Show HN: A remote browser product, open-sourced - <AUTHOR> https://github.com/dosycorp/browsergap.ce <comment><AUTHOR> This represents over 1 year of work.

Why am I open sourcing this?

I don't see any other RBI / CBII vendor open sourcing their platform and in the security industry "closed source" can create issues.

But what about business defensibility?

I agree. Open sourcing removes the trade secret aspect that could make a defensible business.

At the same time, a determined hacker would already have my source code. A hacked "free wifi" connection here, a bit of social engineering there, and my so-called "competitive advantage" could be easily removed. Access to GitHub, Gitlab, other accounts would prove no obstacle for someone motivated, and open sourcing is a way to remove the advantage any small group of parties has by keeping it secret.

How do I self-host it?

There's instructions on the repository page.

<comment><USER2> When you say over one year of work, do you mean one year of manpower (aka ~2000 hours) or that you started it about a year ago?

<comment><AUTHOR> Thanks for the thoughtful question.

For the CE release, I deleted the Git history (it became too difficult to deal with branch rewrites trying to remove all the cruft and deployment secret keys etc).

But the actual current working repo for the non-free version has ~ 2400 commits[0]. And the repo that I forked that from (~ 7 months ago), I'd closed 238 issues, and the repo I forked that project from I closed 200 issues. Those previous repos are all my work built from the ground up within this last ~12 months as well. The current working repo has closed 124 issues.

My Gitlab contribs for the last year are at: [https://gitlab.com/dosycorp](https://gitlab.com/dosycorp)

And it's actually a little bit over 1 year, and if I count the Gitlab contribs show there, it's over 5500.

So, yeah it's been about 2000 hours I think. Working full time every week day and most weekends, and often longer than regular hours (but also dividing the work up in the day into sprints because that's how I manage myself to work best).

It's definitely been a year.

[0]: [https://imgur.com/gallery/wpNhxS0](https://imgur.com/gallery/wpNhxS0)

<comment><USER2> Awesome. Thanks for the detailed answer.

I dig your dedication! You well earned to be on the front page!

Who do you see as the main target audience? And do you have a business model in mind?

<comment><AUTHOR> Thank you for this!

Main audience is people and organizations who are having problems with malware and cyber attacks.

Business model I am still working on, but it's a mishmash of licensing (+ maintenance, for hybrid / on-prem) and pay per seat (for cloud-based). Could be other ways to provide value.

What's your background? I'm open to new ideas.

<comment><USER3> >people and organizations who are having problems with malware and cyber attacks.

this sounds like (almost) everyone

</comment></comment></comment></comment></comment></comment><comment><USER4> Could someone write a few sentences about what it is and how it works, and why it is significant? I see neither this post, the GH repo, nor its website really says much of anything on the subject. I only see info about why it's being open sourced and how to set it up. If someone were to go to all that trouble, I am surprised they would stop short on just providing basic info.

<comment><AUTHOR> Sure, BrowserGap is a remote browser isolation product. RBI means accessing the public internet through a browser that runs in the cloud, rather than through a browser that runs on your device. This helps protect you from attacks on the web.

<comment><AUTHOR> And, if you're interested, read on for more detail.

It works by providing a thin client over the web that you connect your regular browser to. The thin client provides an interface to a remote browser that you interact with the browser the public internet.

This is significant because the internet is a cesspool of attacks. Malware, ransomware, virii, tracking, exploited PDFs, ways to deliver device zero days over the web, browser zero days. All these things can lead to the security of your device and network being compromised, causing significant inconvenience, distress and loss for you.

BrowserGap and the RBI methodology acknowledges that not all threats can be detected and neutralized (such as by virus scanners), in order to face that reality, RBI adopts a "isolation" posture towards threats, effectively isolating them in the remote machine and preventing them from reaching your device.

With BrowserGap, in order to render the content of a web page, the only thing we send to your device form the remote page is pixels. So no HTML, CSS, JavaScript, etc from your browsing is ever executed on your device.

Cloud-based internet isolation is another name for this security practice and it is an emerging industry. Symantec recently acquired a company in this space, and Menlo Security was awarded[2] an agreement to build a CBII prototype for DISA, after a June 2018 request for RBI solutions that could eventually serve 60% of DoD's ~ 3 million users[0][1].

