><USER31> today i learned: there's still AIX. Huh, really?

<comment><USER32> Yup. Banks still have lots of these, and Solaris is being phased out more actively than AIX.

</comment></comment><comment><USER33> Not a prank!

<comment><USER34> This is actually the first thing I thought, after having a quick look at this code, and being aware of todays date ;-)

</comment></comment><comment><USER35> All you really need is

> python -m SimpleHTTPServer</comment>


For First Time, AIDS Vaccine Shows Some Success in Trials - <AUTHOR> http://www.nytimes.com/2009/09/25/health/research/25aids.html?_r=1&hp <comment><USER2> Some success: 30% effectiveness in that 51 out of 8000 given the vaccine because HIV positive, and 74/8000 given the placebo did. I presume that really is statistically significant despite the chance it could have just been random?

They also don't know how it works...

<comment><AUTHOR> _"Although the difference was small, Dr. Kim said it was statistically significant and meant the vaccine was 31.2 percent effective."_

The confidence interval is determined by the number of people in the trial (N=16,400), not the number of people who get sick.

<comment><USER3> If the rate of infection in the general population was even lower, say 1 in 100,000, and they actually trialled 200,000 people, finding that the vaccine perfectly prevented infection, should they conclude this with high confidence? Or have I misunderstood you?

Besides, Dr Kim is quoted elsewhere as saying "the result could be due to chance" and the vaguely phrased "31.2 percent effective" is not encouraging. Add in the likely funding source of AIDS vaccine trials, the pressure to get results and the unknown mechanism and it doesn't look so great.

<comment><USER4> The key is not to find "who gets HIV" vs. "who does not get HIV." Instead, we are trying to measure "who gets exposed" vs. "who gets HIV." Although we do not know how many people are _exposed_ in each group, we can make sure that the number of exposed people in each group is approximately the same by increasing the number of people vaccinated. If we know that the same number of people are exposed (which is less than the sample size), then the number of people who get sick is much more significant.

By increasing the number of vaccinated people, the number of exposed people becomes more equal between the two groups since a few "more exposed/risky people were assigned to group A" will have a less significant impact.

</comment></comment></comment></comment><comment><USER5> link from the AP feed [http://hosted.ap.org/dynamic/stories/M/MED_AIDS_VACCINE?SITE...](http://hosted.ap.org/dynamic/stories/M/MED_AIDS_VACCINE?SITE=INKEN&SECTION=HOME&TEMPLATE=DEFAULT)

</comment><comment> onreact-com So the US army is using Thai people as guinea pigs?

<comment><USER6> They probably sought them out for their high incidence of HIV -- it would obviously be unethical to specifically infect people to test the vaccine.

<comment><USER7> To add to this, at the time the trial started, Thailand was one of areas with the highest infection rate. It's common practice to do a trial where the disease is the worst.</comment></comment></comment>


Show HN: Focus on Work via Win10 Virtual Desktops - <AUTHOR> http://peachapp.net <comment><AUTHOR> In my spare time I've been working on this app, which adds a lot of useful features to Windows 10's Virtual Desktop feature, and I'd love for you to check it out.

This app is kind of an experiment, to bring the Indie Ethos of the macOS / iOS development scene to the Windows audience, spending a lot of time on polish and making the end-to-end experience really great. I think there's not a lot of people doing this right now on Windows, so I'm excited to Make Something Good and get it out there to people.</comment>


Ask HN: Formalized training plans for developers - <AUTHOR>

I'm exploring the option of having a formalized skills development program for my dev team, and wanted to hear experiences people may have had.
Frequently - it seems to me - teams have a reasonable amount of ad-hoc training. Someone brings in an expert in `git` to help the team transition, or a big-name developer is passing through town who's roped in to giving a day or two of training.
I'm interested in providing something a little more rigorous for my team - perhaps a day a fortnight specifically set aside for skill development, using a mixture of intra-team training, external courses, external trainers coming in, auto-didactic exploration of certain topics.
Has anyone tried this successfully? Unsuccessfully? Can anyone provide examples of things that worked well or didn't work at all? <comment><USER2> Formalized training is waaay too slow. I have a thousand tech videos I want to watch but can't because there's no easy way to watch them at 2x speed. A live instructor is just a slow IRL video. the best material is usually slides. Transcripts of tech talks would be ideal. When those are missing or lacking, developers will go straight to the code as the best source.

There's two types of training, enrichment and learning things to get stuff done. If it's learning stuff to get stuff down, a developer usually only has a few seconds to review a dev guide, manual, or API. Ir he/she were to spend an hour on each, reading the whole thing out it would not be feasible. development is an endless stream of hundreds of tiny bits of knowledge that have to be assembled. So there's not really any training available in getting stuff done because it's an exercise in knowledge triage.

So to answer this, yes I have sat through countless hours long training sessions that could have filled a half sheet of paper. What works well is one to one conversations with experts where the developer has already built up a large list of critical 'why' questions. The 'how' questions are easily answered in seconds through q&a websites. Insight into why things work a certain way are the best.

<comment><AUTHOR> Regarding the 'formalized' part, really I was thinking of there being time formally set aside for training.

As you point out, for senior developers, there's often a huge list of things they want to work through on their own - I'm thinking really about supporting their doing that, and making sure that there's a small amount of discipline there where they set out what they want to watch, and why, and jot down some thoughts on what they learned afterwards.

<comment><USER3> Might be good to schedule both some personal learning time as well as scheduling time for the tea to share new insights and discuss standards they think are worth adopting.

If you want company standards, you can use software like Brainshark to build presentation slides with questions that can be answered and reviewed so that you can be sure that people understand and are on the same page.</comment></comment></comment>


How far can you go with MySQL or MariaDB? - <AUTHOR> http://jfg-mysql.blogspot.com/2017/07/how-far-with-mysql-mariadb.html <comment><USER2> The elephant in the room is that there is no mention of TokuDB here.

My personal experience is that InnoDB performance drops off a cliff as tables grow and parts of tables stop fitting in RAM. TokuDB just keeps on going.

