Portier – An email-based, passwordless authentication service - <AUTHOR> https://portier.github.io/ <comment><USER2> Hi! A few of us have been hacking on this scaled-down, spiritual successor to Persona.

The core idea is that you treat this (self-hostable!) microservice like a black box: email address goes in, validated proof of identity comes out. No passwords, and no secrets to store in your application's database. The service itself is also effectively stateless: aside from caching, the longest lived key in Redis has a TTL of 15 minutes, and no other datastore is required. So it should scale pretty reasonably, and be easy enough to administer for hobbyists.

Behind the scenes, it works similarly to a password reset or passwordless login workflow, but with progressive enhancement so that, e.g., Gmail users go through Google Sign-In instead of having to check their email.

<comment><USER3> >Behind the scenes, it works similarly to a password reset or passwordless login workflow, but with progressive enhancement so that, e.g., Gmail users go through Google Sign-In instead of having to check their email.

I mean there's really nothing you can do about it, but it doesn't handle Google Apps / G Suite / whatever today's flavor of white-label Google services is.

If I use my email which is a Google Apps account, I don't get the Google Sign- In enhancement, I get an email.

<comment><USER2> We discussed this in [https://github.com/portier/portier- broker/issues/44](https://github.com/portier/portier-broker/issues/44), and unfortunately don't think there's a good way to blanket-enable support for G Suite domains. :(

I'd really love to make this possible in the near future. Maybe an opt-in flag? Or finishing up our federated protocol and building a tiny service that bridges between that and G-Suite? Suggestions / feedback into that bug would be really helpful.

<comment><USER4> A possible solution would be a DNS TXT entry (some with custom mail domains will have some sort of access to their DNS), which Portier could look up and use to determine if the service supports some form of OAuth.

Alternatively, if DNS is not applicable, users could use filters and autoresponders to send back an automatic response with some code.

In theory that would basically mean "Portier sends Login Mail" -> "Login Mail gets bounced via filter with additional code" -> "Portier constructs OAuth Link" -> "Portier sends OAuth back"

<comment><USER5> An auto responder wouldn't have access to the user that made the request's cookies, and therefore would be unable to actually authenticate the user. You'd wind up with a system where anyone that knew your email would be able to log in as you, which is a rather bad idea.

<comment><USER4> The autoresponder is more of a "This domain accept OAuth" and sends back the email body.

That way, the autoresponder doesn't need to know anything about the process nor does it authenticate the user.

It merely sends back a mail that portier can interprete as "Ok, I send an auth email there and this response means they want me to construct an oauth link to this domain"

it's stateless and only requires a rather simple autoresponder that can include email bodies.

Furthermore, portier can also verify the login link, so that replay attacks aren't feasible and the sender and link-owner must have matching emails.

</comment></comment></comment></comment></comment></comment><comment><USER2> Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes.

Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like firstname.lastname@example.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in [https://github.com/portier/portier- broker/issues/96](https://github.com/portier/portier-broker/issues/96)

<comment><USER6> What about only explicitly allowing domains that have DKIM enabled?

Having that form of validation should help since DKIM was made to specifically stop email spoofing; and anyone serious about implementing Portier would understand that need.

Outlook/Gmail etc aren't likely to be flagged by ESP's for the most part as those have reputation and rudimentary spoofing protection, at least more than firstname.lastname@example.com anyway.

Persons using custom domains are usually the admins of those domains, and Office 365/GApps/Registrars etc. provide simple ways to enable DKIM.

<comment><USER7> In response to your other (dead) comment, "SPF" records actually are TXT records.

In the past, there was an SPF RR type but that's been deprecated.

</comment></comment></comment><comment> awinter-py Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around).

Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.

<comment><USER8> It is, and has been since god knows when: client certificates. Better than passwords because they can't be phised, doesn't require an email, doesn't require trusting any third-party service.

Unfortunately they are also very difficult to understand for even normal geeks and so basically no site use them.

<comment><USER9> It's not hard to understand ("you have the key, in a form of file or a hardware token, use it to open your account" is something average grandma can grok - no harder than passwords), but current UI and UX are terrible. Then it's chicken-and-egg problem: no one uses certificates because they're unuseable, and no one works on their usability because no one uses them.

</comment></comment></comment><comment><USER10> Note that Mozilla Persona did not support passwordless authentication. Specifically, you would still need to create a Persona password if you didn't use a Gmail/Yahoo email address.

I've tested this service with one of those 10-minute emails and it seems to work without any passwords, so true passwordless authentication.

<comment><USER2> Yep! Requiring a separate account for Persona was, in hindsight, misguided. I've written a bit about what Persona got right and wrong, and how we* plan for Portier to be different, at [https://github.com/portier/portier.github.io/blob/master/Oth...](https://github.com/portier/portier.github.io/blob/master/OtherProjects.md#portier- compared-to-persona)

*Though Mozilla supported my work on this, Portier is an independent side project with significant code contributions from folks outside Mozilla.

</comment></comment><comment><USER11> I tried purely email based authentication in the past, unfortunately our domain for whatever reason wasn't deemed beyond reproach by gmail et al. At first it they blocked around 5% of emails eventually this went up to nearly 9%, aside from those that got blocked some just disappeared into a void after being accepted by gmail and took upwards of 20 mins to a few hours to be delivered.

<comment><USER12> > ...unfortunately our domain for whatever reason wasn't deemed beyond > reproach by gmail et al. ... aside from those that got blocked some just > disappeared into a void after being accepted by gmail...

This is why I have started to really loathe GMail. I get that spam is a problem but, periodically, Google decides to shit-can e-mails from me to their subscribers with no notification to me or the recipient. I know for an absolute fact that no one sends spam from my server because I'm the only person who uses that server and it has no mail-sending scripts on it. My DKIM and SPF records are configured and working, my sending IPs have been consistent for years, and my domain's registration predates the existence of Google[0]. But still, every 4 months or so, Google decides to get its hackles up for a few days and then everything goes back to normal.

0 - This is maybe one reason that compounds my frustration because I've been on the Internet long enough to remember when this wasn't a problem and when mail admins could talk to each other to resolve things like this.

</comment></comment><comment><USER13> Is there a process for migrating to a different email address?

Let's say I used my work address to sign into a bunch of stuff, but then I leave my job and I lose access to my email address? Or say I'm migrating from using @gmail.com for everything to using my own domain?

<comment><USER2> Portier is an implementation detail for the websites you're using -- it doesn't do anything but validate addresses, and it doesn't have any kind of persistent database. It'd be up to the sites you're using to have some sort of address changing mechanism, just as if they were using a traditional username/password system.

One tradeoff of Portier's approach is that you can't authenticate if you lose access to your email account. This can be a pain in the ass in some cases, but beneficial in others -- pull someone from your company's LDAP and they can't represent themselves with that email address anymore. Tradeoffs :/

<comment><USER14> This was a criticism I heard a bunch while I was trying to evangelize Persona. Persona and Portier almost replace all of the guts of a user database, except for small needs of user profiles (which will likely forever be site specific) and user continuity, which is a much bigger issue and the source of the most pushback against Persona I heard from potential site owners.

User continuity and conjunction (as a user here are three emails that all represent "me"; this one I used in the past but cannot access now; this one is my "primary") is definitely a complicated problem and there are definitely some domains (corporate) that need to be stricter with what they allow than others.

The best argument I found was that all of the major website frameworks in use today (Rails, ASP.NET, Laravel, Django, what have you) provide in the box solutions for user continuity given the existing "standard" of username/password connected to an assortment of email addresses and/or OpenID Connect connections. The easiest way to implement Persona (or Portier) in most frameworks and continue to take advantage of built-in user continuity was as "yet another vaguely OpenID Connect"-like option in the potential giant wall of login brands, which means that it competes with Facebook/Google/GitHub/et al login for mental brand space.

Obviously there is no "easy" answer here, but it would definitely help sell Portier to potential sites if there were some answers. Perhaps some sort of user continuity service (or service options) would be useful as another microservice in a "Portier ecosystem" even if it is just barely on par with the built-in templates of the average web framework today. That could help make it easier to "sell" it as a drop-in replacement for all of the bulky weight of web framework user systems rather than "yet another login option in a sea of them".

</comment></comment></comment><comment><USER15> Cool! Caddy webserver supports something similar I think —minus the google sign-in: [https://caddyserver.com/docs/multipass](https://caddyserver.com/docs/multipass)

<comment><USER16> Hi, I'm the dev. [https://github.com/namsral/multipass](https://github.com/namsral/multipass)

Multipass is email provider agnostic, any email address can be used to authenticate users without a password. It's up to the service maintainer to handle authorisation.

Multipass is available as a Caddy plugin, a single binary and can be included in your Go project.

</comment></comment><comment><USER17> Is it possible to create an email-like service that doesn't actually handle email, but only serves as an identity endpoint to be used with Portier?