TokuDB also compresses your data really well.

My own stats: [https://williamedwardscoder.tumblr.com/post/160628887798/com...](https://williamedwardscoder.tumblr.com/post/160628887798/compressing- mysql-databases)

<comment><USER3> > My personal experience is that InnoDB performance drops off a cliff as > tables grow and parts of tables stop fitting in RAM. TokuDB just keeps on > going.

Yes but at least in my experience as things fit in RAM, InnoDB is still the correct choice.

TokuDB is great once you run out of RAM-related solutions but given the price point RAM is at these days, we are talking 100GB+ tables which probably shouldn't be one a single machine anyway.

<comment><USER2> Ha! A few gb ram and a few tb disk is real cheap in the cloud.

If your dataset fits in ram, and when it doesn't you have to buy more boxes with more ram rather than just buying more disk, then I think you are making a very uneconomical trade off.

<comment><USER3> > Ha! A few gb ram and a few tb disk is real cheap in the cloud.

> If your dataset fits in ram, and when it doesn't you have to buy more boxes > with more ram rather than just buying more disk, then I think you are making > a very uneconomical trade off.

It is all in what lower latency is worth to the bottom line and how well you scale horizontally.

<comment><USER2> My link described performance too. A cluster of innodb boxes is going to be slower than a single tokudb box.

(Src: have run each, and stuff like shard-query to parallelise queries and scale them out)

</comment></comment></comment></comment></comment><comment><USER4> I manage a multi-TB system on PostgreSQL. There are no performance issues other than making sure you have good indexes and make sure the queries use those indexes.

Backup isn't that bad either as this run on ZFS that support blazing fast atomic snapshots of all related filesystems like pg_xlog and tablespaces.

<comment><USER5> I'd love to hear more about your tuning around both PG and ZFS. I assume pg_xlog is on its own fs with 8K records, but beyond that, anything interesting, or any guides that you found especially useful?

<comment><USER4> pg_xlog has 8k records with lz4 compression. You can disable full-page writes, though I've never had any issues with it on either.

For tablespaces the recordsize can be anything from 8k to dynamic / 128k. They all have pro/cons. Greater record size improve compression and sequential read performance but small random updates becomes a lot more expensive. I feel a recordsize of 16k or 32k with lz4 compression is a safe setting for optimal performance with good compression.

Other useful topics related to performance are: Use multi- column/functional/partial indexes, as this will help you design a database where most of your 'hot' indexes can fit in RAM. If you have too many indexes, you will do index scan on disk, which is painfully slow. I many cases a full table scan (sequential read) would be faster instead.

BRIN indexes are great for large tables that can be sorted on for example on timestamp.

Common Table Expressions, for recursive queries.

The query planner sometimes needs help as it will start doing full table scan on a table when it could just have used an index. This is related to table statistics which you need to alter. You can read more about this here: [https://www.postgresql.org/docs/9.5/static/planner- stats.htm...](https://www.postgresql.org/docs/9.5/static/planner-stats.html)

Adjusting the seq_page_cost and random_page_cost can also help the query plannner.

There is probably a lot more, but you learn as you go :)

<comment><USER6> Unrelated, but the link in your profile to your site Boost AI is HTTPs but the site itself only seems to support HTTP.

<comment><USER4> Thanks!

</comment></comment></comment></comment></comment><comment><USER7> The limits of properly-tuned MySQL on appropriate hardware are impressive. Note that the size constraint in the examples given here is almost always administrative (ease of doing backups, replication, archiving) rather than hitting insurmountable performance limits.

I have a theory that a lot of people who are dismissive of modern relational databases for 'big data' simply never took the time to learn to tune them properly as the data sets grew in size. It's a painful process, and there is an intimidating number of switches and knobs, some of them in the filesystem and kernel.

In particular, running large databases on virtualized hardware like AWS really brings the pain.

<comment><USER8> Agreed on all points. They (MySQL and PostgreSQL) were written and optimized to run on constrained hardware. When you remove those constraints (which is where the configuration pain comes in), they really are capable of absurd volume.

> running large databases on virtualized hardware like AWS really brings the > pain.

The pain, I've found, mostly stems from the fact that it is a VM, and the performance costs associated with that. When you assume that your disk is local, and it's actually a network volume with shared network bandwidth, you'll get kicked right in the assumption. Or you assume that you have a static amount of memory, but the balloon drivers punt you into swap, or that you will get reliable interrupts from the OS...

It's gotten better over the years, but it's still a mess.

Oh, and I've said it before, so I'll say it again. If you're running MySQL in RDS, go in and turn up the 'innodb_log_file_size' setting to a bare minimum of 2GB, 15GB if you have the disk space. Go, do it now!

<comment><USER9> Can you explain why turning up innodb_log_file_size is good?

<comment><USER8> In short, the default is 128MB, which results in block-the-world dirty page flushes when it fills due to write activity. By going to 2G (I frequently recommend 15 when you have a lot of memory), you can buffer a lot more writes during times of peak load, and the idle flushing of dirty pages can generally keep up.

The practical effect of changing this value: a 2xlarge RDS host goes from 85% CPU utilization to 10%, with faster response times, for a moderate write load.

The downside, and why it's not the default for RDS, is that it eats your RDS storage by 2x the value set.

<comment><USER9> ah that makes sense, is there a innodb_log_file_size equivalent in postgres btw?

<comment><USER10> Yes. Before 9.5 it was named checkpoint_segments, now it's called min_wal_size (reserved, won't go below) and max_wal_size (soft max space limit, will checkpoint more frequently).

</comment></comment></comment></comment></comment></comment><comment><USER11> In 2013 I co-founded an experiment with a similar goal: test the maximum number of tables (empty tables, btw) that you could create on a PostgreSQL database.

The answer lies in the "Billion Tables Project" :) [https://www.pgcon.org/2013/schedule/events/595.en.html](https://www.pgcon.org/2013/schedule/events/595.en.html)

</comment><comment><USER12> Missing from the article:

\- HA

\- How to recover some subset of 37TB of data without restoring all of it

\- What happens when your write throughout needs to exceed the capacity of a single disk

Nobody gives up features like joins in favor of a distributed shared nothing DB because they feel like they need more space, they do it for HA, more cores, more spindles, fault tolerance and isolation.