Like, say, I create an account that reads "firstname.lastname@example.com" and implement something on my fiatjaf.com server so that I can use it to login using Portier?

<comment><USER2> It will be! We're not sure what the eventual protocol will look like, but it'll probably start with webfinger, which can then point to whatever authentication gateway you want. We only need SMTP as the base case in the chain of strategies: [https://github.com/portier/portier.github.io/blob/master/Des...](https://github.com/portier/portier.github.io/blob/master/Design.md)

<comment><USER18> At the risk of stating the obvious choosing webfinger implicitly excludes anyone who does not or can not control their website sufficiently to implement webfinger. (ie: hosted webservices similar to Tumblr et al)

<comment><USER17> That's perfect.

If you do not own the domain you shouldn't be able to use the domain like that.

<comment><USER18> Owning the domain is not the same thing as fully controlling the web service.

My use of Tumblr as an example rather than simply stating hosted-CMS has probably misconstrued my point. (I use Tumblr with my own domain and forget that it is primarily not used that way.)

<comment><USER14> Right if your domain is simply CNAMEd to a Tumblr or Blogger or similar hosted CMS you probably have no way to get webfinger in place.

Another example here is any domain that uses static hosting. Lots of domains are hosted on GitHub Pages these days as the obvious big example (but you can replace that with any other static host like Netflify or raw S3 even). The webfinger spec uses query strings to differentiate user requests which means that a static hosted site is at best limited to a single user/email account (by ignoring the query string and returning a static JSON document).

</comment></comment></comment></comment></comment></comment><comment><USER9> Maybe I'm heavily misunderstanding how this whole thing works, but isn't it basically a django-allauth/passport.js/omniauth/... packed as a [micro]service, with an "click link in email" for the fallback algorithm, and a planned "self-hosted" option (not sure how it would be any conceptually different from classic OpenID)?

Calling this a spiritual successor to Persona looks like a big stretch to me... Maybe I got it all wrong, though.

(And still I don't like it anyway, because my pet peeve is not having identity _providers_ at all - one's identity must be something they can actually _own_ , not something they lease from a provider, be it an email service or domain registrar...)

<comment><USER2> Yes. It's multi-provider authentication as a service.

I think this matters, since it means I can run a single instance to support _all_ of my projects, regardless of language, because everything speaks HTTP. I don't have to grapple with OmniAuth for Ruby, AllAuth for Python, Passwordless for Node, and lord knows what for experiments in Clojure, Elixir, and Rust. I don't have to set up outbound email, register social API keys, and design a hybrid login form for each of those projects, either. Set up Portier once, and I'm done. I've written more about Persona's failings and virtues at [https://github.com/portier/portier.github.io/blob/master/Oth...](https://github.com/portier/portier.github.io/blob/master/OtherProjects.md), which might better explain why I view this as a successor.

As to Identity Providers... as long as websites utilize email addresses as a way of identifying accounts and resetting passwords, we're in the same place. Portier makes this no worse. I sympathize with the notion that identity should not be leased from a third party, but I don't know how to solve that. Blockchains? I'd encourage others to pursue that future while Portier tries to carve out an ephemeral but useful island in the present.

<comment><USER9> > Yes. It's multi-provider authentication as a service.

I see. Thanks for clarifying!

I just thought Persona was about privacy (IdPs unaware about identity consumers), and potential browser integration - this was its good points. So, when comparing to Persona, this one looks pale to me.

> Blockchains?

TBH, I don't see any necessity to prove chronologies or require global consensus, unless a globally-unique human-readable identities (like email addresses, but actually owned) are desirable. But are they? I mean, when I walk in some company's reception desk, I don't normally show them some universally recognized ID, I just say "hi, I'm your customer, we had business before - you know me as Aleksey".

Just that I believe it's good to have an authentication protocol (something better than usernames-and-passwords) that is universally accepted, rather than an universally accepted identity. Do you know, does general audience wants it differently?

</comment></comment></comment><comment><USER18> I hope the needs of providers like Fastmail (who provide services at users domains) are top of mind for the people behind this project as it's difficult to see it getting traction if it can't be deployed en-mass by hosting providers.

</comment><comment><USER19> I dream of the day all logins are just simple tokens. Either sent through email, or SMS. So sick of passwords. I've used other Passwordless libraries on a few projects, and it's almost cathartic.

<comment><USER20> The problem with that is that it breaks a user's flow too much :/ It's a good fallback, and it has many benefits, but having to switch contexts to the mail client and wait for an email is too cumbersome for the user (although it's not too bad when paired with a long-lived session).

That's why Portier supports other auth providers, so you can have the best of both worlds.

<comment><USER21> >The problem with that is that it breaks a user's flow too much :/

Unironically and without rancor, would you say it breaks a users flow more or less than having to go fire up their password manager and find the service from dozens of entries?

The number of services we use daily is increasing, and they just keep getting hacked. The idea of actually memorizing your password is rapidly becoming impractical. Most people these days who understand password security have either developed a personal algorithm for deriving passwords, or use a password manager for literally everything.

I'm super glad someone has done this, because it means I don't have to get off my arse and do it, and lord knows I love laziness.

Generally speaking, for websites that I log into less than once a month, I reset my password every time I log into them, and set it to a random and long keyboard smashing every time I do so. This is the same workflow, but without having to use notepad to stage the new "password" for entry into the confirmation field.

<comment><USER20> > more or less than having to go fire up their password manager and find the > service from dozens of entries?

Definitely more. All good password managers are so well integrated that the username and password are pre-filled in most sites noawadays.

> Most people these days who understand password security have either > developed a personal algorithm for deriving passwords, or use a password > manager for literally everything.

Yep, passwords suck.

> This is the same workflow, but without having to use notepad to stage the > new "password" for entry into the confirmation field.

Exactly. This just removes all pretense.

</comment></comment></comment></comment><comment><USER22> This sounds an awful lot like OpenID (2). What makes it different? My OpenID login (aka XRI i-name) is "=chris.hills" and works on sites that support it.

<comment><USER2> There's a little more discussion of that over on Lobsters: [https://lobste.rs/s/fkosun/](https://lobste.rs/s/fkosun/). The TL;DR is that URIs just didn't work for the mass public. You had to supplement the login form with a NASCAR-esque wall of logos, which was awful for different reasons.

Thus, Portier, and Persona before it, chose to identify users by email addresses. I talk a little bit about that at 9:05 in my PyCon 2013 talk on Persona: [https://www.youtube.com/watch?v=nJff23UdNAI#t=9m05](https://www.youtube.com/watch?v=nJff23UdNAI#t=9m05)

</comment></comment><comment><USER23> Emails are not unique, lots of companies assign employees emails that would later be used by another person.

<comment><USER24> That is an issue not spezific to this tool. It's an issue with all tools offering "Lost password" features. Nowadays everybody should be able to get personalized mail addresses.

</comment></comment><comment><USER25> How do you pronounce it?

<comment><USER26> Por-tee-ay

</comment></comment><comment><USER17> Are there any free public servers we can use for side-projects?

<comment><USER2> We're literally running this on a hobby-tier Heroku dyno, with free-level redis and smtp services and doing fine at the tens-of-requests-per-minute rate. So you should be able to host your own! :) Once we implement [https://github.com/portier/portier- broker/issues/88](https://github.com/portier/portier-broker/issues/88), it'll even be a 2-click process to get going.

We do intend to keep [https://broker.portier.io](https://broker.portier.io) online as a public service / reference implementation, but we don't have anyone on call or anything if it falls over. On the upside, the Broker is written in Rust, so it shouldn't segfault all that often. ;)</comment></comment>


Apple Maps on Browser - <AUTHOR>

Has anyone figured out a way to view Apple maps on the browser? <comment><USER2> I took a look at the network traffic between the iPhone simulator and their servers and it appears they're using a proprietary variant of protocol buffers to encode the data. As soon as somebody figures out how they tweaked the encoding, the rest should be relatively easy.</comment>


Camper bike - <AUTHOR> http://www.kevincyr.net/index.php?/project/camper-bike/

<comment><USER2> Here is another "Camper Bike" but with a different design. You could actually stay a night in it for $10.

<http://daviswiki.org/Human_Powered_Housing_Project>

</comment><comment><USER3> Even better is the camper kart <http://www.kevincyr.net/index.php?/ongoing/camper-kart/>

</comment><comment><USER4> Changing a tire looks like an ordeal.

<comment><USER5> he probably could use a standard car jack.

i'd imagine biking up hills would be the true ordeal.

<comment><USER6> Even going down hills would not be much fun... if you hit a curve with any speed at all, off the side of the road you go. Also, any good side winds look like they'd push the thing around.

</comment></comment></comment><comment><USER7> Creative, I like it (whether it's truly functional or not).

</comment><comment><USER8> Burning man will never be the same. Any hackers going, btw?

</comment><comment><USER9> No brakes?