</comment><comment><USER13> I think some of the advice here is good for high traffic sites but my company only sees about 1400 people a day use our data although we do processing of information for each client in millions of jobs a day. In our sceneraio we have one MySQL instance on aws aurora, about 50 tables and 3 terabytes of info total. Most of the size comes from about 10 tables and are mostly used for joins after data is quickly searched on elastic search. I will put down the myisam search we use to use before elasticsearch which was drowning as we reached 100M to 200M rows when things weren't pushed over to their own machine and could hog up ram. When fulltext is planned from the start along with backups and other things it can save a ton of headaches.

</comment><comment><USER14> Facebook is how far you can go.

<comment><USER15> Right, but that means writing your own storage engine [1] to get to their scale, right?

[1] [https://code.facebook.com/posts/190251048047090/myrocks-a- sp...](https://code.facebook.com/posts/190251048047090/myrocks-a-space-and- write-optimized-mysql-database/)

<comment><USER16> _" While there are some databases at Facebook that will still use InnoDB, we're in the process of migrating to MyRocks on our user database (UDB) tier"_

So, still impressive to me. That custom storage engine is just for the "user database" tier. Given their user count, that doesn't seem unreasonable.

<comment><USER17> MyRocks is intended to be a general purpose storage engine for MySQL. It was not built specifically for the UDB tier.

<comment><USER16> Right, but "some databases at Facebook that will still use InnoDB" was a direct quote.

The context being that InnoDB got FB pretty far, and that UDB appeared to be the first area where any pain was notable enough to need something else.

<comment><USER18> It's not really a question of InnoDB "pain" though; Facebook's primary motivation for MyRocks is substantially better compression rate than InnoDB. It adds up to very compelling cost savings at FB scale.

This comparison is a bit apples to oranges anyway, with respect to the original article :) JFG's post was talking about extreme cases within a single MySQL instance, whereas Facebook is extremely heavily sharded.

<comment><USER16> "pain" is just shorthand for whatever drove the switch.

Was just trying to reinforce the point that MySQL gets you pretty far.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Vitess deserves more love here on HN. It's incredible the way it gives you the best of both worlds (RDBMS and NoSQL). Most operations end up in a single shard, so you have no performance impact and still have the benefit of built in MySQL joins and relational integrity. It is built to be container-native, so the recommended usage is to split into 100-300 GB chunks, which simultaneously makes schema changes take 1/(n shards) of the time for a normal ALTER TABLE.

</comment><comment><USER15> This is very impressive, but at some point it becomes more cost effective to rack up more reasonably sized commodity hardware with a "big data" database, no?

(Using "big data" to mean sacrificing low latency joins and full transaction support, with the caveats that many "big data" systems are making progress at getting those things to work.)

Of course you can shard, but there is a significant maintenance cost to that as well, and requires your data model can be easily sharded.

<comment><USER8> Under 1 TB is still commodity hardware with many of these DBMS. 5-10 TB is commodity hardware plus a few extra drives.

Sharding, or splitting out into "big data" databases has its own cost, a cost which is frequently greater than the $20k worth of hardware.

<comment><USER15> An example in the article was over 37TB, and another was 205TB containing "hundreds of thousands of uncompressed InnoDB tables".

Maybe that's a system that could have been better served by something like Cassandra? (Depending, of course, on access patterns, complexity of queries, etc. etc.)</comment></comment></comment>


France Rejects Google Appeal on Cleaning Up Search Results Globally - <AUTHOR> http://recode.net/2015/09/21/france-rejects-google-appeal-on-cleaning-up-search-results-globally/ <comment><AUTHOR> Can anyone explain to me how this is different from China or Iran creating a mass censorship filter? One nation gets to decide what can and cannot be seen on the internet?

I guess if you took the most optimistic view and said the right to be forgotten mechanism would _never_ be abused, then a nation _might_ be able to regulate how articles about its citizens are shared online, since it is acting in the interest of French people.

But what if the City of Townsville passes an ordinance banning the use of French on the Internet entirely? Would Google have to comply with that law?</comment>


Telecom Lobbyists Downplayed Security Flaws in Mobile Data Backbone - <AUTHOR> https://motherboard.vice.com/en_us/article/7x9q8y/telecom-lobbyists-downplayed-theoretical-security-flaws-in-mobile-data-backbone <comment><USER2> SS7 (the protocol whose security flaws are being downplayed here) was not designed with security in mind, and so has been the subject of infosec research for a few years now.

This is a CCC talk from 2014 (there are older ones) where Tobias Engel demonstrates among other things tracking down a test subject over two continents for about a month, via his non-tempered mobile phone, using only SS7: [https://www.youtube.com/watch?v=-wu_pO5Z7Pk](https://www.youtube.com/watch?v=-wu_pO5Z7Pk)

In the same talk he mentions that he is working with a German telecom operator to resolve some of these issues. So as opposed to the US, it appears SS7 has been hardened in the EU since at least 2014 for the type of attacks mentioned in the Vice article... I really wonder why the US MNO are unwilling to act on this, since it's (1) a well known vulnerability and (2) fixes (or at least mitigations) have been implemented.

<comment><USER3> yeah old news. makes the whole mobile system a joke.</comment></comment>


SMS Vulnerability in Twitter, Facebook, and Venmo - <AUTHOR> http://titanous.com/posts/twitter-facebook-venmo-sms-spoofing

<comment><USER2> _Right now, most people use Tent to share short 256 character long status posts with friends. Many independent developers are building other apps that use the Tent protocol._

The author should disclose if his start-up potentially competes with Twitter.

<comment><USER3> I agree, but I don't think it matters too much. He has reported it responsibly. Now, if he had come out with a "zero-day" report, then his competing status would be highly germane.

It was probably because of this competing (experimenting with feature sets, etc) that he found the issue in the first place.

</comment></comment><comment><USER4> You can spoof sender information even when you're running through a shortcode gateway, so short of requiring some sort of authentication on every transaction, there's no real way around this.

Just like email, you should never trust the remote identity.

<comment><USER5> That's really the gist of this.

I still (it's 2012!) can amaze/scare/shock people by sending mails as their so/dad/uncle/lover/boss. SMS is just the same and for just the same reasons it's 'okay' (the usual use case is beneficial: I might want to send mail and define the from header. I really might want to send a text message from a website that looks like it came from my mobile, and leads replies to end up on it).

Can we solve this at all?

</comment></comment><comment><USER6> Almost two years ago: [http://www.ahmedabadmirror.com/article/3/2010112520101125021...](http://www.ahmedabadmirror.com/article/3/20101125201011250211352165d14fe53/Who- updated-your-Facebook-status.html)

</comment><comment><USER7> I thought this sounded familiar:

[http://www.oreillynet.com/onlamp/blog/2007/04/twitter_and_jo...](http://www.oreillynet.com/onlamp/blog/2007/04/twitter_and_jott_vulnerable_to.html)

[http://voices.washingtonpost.com/securityfix/2009/03/twitter...](http://voices.washingtonpost.com/securityfix/2009/03/twitter_security_h.html)

</comment><comment><USER8> best and scariest quote of the post

      Twitter has a PIN code feature that requires every message to be prepended with a four-digit alphanumeric code. This feature mitigates the issue, but is not available to users inside the United States.

So they fixed the problem... but are withholding the fix from tons of users?

<comment><USER9> Or it's specific the phone technology? Maybe the European protocols have authentication built-in.

<comment><AUTHOR> No, there's no phone tech going on here: [https://support.twitter.com/groups/34-apps-sms-and- mobile/to...](https://support.twitter.com/groups/34-apps-sms-and- mobile/topics/153-twitter-via-sms/articles/20169928-how-to-use-pins-with-sms)

</comment></comment></comment><comment><USER10> You can spoof outbound numbers for voice or sms.

As I've said previously, phone number is not identity and confusing the two is foolish.

What'sApp uses your phone number as the username and your IMEI backwards as the password, so I'd say they're a tad more insecure than even these folks.

</comment><comment><USER2> Twitter has a huge engineering department. I just don't know what they do.</comment>


Learn Python with videos, books and conference sessions - <AUTHOR> http://blog.safariflow.com/2013/12/09/safari-bootcamp-intro-to-python/

<comment><USER2> Why hide the price? I realize that landing on a blog post like this first and going from there to the signup process may not be the primary flow they designed to sign up new customers, but I was a bit irked at how many clicks/page loads/scroll to the bottom I had to go through to find the price. Why not put the price right on the account registration page rather than the coy "after your trial you will need to provide billing information to continue"

<comment><USER3> You're right that it's not currently displayed in this signup process, but it's not meant to be hidden. We do always show the current price on the public home page: [http://safariflow.com/](http://safariflow.com/) ($29 USD/mo)</comment></comment>


MIT Tech Review: 35 Innovators under 35 - <AUTHOR> https://www.technologyreview.com/lists/innovators-under-35/2016/?utm_campaign=socialflow&utm_source=twitter&utm_medium=post <comment><AUTHOR> Then there is the "7 innovators over 70" list.

[https://www.technologyreview.com/s/602148/seven- over-70/](https://www.technologyreview.com/s/602148/seven-over-70/)</comment>


Show HN: A renderless and extendable rich-text editor for Vue.js - <AUTHOR> https://github.com/scrumpy/tiptap <comment><USER4> I started paying attention to this when i saw the "Suggestions" demo. [https://tiptap.scrumpy.io/suggestions](https://tiptap.scrumpy.io/suggestions)

Every rich text editor I've tried so far, it's been a nightmare to add autocomplete for stuff like mentions and hashtags. I haven't integrated tiptap yet so maybe it's the same, but the code for the demo looks very promising.

<comment><USER5> At a quick glance tiptap looks great and I don't want to derail the thread mentioning another solution, but after admittedly struggling longer than I'd hoped to implement mentions into a Vue-compatible RTE I got it working fine using modules (NPM) `vue-quill-editor` and `quill-mention`.

Since this is the first public thread I've ready of at least one other person struggling with this (I'm sure there are others), I created this gist of my Vue component in case it helps anyone who want to use Quill instead of tiptap: [https://gist.github.com/whatl3y/d1a9fb7bab75c2188b226e902c6f...](https://gist.github.com/whatl3y/d1a9fb7bab75c2188b226e902c6faff5)

<comment><USER4> Looks great, thanks for the recommendation!

</comment></comment></comment><comment><USER6> As a frontend dev, this is really, really nice and I wish more libraries followed the renderless principles. So many manhours are wasted, daily, just because a library is a tad too specific about it's preferences. It would be nice to see it standardized in some shape or form so that it's both easier to write for newcomers as well as test.

<comment><USER7> I read the renderless article linked to in the README ([https://adamwathan.me/renderless-components-in- vuejs/](https://adamwathan.me/renderless-components-in-vuejs/)) and it seems like an absolute nightmare in Vue. Lots of cognitive overhead for something that's completely natural in React.

<comment><USER6> I didn't downvote your comment, but it seems you've misunderstood the core concepts under discussion here. Renderless isn't inherent to Vue in any way — the problems it addresses are equally present in React-based libraries. You can easily override render functions and the given bindings in both Vue and React, but given libraries that aren't built to be easily extendible, this can often lead to maintenance nightmares. Renderless seeks to counteract that, giving guidelines to architect libraries in a way that doesn't introduce considerable complexity on the library side but makes it a lot more extensible on the consumer side.

<comment><USER7> I think you've misunderstood my post. I'm saying renderless components come "for free" in React -- there's no cognitive overhead or new concepts to learn. It's something that comes very naturally as you develop React components to the point where I've been writing renderless components for years without ever really thinking about it. From reading the article linked above it feels very clumsy in Vue based on the fact that there's a whole feature (slots) which not only feels fairly magical but requires a rather meaty article to explain it's usage.