<comment><USER10> Probably coaster brakes. Turn the pedals backward a bit, and it stops the wheel, as found on kids bikes and beach cruisers and the like.

There's also some sort of cable running down the center from the front to back...but I can't really determine what that's for. Unlikely to be gears, though.

</comment></comment><comment> onreact-com While this thing here is only a work of art there are many cargo bikes out there that can carry a substantial load, the Yuba can up to 300kg. <http://www.yubaride.com/>

<comment><USER11> Can't handle anything like 300kg, but tons of people here (in Holland) are running around with these:

<http://www.bakfiets.nl/modellen.php>

As well as oversized tricycles to move really heavy objects.

<comment> onreact-com Yeah, the classic. We have plenty of those around here (Berlin) as well but they're quite expensive (hand made!). Other cargo bikes get manufactured and are thus cheaper.

</comment></comment></comment><comment><USER12> It gives "tipping" a new meaning...

</comment><comment><USER13> I can't vote this up enough</comment>


California tests mental health app which tracks patients' usage of their phones - <AUTHOR> https://gizmodo.com/california-tests-mental-health-app-that-tracks-everythi-1835583585 <comment><USER2> > _California mental health officials have been in talks with two startups > about developing a digital system that identifies when a smartphone user is > about to have an emotional crisis, characterizing it as a "fire alarm,"_

This whole concept of predictive software for mental health (or otherwise) is a new level of disconcerting.

In an era where both of the following are true, we should not be pursuing these wide-spread predictive applications:

\- Inability (or simply not caring) of companies / agencies to properly secure their data.

\- Systemic inaccuracies present in an infantile field

We're struggling to hold companies accountable for the data they lose. Some of the biggest companies and agencies in the world are having data breaches (or inappropriate access to data, etc.) We are only just exploring how to identify and remove bias from predictive software. And yet, they want to roll this out?

> _But it's still unclear how effective an algorithm can be for someone at > their most distressed, and in the meantime, the distressed are providing a > tech company with its most desired asset—a wealth of deeply intimate data._

That paragraph, at least, sums up how I am feeling.

Noble goal, I think. Terrifying execution.</comment>


Animated 3D X-Wing in pure CSS and HTML - <AUTHOR> http://codepen.io/juliangarnier/pen/hzDAF/left

<comment><USER2> Ugly Z-buffer issues? Didn't look good at all. First thought was that they failed. Maybe it's on purpose, but it's still really ugly.

</comment><comment><USER3> 100% Nerd Vitamins, thank you for making my evening better.</comment>


Ruby on Rails: Secure Mass Assignment - <AUTHOR> http://stephensclafani.com/2010/01/04/ruby-on-rails-secure-mass-assignment/

<comment><USER2>
        # config/initializers/disable_mass_assignment.rb
        ActiveRecord::Base.send(:attr_accessible, nil)

        # app/models/some_model.rb
        class SomeModel < ActiveRecord::Base
          attr_accessible :whitelisted, :attributes
        end

</comment><comment><USER3> This post is nothing new but it's worth reading if you're a Rails dev because it highlights a uniquely Railsy security flaw, which is the default-allow accessibility of model attributes, which is made worse by the fact that ActiveRecord hides the schema (and therefore the attribute file) from the class definition where you override accessibility.

By default, all attributes should have been inaccessible to ActiveRecord::Base#new and ActiveRecord::Base#update. That was a design-level mistake.

<comment><USER4> Is it really Rails specific? I seem to remember Struts working the same way and most other reflection based frameworks working the same way.

The particular solution outlined in the OP is quite incomplete. We need a check not see just which attributes can be edited by a user, but which rows can be edited by a user. attr_accessible offers no protection there.

<comment><USER5> It's not Rails-specific that you need to protect your models with reasonable security logic. This particular flavor of "oops, not protected by default" is Rails-specific.

And Rails is highlighting the fact that "allowed by default" is convenient, while the post highlights the fact that "allowed by default" is insecure :-)

<comment><USER4> "This particular flavor of "oops, not protected by default" is Rails- specific."

Uhh...if it is in most other frameworks, as I claim, and you don't deny, then it is not Rails-specific.

<comment><USER5> When I say "this particular flavor of", I use that to distinguish between Rails and other frameworks. The protected attribute tags that Rails uses are not common to other frameworks.

</comment></comment></comment></comment></comment><comment><USER6> See

[http://blog.mhartl.com/2008/09/21/mass-assignment-in- rails-a...](http://blog.mhartl.com/2008/09/21/mass-assignment-in-rails- applications/)

and

[http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass- as...](http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment- problems-in-rails-applications/)

for a _much_ more detailed discussion of this issue.

</comment><comment><USER7> The black box test really drives home the point that this is a very discoverable and exploitable issue when not handled correctly.

</comment><comment><USER8> I've often felt for us at least that any "belongs_to" relationship should get pulled out of mass assignment by default. 95% of the time I imagine in the world, a belongs_to field on a child record is not going to want to be updated by some mass assignment, but is assigned instead by instantiation parent.children.new or manual assignment. Child.new(:parent=>parent)

Would this be a valid change to Rails. All belongs_to attributes are by default not accessible to mass assignment?

</comment><comment><USER9> Also checkout this screencast by Railcasts. It may show you how the vulnerability can be exploited a bit more clearly to those of you who are possibly thinking "how the hell can they pass more parameters than the ones I have in my form".

[http://railscasts.com/episodes/26-hackers-love-mass- assignme...](http://railscasts.com/episodes/26-hackers-love-mass-assignment)

</comment><comment><USER10> attr_protected / attr_accessible is the lamest workaround in rails. Tons of overhead and potential bugs just so you can have a one line controller.

Better idea: just set the attributes you want explicitly in the controller. Then your forms will never set data that you don't want it to.

</comment><comment><USER5> I haven't used it, but a quick Google search turns up this plugin, to require whitelisting mass-assignable attributes:

<http://github.com/ryanb/trusted-params>

That should fix this problem for apps that use the plugin.

<comment><USER6> In a related vein, I wrote <http://github.com/mhartl/find_mass_assignment> to find likely mass assignment vulnerabilities in Rails apps.</comment></comment>


Put a crontab database in the Name Service Switch - <AUTHOR>

My life would be a lot simpler if a crontab system database was added to the Name Service Switch. Then you could stick crontabs in LDAP or NIS. It wouldn't solve all distributed scheduling problems, but it would certainly help. <comment><USER2> Take a look at a few of these:

[https://github.com/Yelp/Tron](https://github.com/Yelp/Tron)

[https://github.com/airbnb/chronos](https://github.com/airbnb/chronos)</comment>


DuckDuckGo Expands Use of Apple Maps - <AUTHOR> https://spreadprivacy.com/duckduckgo-apple-mapkit-js-update/ <comment><USER3> This is cool to see, and I think should be a virtuous cycle. As I understand it, maps is the kind of thing where more usage really helps make the map better, and while DDG doesn't bring the scale of being the iphone's default map, it should be adding a non-trivial amount of traffic.

I've used Apple Maps as my primary map since it came out, and I've only gotten a wrong location one time in literally thousands of searches, and that was years ago. It wasn't really ready when it launched, but it has gotten consistently better over time. The UX is great, in many cases the satellite imagery is more up-to-date compared to Google, and it doesn't maul my battery to use. Not saying it's clearly better than Google, because it isn't, but for my usage it's more than "good enough," and I love to see Apple's privacy respecting products compete effectively with big G.

<comment><USER4> > _Not saying it's clearly better than Google_

If privacy is worth something to you, it's clearly better than Google.

I, too, use Apple as my primary map. In many cases, Apple Maps is better Google. The ones in which it's behind are more than made up for by Apple's values.

<comment><USER5> _If privacy is worth something to you, it's clearly better than Google._

Is it? Has everyone forgotten the Yelp tracking beacon? Good thing Apple relies on Yelp for business info and has pretty deep Yelp integration with the mobile app.

<comment><USER6> Apple have shown times and times again that they wouldn't let 3rd party do shady things into their own Maps app, that's the whole reason they got rid of Google Maps. That's a baseless accusation.

<comment><USER7> Apple has taken good stances on most privacy issues, but Apple Maps is poorly run.

The main failure is not having something akin to a Google Scout, whereby iOS users could submit info about businesses and streets that lack data. Apple instead hires a ton of contractors in Austin (and now India) to manually trace roads and guess business hours based on anonymized GPS traces.

Apple lacks the scale of Google's army of unpaid Google Scouts (though they could easily fix this) and is wasting time on minutia rather than task their staff/contractors with sourcing & importing higher quality data regularly. One example would be importing county shapefiles, Apple could easily vault ahead of Google Maps if they diffed their map against each of the thousands of county maps in the USA, and they would be the only one regularly doing this (OSM does this occasionally, but not often).

They could also scrape business data from each state and use that to produce more accurate & detailed business listings than Google, among many other low hanging fruit.