I guess what I'm saying is if you're really interested in renderless components it's probably easier to just use React.

<comment><USER6> I still don't really see what you mean — the functionalities are practically identical between the two frameworks, Vue uses slots, React uses props children. The only difference is naming and minor semantics differences. The same principles apply for both, and the discussion is just as relevant for both. Personally I prefer the Vue approach over the React one since React components are usually build more black-box style in this architecture, but that is mainly a preference argument. The "cost" of the approach is the same in both libraries.

<comment><USER7> > The only difference is naming and minor semantics differences

I don't agree at all. There are no naming/semantics for doing renderless in React. React has no analogue for "slots" because it's just naturally part of the framework. It's as simple as doing:

       <LinkList renderLink={(linkProps) => <div>...</div>} />

No extra terminology to learn, no slot keys, extra attributes, or rendering magic, and definitely not something you need a whole article to explain.

<comment><USER6> That's a basic example which doesn't address the topics discussed in the article at all. The same is just as easy in Vue, even with identical property names if you like.

        <link-list :render-link="(props) => ..." />

The whole idea of renderless is to move beyond this very limited and crude approach for library code where you might need to override only small bits of the logic or all of the logic, depending on your use case. At the moment I can't help but feel you've missed the core ideas of the article and we're discussing completely different points.

<comment><USER7> Why would you want to use slots, then? It's just extra steps for the same functionality.

> The whole idea of renderless is to move beyond this very limited and crude > approach for library code where you might need to override only small bits > of the logic or all of the logic, depending on your use case

Not at all. For example, react-select does this super seamlessly: [https://react-select.com/components](https://react-select.com/components)

I guess what I'm trying to say is I don't understand why it seems so complicated in Vue.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is really cool! and I really want to adopt it. I have a question though, can the data be represented as markdown, instead of html and json?

My current editor is monaco and the format is markdown. Monaco is too heavy, I want something closer to what Medium.com has. This renderless rich-text editor looks perfect. But my backend accepts only markdown ...

And I also need to support math equations ...

<comment><USER9> There is already a feature request about markdown support. You can follow that issue on github. At the moment I'm not sure if this will land in tiptap.

</comment></comment><comment><USER10> This is really awesome. I've been watching Prosemirror for a long time and have considered building something like this on top of it, but haven't had the time to try. I've been using Quill instead, since it's a lot simpler and was pretty easy to just drop in place. This looks like a nice upgrade though!

<comment><USER9> We used Quill before as our rich text editor at scrumpy.io … a few months later I started working on tiptap :)

</comment></comment><comment><USER11> Nice work here, very smooth and supports a good set of functionality by default.

Added to the list of HTML editor: [https://gist.github.com/manigandham/65543a0bc2bf7006a487](https://gist.github.com/manigandham/65543a0bc2bf7006a487)

</comment><comment><USER12> Might be nice to do some more input validation, particularly for links - <USER2> editor is happy to insert a javascript: link. I don't think this poses a security issue (at most, you'll get what - a self XSS?) because you'd obviously do server-side sanitisation in a real application, but it might be nice to check for non-https protocols and warn the user when they insert them?

<comment><USER9> Good catch! That should be easily done.

</comment></comment><comment><USER13> It fascinating that in 2019 we aren't able to get one text editor that would work seamlessly across all frameworks , but instead need to basically re-write huge "bindings" to support the reactivity and the rendering logic in each of them.

Web Components have definitely failed.

<comment><USER14> While I agree we (as in the internet at large) haven't solved the text editor problem, by saying "web components have failed" you're concluding in bad faith.

If such a "universal rich text edit" web component comes out, have web components then succeeded? Then failure isn't such a permanent state as your comment implies, rather an indication of work yet to be done.

Unless you'd like to clarify more, your comment seems to me like you're flinging mud without being able to back it up. What's the reason for that?

Of note, Trix has been using the `customElements` standard since forever: [https://github.com/basecamp/trix/](https://github.com/basecamp/trix/)

There's also slate, the (old!) tinymce, umm... I know I've at least experimented with a good couple more I can't recall.

And, on the topic of components I wish existed (anywhere - react, vue, angular, etc - anything), I've been searching for a good rich multiselect for a long time! If you know of any please let me know :)

<comment><USER15> > And, on the topic of components I wish existed (anywhere - react, vue, > angular, etc - anything), I've been searching for a good rich multiselect > for a long time! If you know of any please let me know :)

Select2 [1] has been around forever but it's always worked out pretty nicely for me.

It's a jQuery plugin, so it's somewhat out of vogue these days, but it's trivially easy to wrap it in a component to make it play nicely with Vue (in fact, the Vue documentation uses it as the example for writing wrapper components [2]). I imagine something similar can be done with React, Angular, etc., though I'm not too familiar with the process there.

[1] [https://select2.org](https://select2.org)

[2] [https://vuejs.org/v2/examples/select2.html](https://vuejs.org/v2/examples/select2.html)

<comment><USER16> not that there's anything wrong with jquery or select2, both of which i used heavily in the past, but if you're working in vue it's a very nice feeling to just completely drop the jquery dependency. ive been using [https://github.com/shentao/vue-multiselect](https://github.com/shentao/vue- multiselect) for over a year now in production and despite its quirks i'd recommend it.

<comment><USER14> ooooh nice. I didn't know this was a thing. Yeah, the jquery bundle size really isn't justified for a single thing (rich multiselect). I recently ported `selectr` for use in an app at work, but I'd love to replace it as there's some wonkiness

</comment></comment></comment></comment></comment><comment><USER9> creator of tiptap here. a bit late, unfortunately.

<comment><USER17> Can you write an editor that moves on from 1990's WYSIWYG to use the HTML5 content sectioning elements, so that different 'sections' and 'asides' can be moved around? In so doing - and nesting them - the headings could be given an automatic h2 - h6 level, with the headings inside sections/articles.

It would also be nice to see details/summary entries and nothing in the toolbar that creates inline CSS things.

Out the box such an editor should create accessible HTML that can be easily styled, with structure to it that would result in a document outline.

I think such an editor could be what a lot of the web needs, to make people wonder why we ever had WYSIWYG backend editors that render nothing like the frontend, e.g. the things you get in Wordpress and other content editors.

WYSIWYG made sense in the 1990's when what you wanted was a printed 'dead tree' page, but we have responsive design now and lots of different screen sizes, so it is getting the structure right that matters more, not just for accessibility but SEO.

</comment></comment><comment><USER18> This is _really_ slick. I like it.

Would love details on browser support, though.

<comment><USER9> It's built on top of ProseMirror. They're targeting IE11.

</comment></comment><comment><USER19> I used this for a demo (that took about 30 minutes to build) and my stakeholders loved it. Thanks!

</comment><comment><USER20> Yaaaay, there is a project that integrates it with vuetify my favourite vue UI kit:

[https://github.com/iliyaZelenko/tiptap- vuetify](https://github.com/iliyaZelenko/tiptap-vuetify)

</comment><comment><USER21> On the topic of rich text editors (since people mentioned Slate) what's your opinion of react's draft.js?

<comment><USER22> Not OP, but I was an early contributor to Draft.

Draft JS lacks a few features, notably nested block support (tables) and a schema definition and sanitization. Slate is more focused on providing a nice plugin experience.

On the plus side Draft's core is battle tested and has just picked up Android support, and has the excellent Draft JS Plugins resource.

</comment></comment><comment><USER23> While this is really nice, it's a shame that a VueJS developer is unable to re-use a React-based text-editor which already exists and he found it perfect. This is why Web Components start making a lot of sense.

<comment><USER24> Will web components let him use a React module with Vue.js without loading both libraries and learning React?

Or is web components a _third_ library that is so much better that you don't need the other two libraries?

Is this the situation where there are too many standards and you can only solve the problem by creating another standard?

<comment><USER25> Web Components should replace them both. They aren't standards - <USER3> frameworks developed by third parties. The Web Components standard is the official standard and should be the one people reach for</comment></comment></comment>


Facebook for work is about to launch - <AUTHOR> https://techcrunch.com/2016/09/27/facebook-for-work/ <comment><USER2> We use Slack in our office. As a company owner, I wouldn't encourage my employees to use Facebook At Work, because they'll definitely get distraced by personal messages. However, it's exciting to see what features Facebook will launch.

<comment><AUTHOR> I see it as the slack of small businesses.</comment></comment>


The start of seeing ads in your terminal - <AUTHOR> https://github.com/standard/standard/issues/1381 <comment><USER2> Next up: sending system metrics back to a server to allow for better ads. "Wouldn't you rather see an ad that's useful for you? See, you really should allow us to scan your files and transmit them to our servers".

</comment><comment><USER3> The plague of advertising will always find a new home to infect.</comment>


If it can be null, it will be null - The Golden Rule of Programming - <AUTHOR> http://hub.am/XB63WL

<comment><USER2> this has kicked my butt so many times. You would think I'd have learned by now.</comment>


Jimmy Wales plans to hire journalists for news-focused social network - <AUTHOR> https://www.pressgazette.co.uk/wikipedia-jimmy-wales-hiring-journalists-wt-social-network-news-wikitribune/ <comment><USER2> I'd prefer embracing the hyperlink and think he might be tackling two separate problems at once here: (collaborative) content creation on the one hand and content curation and consumption on the other.

</comment><comment><USER3> From the wikimedia coffers I bet.</comment>


62% of general counsels use Excel and email to manage contract data: survey - <AUTHOR> https://www.artificiallawyer.com/2020/02/13/62-of-gcs-still-use-excel-sharepoint-email-to-manage-contract-data/ <comment><USER2> It seems to me that SQL, C++, and Excel VBA (in that order) are probably the 3 top evergreen skills that folks in the 80s or 90s are still able to utilize in a career spanning 20+ years! JavaScript is probably the equivalent for this generation.

<comment><USER3> Out of all major programming languages, JavaScript is the language that changed the most in recent years.

<comment><USER4> I tried to teach someone new to programming javascript... I was quite astonished at how hard it is to learn. Nearly anything you'd want to do, there are 5 different ways to achieve it, together with 5 more libraries/abstractions that help solve the issue, and they're all a bit incompatible.

Have fun trying to integrate the "document.write('hello world')" example you found from stackoverflow into a react app while being a beginner and not really knowing why exactly they aren't compatible.

<comment><USER5> The inappropriately-leaked abstraction of the event loop is another big hurdle for newbies in JS-land. Yes we have async/await so it's somewhat less gross now but then that's another of those "5 ways to achieve it" things.

</comment></comment></comment></comment><comment><USER6> Excel, SharePoint and Email all have one thing in common. They are almost universally used and have a low barrier to entry.

<comment><USER7> Ok, but why not use Google Sheets or Airtable instead of Excel?

<comment><USER8> Privacy concerns. Why would you upload private information to a third party for no advantage?

<comment><USER7> There are some advantages like version control or everyone working in the same document with the latest data.

I've seen it dozens of times. Someone shares the wrong excel file then others keep working with outdated data. Or maybe they all share a file in Dropbox but someone didn't sync for some reason and kept working and generating changes over an old file.

</comment></comment></comment></comment><comment><USER9> I have never met an application that's as easy to maintain as a spreadsheet is. It's the only thing that feels like you're actually editing what you want and not being hand cuffed by some constraint. It's the very definition of WYSIWYG. There's a reason that the shared calendar of choice for my wife and I is a Google Sheet and not Google Calendar.

<comment><USER10> If there was only decent version control so you could go back quickly if something goes wrong.

<comment><USER11> Google Sheets has this: [https://support.google.com/docs/answer/190843](https://support.google.com/docs/answer/190843)

</comment></comment></comment><comment><USER12> I'm in eDiscovery, we host trial databases in a really stout and intuitive review platform. My clients can, after they've done their searching and culled for relevance and privilege, browse through the document viewer and look at either the text with highlighted search hits or the native rendering of all their documents. All of their coding and tagging of documents is right there in the side panel of the doc viewer. There's hardly a week that goes by that an attorney or paralegal DOESN'T call and ask us for PDFs of their documents. Until a few years ago it wasn't unusual for someone to call and ask paper copies of hundreds of pages at a time to review.