<comment><USER8> This is not 100% true, if you go to an existing business listing and scroll to the bottom there's a "report an issue" option. Apple has fixed my reported issues within a few days in the past.

In another sense I'm not sure why it should matter to the end user how many interns Apple hires to do things behind the scenes. I'm imagining that Apple is well aware of these shortcomings. Not only that I wonder if operational information observations like this quickly become outdated. i.e. it's all manual and terrible until somebody gets around to automating it.

<comment><USER7> These user reports take weeks to months to get triaged, making many rather useless.

<comment><USER9> They all have that problem.

My son's school is in a kafka-ish situation with Google where their listing is wrong and cannot be changed. People cannot write reviews, and data doesn't get updated.

98/100 times, updates to Apple or Google mapping products are done in hours or days. The 2/100, forget it.

<comment><USER7> Apple Maps has a deep queue for reports about map inaccuracies, your minimum wait time is a few days 98 times out of 100. This is fixable, but it requires even more staffing than Apple already has working on Apple Maps (which is most of the people they employ in Austin and India).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think of Apple Maps the same way I think of North Korea's missile program: I know it exists and it has continent-level accuracy.

<comment><USER11> I use it all the time. In Portland it is as good as GMaps is at navigating fastest route during heavy traffic. Which is to say, not perfect, but adequate. It has yet to take me to the wrong location.

<comment><USER5> Apple Maps is pretty awful in the Bay Area. My favorite recently was it's insistence that I make a left turn off of Van Ness. Left turns have largely been banned from Van Ness starting with the huge construction project, but the left turn Apple Maps was also demanding was also across a double yellow line where a left turn would've been illegal regardless of construction.

Yesterday I was trying to remember if this deli was on Howard or Folsom (and I forgot the exact name). The search results for 'deli' were basically everywhere on North America except for where I was (including across town). Searching for businesses with Apple Maps is nearly impossible, and the insistence upon installing the Yelp app to get more info is just infuriating.

Edit: Oh yeah and it can't find Grainger in Millbrae to save its life. Shit happens and business info is one of the hardest parts about mapping. Unfortunately Apple makes it damn near impossible to report problems to a real human.

Edit edit: My all time favorite though was asking Siri for directions to some club that I usually take BART to. I kept getting directions to a not that nearby and not that similarly named bail bondsman.

<comment><USER12> What is "Grainger in Millbrae?" Do you mean Grainger Industrial Supply in Burlingame? Because if you do, that's why it can't find them in Millbrae. :)

This is all anecdotal, which is kind of the issue, isn't it? I'm in the Bay Area, too, and I very rarely have any problems with Apple Maps. It isn't perfect, but it's absolutely not "pretty awful." I have no significant problems finding businesses with Apple Maps; I literally just typed "deli" and the first search suggestion that came up was "Delis - search nearby," and it, well, found delis nearby.

Problems due to long-term construction seem to be a weakness for it, but I've run into those issues with Google and Waze, too.

<comment><USER5> Sorry, yes, Burlingame. All the teeny peninsula towns tend to blend together to me, and Grainger shuttered its SF outpost. Apple Maps happily took me to the street behind the store where there is/was no entrance.

Even when I know the name I often have problems finding something in Apple Maps. Up in Marin, searching for "Apple Store" pulled up listings for the Apple Stores in the East Bay (the one in Corte Madera was significantly lower).

Or, if I'm looking for the specific address for the junk yard... for a while it would sort the results in seemingly random order. Right now it seems to at least be sorting by distance, but I think it default to heavily weighting towards what you were last looking at, which almost makes sense (but this seems to persist even if you move someplace else lending an utterly unpredictable feel to the results). This wouldn't be a huge problem but the distance is only shown for the top two results, and the city name is often truncated so chains will often be hard to distinguish from one another. Even better if I scroll up too far it backs out of the search itself and clears the search bar.

Edit: Oh yeah, and the deli was actually called a market (but I had also searched for market and only gotten results for Market Street).

</comment></comment></comment></comment></comment><comment><USER13> I live in Romania.

It depends on the country, but for search what really matters are the points of interest and Apple Maps in my country doesn't have any, whereas OSM and Google Maps are competing head to head.

Even for driving, the OSM apps available, while lower quality, are more reliable when I travel to Bulgaria for example. The penetration of Google Maps in Eastern Europe isn't great and Apple Maps isn't worth bothering with.

Anyway, I wonder why DuckDuckGo is choosing Apple Maps. It makes no sense IMO from a user experience perspective.

Remember that if you're in California or New York, those are the primary markets targeted by all tech companies, so your experience with Apple Maps is not representative of the rest of the world.

In my travels OSM fares quite well in terms of its POS database and is the only one that can compete with Google Maps in that regard.

<comment><USER14> In Germany I use OSM exclusively for navigating and it is very good. Maybe not quite on the level of Google maps concerning things like live traffic, but certainly good enough to reach your goal and then some. Love the project and would have liked to have DuckDuckGo support it instead of using proprietary data.

Google Maps has shown what can happen if you use it for anything business critical.

edit: Sadly OSM doesn't yet have services like forward adress search (might be too expensive to provide). It would enable many businesses to use it for adress comparison to clean up their own data for example. I think that could put OSM on the map so to speak.

<comment><USER15> Any tips to switching, as in which app etc?

<comment><USER16> Currently my favorite OSM-based map and navigation app on Android is this one:

[https://play.google.com/store/apps/details?id=com.github.axe...](https://play.google.com/store/apps/details?id=com.github.axet.maps)

Fantastic non-cluttered UI and offline maps that don't eat up my mobile data.

</comment></comment></comment></comment><comment><USER17> > For example, try a query such as "coffee shops" and zoom in on the map to > refine your search.

There is exactly one result for "coffee shops" in San Francisco. The tech and privacy initiatives sound good, but unfortunately the data needs work to pass basic sanity checks.

[https://duckduckgo.com/?q=coffee+shops&ia=web&iaxm=maps&stri...](https://duckduckgo.com/?q=coffee+shops&ia=web&iaxm=maps&strict_bbox=1&bbox=37.891217720838085%2C-122.61477652810956%2C37.54794931917816%2C-122.22476187967206)

 _Edit:_

Searching for "coffee shop" (singular) shows many more results. Perhaps the blog post should use that as its example.

[https://duckduckgo.com/?q=coffee+shop&ia=web&iaxm=maps&stric...](https://duckduckgo.com/?q=coffee+shop&ia=web&iaxm=maps&strict_bbox=0&bbox=37.891217720838085%2C-122.61477652810956%2C37.54794931917816%2C-122.22476187967206)

<comment><USER18> "coffee shop" on the other hand yields 20 results. I agree that some support for fuzzy search is needed, but there is a reasonable amount of data there.

<comment><USER19> I hate when searches parse like that. Ideally coffee shop, coffee shops, coffee, cafe, espresso, etc. should all give me the same exact results: 100% of the stores in the area that sell coffee.

I don't think there's a single piece of mapping software that doesn't suck hard in some way. It's pretty annoying how google maps shows you x number of results zoomed out, y zoomed in, and z with the map frame moved half a block to the left.

Just show me everything. Search the entire city. Flood my map. Let me do the vetting, that's what I came to maps to do anyway.

<comment><USER20> where the sets of y and z might not even overlap

</comment></comment></comment></comment><comment><USER21> I'm still so perplexed why they didn't go with OpenStreetMaps which are not only floss but also infinitely better. Apple maps are absolutely useless in my region, while osm has always been at least toretable experience wherever I went in the world. Actually OSM is often better than google maps - the only thing it really lacks is better user review ecosystem.

<comment><USER22> OSM doesn't have great APIs, you end up having to have GIS experts on your team in order to use it in your product. source:someone who tried to use OSM stuff in a IoT fleet tracking system. Even Bing maps is better than OSM

</comment></comment><comment><USER23> One thing thing that I love about Apple Maps is that they have the name of every river, stream, creek, and ditch if you zoom in far enough. I can't find this information in Google Maps (maybe there's a way to find it, but zooming in doesn't do it). This was exceptionally helpful on my recent trip to Corsica, where I was searching for a specific stream with a genetically significant population of native trout. Apple Maps made finding it a breeze, and even had the name of all the tributaries that flow into it, which were essentially just trickles.

I subscribe to OnX Maps for most of my fishing and hunting research in the United States, but Apple Maps is a pretty great free option.

<comment><USER24> I noticed that too. I like osmand (openstreetmap) for the same reason. It's like google maps decided to practice more minimalism than apple did.

</comment></comment><comment><USER25> Very recently Qwant launched their Maps beta that is based on OpenStreetMaps. Discussion here: [https://news.ycombinator.com/item?id=20304720](https://news.ycombinator.com/item?id=20304720)

Sidenote: I use duckduckgo for Safari search. I saw an ad on twitter for something that I searched in a private window of Safari. Not sure whose fault that is, but it really disturbed me.