The legal world is outstandingly slow to embrace better solutions in technology.

<comment><USER13> Can I access your platform / document viewer offline?

<comment><USER12> No, and of course, that's the rub.

<comment><USER14> Seems like a gap in the market if someone steps in with offline sync (even just one-way) and the ability to securely access files from a next-day delivered USB stick.

<comment><USER12> We've done that for special case scenarios. The last review tool we used was in a mixed Linux/Windows environment and we had a client in jail awaiting trial so we built a laptop to run everything and our PM visited him weekly to update his copy of the DB locally (no internet access in the pen). The biggest sticking point is that it's not uncommon to get to 4-6 TB on one of our databases and it takes a bunch of processors and memory to run the software, but I smell a development opportunity now that you mention it.

<comment><USER13> One, you can get an external 6 TB hard drive for like $100. At attorney levels of money, that's entirely reasonable.

Two, clearly in the pre-computer world, attorneys were not reviewing 6 terabytes of actual data for discovery. What makes it so big? Is it that you have scanned PDFs in image format (such that it's a reasonable number of pages printed out), or is it that you have new types of data like electronic records that simply wouldn't have been picked up in the old days?

</comment></comment></comment></comment></comment></comment><comment><USER15> My takeaway is that MS should double down on their office applications and make them absolutely spectacular.

<comment><USER16> I think that Excel is already spectacular. That being said, if a C# or similar lived inside excel as a first class language (instead of VBA), that would make Excel unbelievable.

<comment><USER17> Microsoft is doing basically this, except with Typescript instead of C#: [https://docs.microsoft.com/en- us/office/dev/scripts/overview...](https://docs.microsoft.com/en- us/office/dev/scripts/overview/excel)

</comment></comment></comment><comment><USER18> Keep in mind that their email probably doesn't look like your email. There are literally thousands of tools that plug into email and/or build on top of it in some way. Everything they're sending and receiving is going to be searchable and auditable by multiple entities, both within and outside of the company, and will stand up in court if challenged.

Just because they're "using email" doesn't mean they aren't also already using specific tools for this purpose.

</comment><comment><USER19> This way is pretty sane. With O365,they can have azure information protection and MFA for security and easily share with onedrive(blocking all other filesharing and USB helps a lot with this) Outlook hosted on O365 also has AIP to prevent confidential data leakage. As others have noted,excel is great with managing this kind of data and if you dislike VB macros: embedded python support will be there this year!

</comment><comment><USER20> I have spent a lot of time on contract negotiation and management for engineering and EPC contracts. I can confirm that more or less, excel, SharePoint, and email fits with my experience of how things are done in the wild. (I do have some home-grown specialized tools I use for things like claims tracking.) Every big contract is different, and tools with lots of requirements are often not as adaptable to those nuances as a trusty excel sheet that you've honed through the years.

However, my experience in utility EPC space is that contracts are negotiated primarily by sales & supply chain people and reviewed by lawyers, and then turned over to contract managers, who only get their legal departments involved for advice or when there is an escalating problem that looks like it might head for arbitration or court. So asking general counsels about this seems like the wrong audience--at least out in my little segment of the real world, it's contract managers who mange contracts, not lawyers.

</comment><comment><USER21> Those tools are all excellent at getting work done.

</comment><comment><USER22> What's the alternative?

<comment><USER10> Have an IT department take over. Have things that took five minutes to change previously now take weeks of writing requirements plus waiting for implementation only to be told after a year that your request has been descoped. Now you have a "professional" Solution but also some spreadsheets because you actually have a job to do and need these changes and Excel is the only way to do it quickly.

<comment><USER23> I once had a temp job where I would take data printed out from a mainframe, and type it into a PC. I asked "Why not download it?" It turned out it was easier to hire someone to type than to get any useful cooperation out of IT.

</comment></comment></comment><comment><USER24> Putting aside whether or not this is actually a problem: The survey is only N=50, not N=10000, in spite of the article's emphasis on the second number. Large firms are unlikely to use different techniques for managing different contracts.

This is a white paper report from a legal AI company, not an academic study, so some selection bias is to be expected.

</comment><comment><USER25> What's wrong with using these products? This "study" doesn't appear to make a distinction between using the products exclusively and using them in conjunction with other products.

I'm betting every one of these large companies ALSO use specific contract management software tools in addition to Excel Sharepoint and email.

I'm actually surprise MORE companies don't use this combination since almost every large company makes use of MSFT office suite products.

I'm skeptical of any company trying to position itself as some sort of replacement for products that have been used for decades.

I've drunk that Kool-Aid before and it never works out the way it's intended, companies always fall back on some class Office suite products.

The sad truth is that you'll probably end up using Excel, Sharepoint, and email in addition to whatever contract management solution you go with.

</comment><comment><USER26> You can see the perspective of the authors of this article by the "Leaders" and "Laggards" lists at the bottom.

E.g., the top "Leader" point is: "Will adopt AI-based contract risk mitigation technology in the next 12 months."

I mean, who am I to tell "GC"s not to have some fun and fluff up their resumes at the same time? But if you want to improve your capabilities to manage contracts, buying AI solutions is not exactly a straight line to success.

</comment><comment><USER14> My instinct says that their data structure is also a _nightmare_.

</comment><comment> stef-13013 KISS

</comment><comment><USER27> Only 62%?

<comment><USER28> Only 62% admitted to use Excel in a survey.