<comment><USER26> Interesting, but certainly not usable yet.

My "shorthand" address missed my house by about 5 miles, and the precise mailing address (like I'd use on an envelope) brought up a steakhouse about 8 miles away. My company name dropped me in Saudi Arabia, and the exact address dropped me in New York (I'm in Minnesota).

It's the same issue I have with Open Street Maps, if you're not in SF/NYC/Chi they're damn near useless. OSM at least gets me to the correct block, although it's still off by about 500 feet.

Edit: Oh boy, this is like Cuil again. Grand Canyon brings up a mall in Israel, Burj Khalifa is somehow underwater, Eifel Tower brings up Las Vegas, Roman Colosseum some residential street in Houston. Statue of Liberty and Taj Mahal are the only two landmarks I tried it got correct. I get it's a "beta", but ouch. If you can't get addresses or major landmarks correct this shouldn't even be public facing yet.

<comment><USER27> > It's the same issue I have with Open Street Maps, if you're not in > SF/NYC/Chi they're damn near useless

OSM long-time mapper here. SF and NYC are not our strong points. Europe is our strong point.

<comment><USER28> I think for the Americans, contributing data feels too much like work which would violate their idea of letting the free market do its thing. Where would the world go if people just did things for free? Same as with self check-outs, you ain't gonna do that work yourself if you're not getting a discount!

<comment><USER25> To be fair, contributing to OSM _is_ more work in America. You have to drive every where and you technically aren't allowed to use other maps as a source (I don't know if that's ever followed though)

</comment></comment></comment></comment></comment><comment><USER29> Why support proprietary Apple Maps instead of Open Street Map? Is the data a lot more precise? Is the viewer smoother?

Is it just another step towards aligning with Apple for an eventual buyout/search engine standard?

That said: If privacy is the only concern Apple seems to be a pretty good ally, as the only major player with a significant interest in it.

<comment><USER30> > Is the data a lot more precise?

Perhaps in Apple's own backyard. In the Netherlands it's laughably bad. Cycle tracks? Mostly missing (in a country that has a huge cycling infrastructure). The map doesn't even have building outlines.

Google Maps is slightly better, but mostly because of the more extensive mapping of points-of-interest; because business owners add their own information with an almost religious zeal.

Bing interestingly enough uses OpenStreetMap (and properly attributes its usage) to gain access to the municipally contributed building outlines OpenStreetMap can use due to its permissive licence. The roads are their own though, and they are quite inaccurate at the lower end of the road hierarchy.

OpenStreetMap is probably the most complete map here in the Netherlands (disclaimer: I contribute to OpenStreetMap).

DuckDuckGo using Apple Maps instead of OpenStreetMap is a really weird choice for many countries, but perhaps it works better in the US?

<comment><USER31> _Perhaps in Apple 's own backyard. In the Netherlands it's laughably bad. Cycle tracks? Mostly missing (in a country that has a huge cycling infrastructure). The map doesn't even have building outlines._

Apple uses Tom Tom data. We never had serious problems with car navigation in Germany where we lived before and in The Netherlands.

Bike navigation is indeed bad, but it is also bad with Google Maps once you cycle in nature (outside cities). Then nothing beats a good Garmin GPS with paid maps (e.g. Topo Germany Pro and Topo Benelux), which do not only contain smaller cycling roads, unpaved roads, etc. but typically also contain paths recommended by national cycling associations (ActiveRouting). Unfortunately, it seems they are not updating maps frequently anymore, I guess it's a small market. I hope that OpenStreetMap continues to pick up the slack.

<comment><USER5> _Apple uses Tom Tom data. We never had serious problems with car navigation in Germany where we lived before and in The Netherlands._

The car navigation in Germany was fine with Apple Maps for me (although I only used it for one trip), but the public transit info was mostly missing.

</comment></comment></comment></comment><comment><USER32> It's a shame they didn't invest in OpenStreetMap.

Their values would align significantly, and OpenStreetMap has excellent road and path coverage in my experience (though struggles with Points of Interest).

<comment><USER33> They do invest in improving the project [https://github.com/osmlab/appledata/](https://github.com/osmlab/appledata/)

</comment></comment><comment><USER34> Not sure if it's a lot to ask, but I'll consider it a killer app if DDG can let user opt which map source to choose from? e.g. Some may prefer Google, and some may prefer openstreetmap?

Just a thought.

<comment><USER35> Pretty sure you can forget about DDG supporting Google. The whole point of DDG is privacy. Not sure how they could use Google and still keep your location information private?

<comment><USER26> They do have the !g option in their search though. If you aren't happy with the results, append your string with !g and it will send you to google results. You do lose the privacy layer though.

From a purely privacy standpoint this isn't much different.

There are a ton of other bang options here:

[https://duckduckgo.com/bang](https://duckduckgo.com/bang)?

<comment><USER36> I was under the impression that a !g search was somehow anonymized. Was that just wishful thinking?

<comment><USER37> It surprises me how many people think this. I'm not sure where it comes from. All it does is redirect you to Google.

So `!g hello world` just redirects to `[https://www.google.com/search?hl=en&q=hello%20world`](https://www.google.com/search?hl=en&q=hello%20world`)

I'm can't see how that could possibly be more anonymized then just going to google.com yourself.

<comment><USER28> > I'm not sure where it comes from

I guess because it makes zero sense the way it is. What's the point? Might as well have gone to Google directly. And what DDG user would ever want to be redirected to Google? They're using DDG for a reason (and for 99%, it isn't the search engine quality). It just makes no sense.

> I'm [sic] can't see how that could possibly be more anonymized then [sic] > just going to google.com yourself.

DDG could proxy the traffic the way startpage does.

<comment><USER38> > I guess because it makes zero sense the way it is. What's the point?

There are over 10.000 different bang shortcuts. They're very valuable for several reasons, especially if you make DDG your default search engine. "Denmark !w" will take you to Denmark's Wikipedia page, saving you the time and bandwidth it would take to click on the link through the DDG/Google result. Similarly, you can search "hello !gtda"; and sure, for short translation queries then you could also just type "hello danish" in Google, but try doing that with an entire paragraph. You could also search "duckduckgo !gandi" to see available duckduckgo domains on Gandi (or whichever domain registrar you prefer).

> And what DDG user would ever want to be redirected to Google? They're using > DDG for a reason (and for 99%, it isn't the search engine quality). It just > makes no sense.

DDG users aren't (or at least they shouldn't) append !g to all their searches.. it should only be used as a last resort (and even then they should still be using !s instead of !g). DDG's primary selling point is privacy, but even if they were just as evil as Google (and there were no other privacy- friendly alternative available) then I'd still be using DDG as my default search engine thanks to the bang shortcuts.

> DDG could proxy the traffic the way startpage does.

That would defeat the purpose of the bang shortcuts, which is to take you to the search results on other sites. Besides, they already offer this through !s.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> I was a big defender of Apple Maps, largely because I almost never saw any problems with the data. Then I moved into an apartment complex in which Apple had the driveway in the wrong place.

I've moved since, so I'll spell it out: [https://duckduckgo.com/?q=5940+Arapaho+Rd%2C+75248&t=osx&ia=...](https://duckduckgo.com/?q=5940+Arapaho+Rd%2C+75248&t=osx&ia=maps&iaxm=maps)

Apple Maps believes that the driveways are to the south and east, but in fact the front driveway--the main entrance--is to the north, and there is no direct passage from the east. So every set of directions to or from those apartments begins or ends incorrectly. When leaving, I just have to guess whether I should turn east on Arapaho to catch up to where Maps thinks I should have ended up on Preston to start out, or whether it will send me west on Arapaho once it realizes I'm already most of a block in that direction from Preston. It added a minute or two to every trip, and delivery people would fail to find my apartment unless I specifically said "don't use Apple Maps." So I started saying that to everyone, all the time.

Apple's commitment to privacy means that they deliberately don't track the beginning or ending of any trip, but that's precisely the bits they needed to track to see that their routing was completely and totally wrong. So the problem will apparently never be fixed, at least until an Apple employee happens to want to visit a friend who lives in the Enclave at Prestonwood and realizes they can't get there.

So I've switched to Google Maps, and I _loathe_ the lack of privacy, but I love the sharing option, so I guess I'm staying, even though I live elsewhere now.

<comment><USER40> > So the problem will apparently never be fixed, at least until an Apple > employee happens to want to visit a friend who lives in the Enclave at > Prestonwood and realizes they can't get there.

Or you can report the issue yourself in-app?

<comment><USER39> I haven't figured out how, but since I've gone to the trouble to complain in public, I should dig in and see if I can.

</comment></comment></comment><comment><USER41> Tangentially, I noticed that when I start typing a word in my Chrome URL input field, it started to privilege Google searches instead of websites I normally visit.

It is very annoying to type _" n <enter>"_ and it goes on to search any query starting with _" n"_ that I happened to have searched in the past instead of going to HN as it was the case for the last several years.