</comment></comment><comment><USER29> GC = General Council, surveyed across 50 large corporate legal departments

<comment><USER30> > GC = General Council

No, General _Counsel_ (Council is a group of people who make decisions, Counsel is an advisor, especially, as in this context, a lawyer/legal advisor, or their advice; "counsellor" is also used for a lawyer or advisor.)</comment></comment>


Ask HN: After Google Reader (etc.), do you still choose to rely on Analytics? - <AUTHOR>

After Google cancelled Reader - while Alerts is becoming less and less useful - I wondered whether it still made sense to use Google Analytics as the primary analytics tool.<p>Are we better off using a - paid - alternative, or do you still think it's a good idea to keep using Analytics? <comment><USER2> I just switched to Piwik and regret not doing it sooner. [http://thecrumb.com/2013/03/29/breaking-up-with-google- analy...](http://thecrumb.com/2013/03/29/breaking-up-with-google-analytics/)</comment>


When is a URL shortener not a URL shortener?  - <AUTHOR> http://qntm.org/twit

<comment><USER3> > Once it's fixed (I'll let them know about it tomorrow and I expect it'll be > rectified in a day or two) I'll update this page, but until that time, try > it for yourself.

Sadly, it will never be fixed. This is not a bug to them. They are forcing every url on twitter to go through t.co for click tracking. It is no longer possible to put a url into a tweet without going through t.co, unless you leave off the http, which makes it unclickable in a lot of clients.

<comment><USER4> Twitter's description says wrapping only applies to links of 19 characters or longer.

<https://dev.twitter.com/discussions/1062>

Sounds like a bug.

<comment><USER5> Might be a bug, but the posting API has also been updated to allow developers to flag that all URLs to be wrapped, no matter the length. And it looks like the plan in the long run is to wrap all links.

</comment></comment></comment><comment><USER6> This doesn't just bug me for URLs that are shorter than the t.co URL, but also when I'm posting a link to a website and I want people to see the full URL.

e.g. It is often sufficiently descriptive to tweet "This is a great site: <http://actionfiguresridingkittens.tumbly.mil>

<comment><USER7> Twitter has implemented a decent solution for that, which most clients (including the website) respect - it includes a display_url parameter along with the shortened URL in tweets fetched via the API.

<comment><USER8> But the displayed URL is truncated with an ellipsis at the end. The OPs URL is likely long enough to trigger that. Sometimes a long URL is all you want to share, but that is now impossible to do. A tweet saying "<http://hotchickswithstubbedtoesmakingsexfaces.com/> exists" is a decent tweet, but a tweet saying "<http://hotchickswit..>. exists" isn't as good. And sure, you can mouseover to see the full link, but that's balls.

</comment></comment></comment><comment><USER9> A solution to this would be for Twitter to post the t.co URL if the original URL is longer than the t.co URL or if the original URL is too long to fit in the tweet. Else, it would display the original URL but direct it to the t.co URL for tracking.

So a tweet that says:

        Check it out: http://zombo.com

Would be posted as:

        Check it out: http://zombo.com

This would preserve Twitter's tracking while maximizing the amount of information in the displayed URL as well as meeting the user's expectations, intent, and needs. Thoughts?

<comment><USER10> That's what they already do through their web interface. And for any apps/whatever using the API, they give both version of the URL so that developers can do the same thing.

</comment></comment><comment><USER11> There are pigeonhole principle issues with the concept of url shortening - <USER2> same that apply to data compression in general.

With regards to urls that are a bit of ways down the tree (<http://www.foo.com/bar/baz/whatever>), this isn't really an issue, as generally within a domain, the url-friendliness comes at an expense of a great deal of length, and you can do something like:

shortened url := <http://short.nr/shorten(domain)shorten(tail)>

and end up with something shorter.

When trying to shorten already-short urls, though, characters will not necessarily be gained.

From Twitter's perspective, the ideal solution might be to count "urls" as a fixed length, or an attachment, with respect to the length of a tweet so as to sidestep this issue entirely.

<comment><USER12> If all you want is shortening, then there shouldn't be a problem: if the t.co link is longer, just don't use it. This is different from data compression because "pointers are automatically dereferenced": there's no functional difference between t.co/foo sending you to google.com and t.co/bar sending you to t.co/foo. (If I'm wrong about this, then it's still possible to not-make- longer everything that isn't a t.co link.)

A similar case with data compression would be if you can guarantee that the decompressed data is never a valid compressed file. In this case, compress something iff that makes it shorter, and decompress something iff it's compressed.

</comment></comment><comment><USER13> t.co isn't just shortening—it's also click tracking.

<comment><USER7> That's pretty much an assumed feature of any URL shortener these days. Many folks use them precisely for that sort of analytics.

</comment></comment><comment><USER14> this 'feature' works even with <http://bit.ly> or <http://t.co>, lol

</comment><comment><USER15> It's surprising that URL shorteners are so central to how Twitter works, but they only recently built it into their own UI. I've been using the website interface lately and find myself having to shorten externally and paste it into Twitter, as the 120 default is sometimes too short.

</comment><comment><USER16> Well, regardless what their policy says, it's been buggy this way since they introduced it, and they've thus far ignored the many, many bug reports they've gotten about it. If yours gets through to them that would be wonderful, but I'm not holding my breath.

</comment><comment><USER17> Cannot believe that developer forgot to include this at the end of shortening process:

if(strShortenedURL.Length > strURL.Length) { //Handle this case //donot use shortened version, use original URL }

<comment><USER18> It's not in their interest to do so, as it would leave already short links without them being able to track them

</comment></comment><comment><USER19> When it's ajar?

</comment><comment><USER20> link wrapper != link shortener

<comment><USER21> totally agree, some "shortening" services simply give you some value add services like - <http://sclst.mp> , http//su.pr etc.</comment></comment>


How to Fix Science - <AUTHOR> http://lesswrong.com/lw/ajj/how_to_fix_science/

<comment><USER2> It's funny how the author uses published studies to support his claim that science is broken. What's statistically more likely, that 80% of articles conflate "statistical significance" with colloquial "significance", or that _one study_ misinterpreted many of the others. That requires bias on the part of only one team of authors. Nah, the studies that support my thesis must be true.

But if those studies (which reviewed other studies) are true, it's a nice example of the self-correcting nature of science. We've gotten this far. To say that science is fundamentally broken is a bit of an exaggeration.</comment>