It is happening now with all my usual "shortcuts".

Chrome now is less a browser and more a Google widget.

I wonder if I change the default search engine to DuckDuckGo it would still be the case.

<comment><USER42> This is a chrome flag you can toggle: omnibox-drive-suggestions

Alternatively, use Firefox.

<comment><USER43> Firefox (at least for me) does the same thing and pushes search results before websites. I have to arrow or tab down 4-5 selections before I get to the first website result in the url/search bar.

<comment><USER44> Options->Search->untick "Show search suggestions ahead of browsing history in address bar results"

</comment></comment></comment></comment><comment><USER45> I thought people complaining in the comments were just being critical, but I clicked the "coffee shops" example search in the post - I'm in Hong Kong - <USER2> it showed me only 2 results:

One coffee shop in Hong Kong and one on the other side of the Pearl River Delta in Macau. That's pretty bad. Screenshot here: [https://twitter.com/larrysalibra/status/1151182624108318720?...](https://twitter.com/larrysalibra/status/1151182624108318720?s=21)

<comment><USER46> That looks more like it has to do with query detection than the lack of results. It clearly didn't understand the Hong Kong part, which is the main issue.

<comment><USER47> are people using apple maps completely different than google maps? 90% of the time I use map for searching places, shops etc. If apple maps is not excelling at that, why do people use it?

<comment><USER48> I use it for transit times to a handful of places in the Bay Area I regularly visit, and it works well for that. One glaring search problem I have though is for a contact, it will only show the result for the first two letters of the name and then when I continue typing it shows anything that's not the contact's address. This is even despite getting directions to the contact several times.

</comment></comment></comment></comment><comment><USER49> Google maps recently made nice improvements when search history is turned off. It used to nag constantly to turn search history on and now it no longer does that and saves searches on my device with a clear setting to turn it off.

The ability to limit the duration of search history is another nice feature.

I feel less inclined to use Apple maps these days.

</comment><comment><USER50> In my region (Germany) Apple Maps are not very helpful, compared to Openstreetmap they are incomplete and/or years back. I absoluty can't see why they chose to use them.

<comment><USER51> Probably comes down to API access and/or pricing. Privacy focused mapping services are quite rare. I'd do the same in their place.

<comment><USER50> I see this as an ill-informed decision, from a viewpoint of someone living in a big western city. Results are so error-prone, it's basically useless in 99% of the locations in the world. Even Google has so much wrong information gathered from out-of-date websites and public registers. Even in central Berlin.

<comment><USER51> How do the results compare to openstreetmaps?

</comment></comment></comment></comment><comment><USER52> For those interested in the differences between the maps providers, Justin OBeirne has a set of absolutely wonderful blog posts on them. I look forward to the next one.

[https://www.justinobeirne.com/](https://www.justinobeirne.com/)

</comment><comment><USER53> About a year ago Apple maps helped me find the entrance to an airport when Google maps was absolutely insisting the only entrance was something extremely wrong. Outside of waving someone down on a motorway to get directions (yes I was really dumb and walked alongside a major road to an airport, had a lot of free time...) or paying an absolute ton to get a taxi to find me and take me to the correct entrance I was probably going to miss my flight home if I didn't think to try Apple maps.

Anyways, it was a really good lesson in the value of checking multiple sources of truth, which gets harder and harder to remember as Google penetrate further into our lives.

</comment><comment><USER54> I love Google Maps a lot but it's becoming very bloated. I would love to use Apple Maps, but I just don't trust it to be reliable and comprehensive enough on the basic features I need.

</comment><comment><USER55> Talking about maps, is anyone has a "Direction API" cheaper than Google maps? Google maps is excessively expensive ( 5USD per 1000 queries [1] ) for my side project. I'm trying to get an estimate time (driving and public transport) between 2 places in large city.

Any suggestions welcome!

[1] [https://developers.google.com/maps/billing/understanding- cos...](https://developers.google.com/maps/billing/understanding-cost-of- use#directions)

</comment><comment><USER56> Does anyone else see Apple buying DDG in the near future?

<comment><USER3> Probably not. Apple is cautious about acquisitions and doesn't generally buy things that have a consumer brand, they don't really do advertising supported products, and they're also mindful of anti-trust. My guess is that in the search space they see DDG as a useful partner, much like they see Yelp, but they're not trying to expand into that business so an acquisition wouldn't do much for them.

</comment></comment><comment><USER57> I'm glad they are expanding usage of Apple maps. I hope that people will start using it more. In its older state it was a pain to search for things. I wonder if they will expand to using the routing so you don't need to leave for directions.

</comment><comment><USER58> What I'd want is Apple Maps and Here Maps to enter into a technology/business collaboration agreement.

Here Maps have excellent tech and offline packaging and Apple has the reach.

Put all this together with DDG, we have a winner.

<comment><USER59> I absolutely agree! I'm kinda disappointed that nobody else talked about Here Maps in the comments. Nobody use it?

</comment></comment><comment><USER60> It would be so cool if they would add an option to select the preferred map provider. Obviously, preferences differ and for other features (e.g. directions source) they already have such options.

</comment><comment><USER61> I love Apple Maps' Dark Mode.

<comment><USER62> I think the true hero of the story is whoever made dark mode for maps a thing.

</comment></comment><comment><USER63> IMHO, one of the best thing in Apple Maps is that they localized the street names to those one familiar to locals. I live in Bangkok, and Google Maps always say something like "Road No. 3" (which was not wrong, but nobody here calls it that) whereas Apple Maps correctly identify them as "Sukhumvit Road".

</comment><comment><USER64> It seems to still have the dropdown to select which mapping service, but it doesn't change when you use it, and Apple maps isn't on the list. But the map it shows me does have the Apple logo in the corner.

<comment><USER65> Are you talking about the drop down right under the "directions" button? I believe that's for navigation only. ie. if you choose "google", and click the directions button, it opens google maps in a new tab, and if you change it to bing, it opens bing maps in a new tab.

</comment></comment><comment><USER66> My experience with Apple Maps in California has been great. They had my home address wrong for a bit, so I submitted a correction and the map updated in two days from my request. That was the only issue I ever had.

</comment><comment><USER67> Great..adamant DDG user!

One thing I look forward to is the ability to get the distance from X to Y in DDG.

I'm not sure if this something many do as well but personally it's probably one of my top ten things I Routinely search(Weekly) for.

</comment><comment><USER68> Took DDG Enhanced Maps for a test drive: [https://www.youtube.com/watch?v=_EnmdbzdOWI](https://www.youtube.com/watch?v=_EnmdbzdOWI)

</comment><comment><USER69> I would use Apple Maps significantly more if it allowed me to download maps for offline navigation, like I can with Google Maps.

</comment><comment><USER52> Why does neither maps.duckduckgo.com or duckduckgo.com/maps take me to the maps interface?

Thats the number one way I access google maps.

<comment><USER70> Likewise. Note ddg.co works too, saves lots of typing.

<comment><USER52> My brain doesn't do .co. No matter how I try. Duck.com works for me though.

<comment><USER71> I hadn't caught up with that. Duck.com is a relatively recent development: [https://edgy.app/duckduckgo-search-engine-duck- com](https://edgy.app/duckduckgo-search-engine-duck-com)

None of the articles I found explain how DuckDuckGo managed to convince Google to give it to them.

</comment></comment></comment></comment><comment><USER72> Unlike Apple Maps, Google Maps are "powered" by Android devices

</comment><comment><USER73> Unfortunatelly Apple Maps are irrelevant outside the US though.

</comment><comment><USER74> What service did DDG use before Apple Maps?

<comment><USER27> Mapbox.

</comment></comment><comment><USER75> DuckDuckGo making itself less useful then.</comment>


Translation from Haskell to JavaScript (Introduction to monads)  - <AUTHOR> http://blog.jcoglan.com/2011/03/05/translation-from-haskell-to-javascript-of-selected-portions-of-the-best-introduction-to-monads-ive-ever-read/

<comment><USER2> In the author's own words: _I should stress that this is very hand-waving imprecise definition..._

I don't want to be too hard on this guy, but this is a bad article. Sorry. This article uses incorrect terms to define things. It also doesn't explain or illustrate why monads are useful. You cannot read this article and learn anything about monads.

It's not useful on a theoretics level, and it's also not useful on a practical Haskell level. I don't think the author understands what he is writing about. (Don't get me wrong, by the way – it's totally fine to write about something you don't understand in order to learn more about it. But maybe don't publish it prominently on your website and peddle it out to newbies as learning material.)

The overabundance of bad monad articles is making it harder for Haskell newbies to learn. There are many good, free resources for learning about Haskell, such as _Real World Haskell_. This is not one of them.

 _Think of a monad as a spacesuite full of nuclear waste in the ocean next to a container of apples. now, you can't put oranges in the space suite or the nucelar waste falls in the ocean, BUT the apples are carried around anyway, and you just take what you need._ \- Dons, talking about bad monad explanations

edit: also, if you're really interested in seeing what a Haskell monad looks like literally translated into JavaScript, I wrote a comment here on HN a year ago with some code: <http://news.ycombinator.com/item?id=1275860> I could leave better comments if I wrote it again today, but the code is correct and works.

<comment><USER3> Hmm! That's funny, I thought I was "getting" monads better after reading this article (as someone who doesn't already have a firm grasp of monads, of course).

You see, I already sensed that monads:

\- were a way that you could sort of simulate side effects using pure functions

\- had to do with the type signatures of functions

What I gleaned from the article is that monads:

\- have to do with making functions composable

\- work by way of the abstractions bind and unit in order to make type signatures match

Did the article harm my (lack of) understanding of monads?

<comment><USER4> Monads basically let you add an extra calculation to your functions. Why would you want to do that? Mainly so that you don't have to do it manually. Think of it as tacking an extra calculation onto the side of each function that operates in the monad.

For a "state" monad, that calculation is maintaining/passing the state. For a "logging" monad, that calculation is maintaining the log. For an "error handling monad", that calculation is checking for and propagating errors.

<comment><USER3> I know lisp better than Haskell, and so I'm more familiar with macros than with monads. From what you describe, it seems to me that the use cases for monads and macros have some overlap.

Take the OP's example for the Writer monad, in which several functions needed to return a debug string "<function name> was called" in addition to their main return value. If I had these two functions+:

      (def sine (x)
        [(Math.sin x) "sine was called"])

      (def cube (x)
        [(* x x x) "cube was called"])

I might write a macro like the following (rather than a monad) to abstract away their common pattern:

      (mac defWriter (name parms body...)
        `(def ,name ,parms
           [,@body (+ ,name " was called.")]))

And then each function's definition could be written more concisely:

      (defWriter sine (x)
        (Math.sin x))

      (defWriter cube (x)
        (* x x x))

\---

\+ Forgive me for indulging in the syntactic sugar from my own lisp->javascript project in these examples, but since we're dealing in JavaScript I couldn't resist. <https://github.com/evanrmurphy/lava-script>

</comment></comment></comment></comment><comment><USER5> Anyone else disappointed that this was not about machine translation of Haskell to Javascript, with some sort of DOM monad?

While Haskell -> Javascript has been done before, all the examples seem toys without a rich integration into the browser.</comment>


Government debt swells as choices get harder - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?file=/c/a/2009/05/24/MN2B17PDPL.DTL <comment><USER2> _The United States spends $2.5 trillion a year on health care, more than any other rich nation, and yet has poorer outcomes. About $700 billion is wasted each year._

The reason is simple: Artificial controls on supply and demand of medical professionals: <http://www.ama-assn.org/amednews/2008/06/23/prsb0623.htm>

I can't count the number of friends I have had who applied to medical school and were denied entry due to insufficient seats. There are vastly more individuals qualified to be doctors, many I would much prefer to have as doctors than I have had in the past, but with these artificial limits on supply - governed by the AMA itself - there will always be a shortage of medical care and high medical care costs.

Furthermore, the healthcare industry lobbies congress to prevent individuals for caring for their own health. We cannot for example buy our own insulin without first getting a prescription from a doctor. We cannot get our own blood tests or request our own CAT scans. We are forced, by law, to visit a doctor before we can manage our own health.

As long as doctors are the gatekeepers to health and the supply of doctors is limited by doctors themselves, there will continue to be healthcare problems in the United States.

Our society has pitted the doctor in a competitive role against the patient through litigious means and pharmaceutical industry pressure on doctors to overprescribe unnecessary medications.

It's a horrible situation, but the solution isn't difficult to implement for anyone except the medical industry itself. They don't want to lose the power and control they have over every single life in America.

Visit most countries outside the U.S., Canada, and the UK and you can walk into nearly any pharmacy and purchase the drugs you need to survive, cure disease, and prevent pregnancy for a tiny fraction of the cost Americans pay and without the time delay of a doctor's appointment or the added cost of the doctor's visit itself. And healthcare for the average citizen is higher in these countries. Infant mortality is lower and people live longer.

<comment><USER3> We pay a fraction of the cost Americans for drugs because our governments aren't as owned by the pharmaceutical companies as the US government is. They're called price controls and they work pretty well, maybe someday the US will wake up to that fact.

And of course, blaming the AMA and doctors is another great diversion. The same professional association exists in Canada and other countries, yet our health care expenditures are under control. Like price controls on drugs, it is the kowtowing to free-market ideology over practical policies that work that gets Americans a shitter health care product for nearly twice the cost.

<comment><USER4> _"The same professional association exists in Canada and other countries, yet our health care expenditures are under control."_

Many times, the costs are not under control, they are hidden. I come from Europe, and in my homecountry the AMA-like lobby is powerful too. The reason why the health care expenditure seems to be under control is that health care is subsidized by the state. You pay for it with the highest sales tax in Europe. No free lunch, right?

<comment><USER3> Statistics on healthcare expenditures as a percentage of GDP are freely available around the net. Have a look. The US spends _substantially_ more than European countries and gets worse results.

If you add up what you pay for healthcare in taxes, and what the average American spends in taxes and private insurance, you'll find you spend far less. Your high VAT is likely needed because of any other number of government programs not available in the US.

<comment><USER4> I am aware that the U.S. spends way too much money in health care and gets less than brilliant results. I will never understand how that is possible...

</comment></comment></comment></comment></comment><comment><USER5> Not a problem. Lets just pass 1 more stimulus plan (to make it a trifecta) and then implement national health care. Because we all know the best way to lower prices is increase demand.

No doubt this problem is going to catch the country completely by surprise in the next 3-5 years. Paul Krugman will be shocked, just shocked, that the government is out of money.

<comment><USER6> In the immortal words of Monty Python during the killer rabbit incident: "run away!"

I blame myself as a partial culprit.

Boy was I a sucker. Even though I am an independent, I have picked a party to vote for based on which one I thought would keep spending under control. I used logic, reason, historical trends, etc.

Boy was I a sucker.

Seems like each side is playing "who can run the biggest debt up" game. One bunch takes it to new levels, and the next bunch tries to outdo the first. Not only is the slope of the equation bad, the first derivative is bad too.

I honestly don't see a political way out of this. For the first time, I wrote a letter to my senator and asked him to do what he could about spending. Don't make a scene, I said, and don't play politics with this. Just try to do the right thing.

In reply I got a form letter with a political speech in there about how he's such a great guy for voting for such great bills.

sigh

<comment><USER7> As a Californian I think there is a political way out. Calfiornia has gone down the road that the U.S. is headed down so you can sort of see the results.

Basically what has happened here is that conservatives who believed in small government lost out to liberals who promised the government would solve everything. Those conservatives then becamse "social conservatives" and started focusing on a bunch of hedge issues while promising to spend as much as the liberals (which is basically where the U.S. is now). Now we're out of money and those "social conservatives" are now turning back into "fiscal conservatives" because the public has finally started to realize spending like there's no tomorrow doesn't work.

For the record I think there's one more step here where liberals start to become more fiscally conservative and focus on ideals that don't cost anything to change like gun control. Think Clinton era liberalism. But that's just my opinion.

So really the political answer to the problems the U.S. now has is to get into enough financial trouble to give political cover to those politicians who would propose spending cuts.

</comment></comment></comment><comment><USER8> Obama should call Castro for tips on running a health care system on a shoestring. Just kidding, sort of.

</comment><comment><USER9> It's probably worth noting that the US also currently has the highest GDP of any country in history. While our debt is catastrophically high, we also produce more per person than any nation our size.

<comment><USER10> It's difficult to judge. The US has the highest GDP, but it's also the largest western country in terms of population, which makes direct comparison difficult.

It does not have the highest GDP per capita (see [http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28nom...](http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28nominal%29_per_capita) and [http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28PPP...](http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28PPP%29_per_capita)).

<comment><USER11> The only country above the US that isn't an oil exporter is Luxembourg, which has a population about %0.1 of the US-- its basically a single, medium/small city. I bet if Beverly Hills became its own country, the per capita GDP would also be impressive!

</comment></comment></comment><comment><USER3> The solution is marvellously simple:

"But the larger problem, as in California, is that the public also recoils from spending cuts and tax increases"

The American public needs to stop acting like a bunch of petulant, whiny children and start paying up.</comment>


In Praise of Theory in Design Research: How Levi-Strauss Redefined Workflow - <AUTHOR> https://www.epicpeople.org/theory-in-design-research/ <comment><USER3> "It was clear that our research participants were not using and not seeking out specialized tools tailored to accomplish their specific goals. Why?"

While the Levi-Strauss explanation is attractive, there are other factors as well. The author seem to think that a kludge of things such as email, ms word, and screenshots is an inferior workflow, but it has virtues as well. Those tools are _stable_ and _reliable_ and have been around for 20 years, and can be expected to be around for 20 more. Nothing about them is going to fundamentally change, and the user can expect that everything about them is controllable by the user, and they they'll appear on any new platform that might emerge (smart phone, tablet) essentially unchanged.

Contrast this with something that the author sees as a better solution, say, Instapaper. It began as a paid app, then it was free but with a Pro version, then it was subscription-based... the whole situation just seems volatile - <USER2> could disappear tomorrow, and it stores the data god-only-knows-where. If you happened to go with Readability or Evernote Clearly then now you're back to square one and have to figure this stupid crap out all over again.

There are a lots of users who value stability and reliability over small efficiency gains, and who don't enjoy spending time navigating ever-changing marketplaces.

<comment> moz-ur Author here. Perhaps we could be clearer in the piece about this, but there is no value judgement attached to our participants' workflows. On the contrary, we often marveled at how resourceful and clever many of our participants were in solving their tasks with technology.

<comment><USER4> Good to be talking to you. Thanks for intresting post. I am wondering if you have studied "juggad" philosophy in india. We practice bricoleurs in every sphere of life.

<comment> moz-ur I have read about juggad! But I haven't studied it closely so my knowledge of the details is limited.

<comment><USER4> thanks for reply . you might want to read this [https://gagandeep.org/2016/06/02/bricolage-jugaad-and- indian...](https://gagandeep.org/2016/06/02/bricolage-jugaad-and-indianness- part-1/)

</comment></comment></comment></comment></comment><comment><USER5> I think this is pretty insightful.

I have some recent experience deploying web-based administrative tools in my organization, which are meant to replace and supersede legacy, often informal, workflows.

Adoption rates are low and frustration among users is high, and my efforts at understanding this has focused on missing elements in the new workflows -- it seemed likely that, in formalizing the workflow in order to implement it computationally, we missed something, or got the order wrong. The unexamined assumption here is that there exists a correct, usable formal workflow, and that our task is just to find it and code it up, and then users will engage and frustration will recede.

But, as the article suggests, this may not be the case. If users are frustrated by the inability to use familiar tools, and to comprehend and execute the sub-parts of the workflow, then no "all-up" integrated workflow will ever feel right to them.

Somewhat embarrassingly, the "bricolage" approach also reflects the Unix philosophy, of which I am very fond -- users should be given a suite of powerful, comprehensible tools with narrow and very clear operational scopes, out of which they should build their own solutions.

<comment><USER6> I can't speak for your work, but in my experience most web-based administrative tools are often poorly implemented by the company using them, no matter how good the design. Quite often they're designed for corporate efficiency and not worker usability (ex: This framework has a shitty interface but generates nice looking reports! We're going with that one!), leading to frustration to those on the ground.

A good example is my company's Mantis ticket usage. There's nothing wrong with Mantis, but if I file a ticket odds are it will never get looked at for hours or days, whereas if I walk over to our DevOps team and make the request person-to-person it will often get addressed immediately. It's also worth noting that it's less effort to just have a conversation with someone vs filling out a Mantis ticket which then has to be filed/processed/marked as done, etc. The ticketing system actually adds unnecessary overhead in our context.

If all formal workflows were as reliable as, say, Amazon shopping and customer service, I think we'd see mass adoption after some initial resistance. I have no knowledge of the organization you work for, but I'd look for problems in execution before seriously questioning the design. Most corporate leadership types consider (wrongly IMO) infrastructure to be a cost center, and that attitude tends to trickle down no matter how good the design.

</comment></comment><comment><USER7> Very interesting insight.

I wish we made more allowance for bricolage in software. There are some great systems that enable bricolage, like Lisp or Unix or Emacs or Forth or Excel. They are toolboxes that you can use to cobble together some solution, perhaps not the best engineering solution, but it's quick and solves the problem.

Today, it seems, bricolage is out of fashion. All applications (and all devices in fact) must be made to be "perfect" and "easy to use", not to be combined and remixed as pieces of some "erector set".

<comment><USER8> I would add OSX Automator to your list. Is there anything similar fir Windows, btw?

<comment><USER9> There's third party tools that are at least similar. AutoIt and AutoHotkey are two that are popular.

To a significant extent they expose built in apis to a basic style language. There's various programming language libraries that do similar for other languages.

</comment></comment></comment><comment><USER4> In India we call bricoleurs as "juggad" and people have overused this idea and made it excuse for not thinking through. Championing this idea is a slippery slope

</comment><comment><USER10> Edit: My bad. More coffee, less impulse. Apology.

 _This (the OP) may be insightful, but my first reaction is within the context of my ceasing to purchase Levi-Strauss products, because: First and primarily, they started wearing out very quickly -- I 'm hardly the only one to have noticed this; and secondly, their unit size variations went way out of control -- e.g. taking 10 or more identical units into a dressing room, to find 3 or 4 that actually fit well, or at all.

Their office processes may have developed to some super-natural level. But I'm still not buying their actual products.

I mention this, because I run across it repeatedly, these days. All sort of internal "efficiencies and improvements", but no corresponding improvement in the actual product.

Towards the more dark pattern end, materials scientists and engineers closing in a particular lifespan to maximize revenue. It may be a very sophisticated process, but as the consumer, it's not doing me any good -- as I see it._

<comment><AUTHOR> The author was referring to Claude Lévi-Strauss, a french anthropologist: [https://en.wikipedia.org/wiki/Claude_L%C3%A9vi- Strauss](https://en.wikipedia.org/wiki/Claude_L%C3%A9vi-Strauss).

<comment><USER10> My bad. More coffee, less impulse. Apology.

</comment></comment></comment><comment><USER11> The interesting question will be how do users arrive at individual piece of the bricolage? If we look at the "save mobile content for later" example, I am sure once upon a time people felt it to be easier to simply copy the link, open the email client and then email -- instead of using the "share" button.

That said I am also kind of lost on the conclusion here.

> Using theory to support our research findings allowed the team to gain a > greater sense of self-awareness into their assumptions and how others > without those assumptions might think and behave differently.

While insights are fine, without concrete examples, this is just a hypothetical whether this really helped the engineering team.

</comment><comment><USER12> Can anyone explain this? I kinda missed the point - "people doing a job only use the tools at hand, but engineers can not do the job and go off and build a better tool?"

<comment><USER7> As I understand it, they point out that Levy-Strauss discovered two kinds of approach to solve problems, engineering and bricolage. The former is careful planning and solving the task by building an exact tool that resolves the problem, the latter is putting together whatever you have available in an approximate solution and moving on.

In software, we would probably call them "software engineering" and "hacking" approaches. For example, in the Linux Kernel init discussion, systemd is an engineering solution, while traditional init system is a bricolage solution.

<comment><USER8> Also, as someone else noted in a comment to the sane article months ago (yep, it's a dupe) the Unix set of single-task CLI utilities (sed, grep etc.) encourage a bricoleur approach at solving problems without having to write a throwaway application (or extend an existing one) every time.

<comment><USER13> This is only if you hold them as individual items outside the context of the system. These utilities are an engineered solution as a whole. Look how they work together and interact with one another.

If you break an engineered system down into its components and never consider all the ideas and fabric that link them together in an engineered system, you could reduce anything to bricoleur.

<comment><USER7> > If you break an engineered system down into its components..

I disagree. Yes, Unix is deliberately engineered to allow for bricolage. But many (most) things aren't. Take for example classic PC and the iPhone. You cannot break down iPhone to it's components and remix them. You could do that with a PC, to some extent.

</comment></comment></comment></comment></comment><comment><USER14> this is a very insightful article! i have worked quite a bit with bpms'es, apache camel and such and experienced the inflexibility, brittleness myself..

so any larger application can become very easily 'overengineered' and of less value to the bricoleur.

there are some good examples of bricolage systems mentioned here, like unix shell commands etc.

but in a more application design-specific context targeted to 'normal' (non- technical) users i was wondering if flow-based programming (e.g. noflojs.org) could offer a better balance between well-engineered small (maybe even tiny) building blocks and bricolaging them based on personal preferences (e.g. visually) to bigger, useful apps.

flow-based programming had a good uptake initially, but i'm not hearing much about it of late..

any opinions or experiences?

</comment><comment><USER15> I'm still stuck on why they can't measure jeans: [https://imgur.com/a/866aO](https://imgur.com/a/866aO)

<comment><USER16> In case you weren't being snarky, the article was talking about Claude Levi- Strauss who was a French Anthropologist, not not the maker of jeans...

[https://en.wikipedia.org/wiki/Claude_L%C3%A9vi- Strauss](https://en.wikipedia.org/wiki/Claude_L%C3%A9vi-Strauss)</comment></comment>


Star Wars Ring Theory - <AUTHOR> http://www.starwarsringtheory.com/ <comment><USER2> This is the best dissection of the Star Wars story I have ever read.</comment>