See more about RBI[1].

[0]: [https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih...](https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih.pdf.html)

[1]: [https://en.wikipedia.org/wiki/Browser_isolation](https://en.wikipedia.org/wiki/Browser_isolation)

[2]: [https://www.menlosecurity.com/press-releases-blog/disa- cloud...](https://www.menlosecurity.com/press-releases-blog/disa-cloud-based- internet-isolation-cbii-awarded-to-the-by-light-professional-it-services-llc- and-menlo-security-team)

<comment><USER5> Genuinely curious: who's your customer base?

I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I'm not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade.

Those way more paranoid than me still have the option of using local VMs/containers without too much compromise. Then the attacker really needs an exceptional exploit chain to escape all the way; it's hard to imagine any group blowing such a valuable chain on a drive-by.

So, why would anyone sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. to reduce the minuscule chance of drive-by attacks (assuming otherwise reasonable opsec)? Extremely high value targets?

But then, why would extremely high value targets trust a MITM? (Self-hosting apparently changes that to some extent.) Also, even if you run your browser in the cloud, that browser could still be hacked and leak sensitive information or actively modify traffic, no? So this isn't even bulletproof for high value targets.

<comment> o-__-o I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there.

I currently use a proxy and have instructions on how to use FoxyProxy to access each env's environment. This will provide for a much nicer UX where you simply click a link and you're brought to a virtual tab in that env. I'm sure some things will break, so the proxy is a backup, but for 90% of our work I think this is amazing!

Solves any app problem where you have the same hostname per environment

<comment><USER5> Have you tried using this? When I said

> sacrifice the ability to interact with text, resolution, color accuracy, > frame rate, etc.

it's very much an understatement... Pretty sure your devs/testers won't appreciate the experience. Frontend devs in particular can't possibly work with this.

I fail to see why it's hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource intensive than something like this.

Anyway, your use case only makes sense when the code can be self-hosted, but apparently this product / product category has customers before the source is opened up, and that's what I'm curious about.

<comment><AUTHOR> > genifnly curious: who's your customer base?

Customer base is people and organizations who are having problems with malware and cyber attacks.

> Have you tried using this? When I said > sacrifice the ability to interact > with text, resolution, color accuracy, frame rate, etc.

> it's very much an understatement... Pretty sure your devs/testers won't > appreciate the experience. Frontend devs in particular can't possibly work > with this.

I totally agree the image quality can be much improved. So I'm really sorry you had this experience today trying it out!

Would you be unwilling to mail me firstname.lastname@example.com and I can contact you if and when I have image improvements to share?

Initially, I used JPEG for all clients, then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is _a LOT_ (but WebP in FF looks pixelated, so I hope I can find a way around that), even tho the bandwidth is the same.

For Safari and iOS the quality is on JPEG. It sounds like it has sacrificed the ability ot interact with text, resolution, color accuracy and frame rate, etc. I'm really sorry about this.

Some people seem okay to roll RBI out in a test deployment, without the code being open-sourced. I can't speak directly for them, but I assume that Symantec (who bought FireGlass Browser), Menlo, WEBGAP, Light Point, Ericom, Authentic8, Citrix all have some customers even tho they are not OSS. I think that, often, as long as the contract provides the ability to examine the code if required (due diligence) even without publishing it openly, sales happen.

It sounds like you're unfamiliar with RBI, is that right? This is still an emerging industry so it makes sense to me that even if you are in security you are unfamiliar with RBI.

<comment><USER5> Appreciate the detailed response. Over the past few years I've seen a couple of similar remote browser services and was curious who actually need it, glad you shared firsthand knowledge.

Now I can see that while this would probably be an overkill security-conscious individuals, it might make sense for organizations because there are always employees who can be easily tricked into clicking anything. I do wonder whether it's more effective and productive to instead enforce host-based blocking + browser-level content blocking + lightweight virtualization (like Windows Sandbox? Not sure how well it works since I'm a Mac user for the most part), but I'm in no position to evaluate for organizations.

Having checked Symantec's website, they seem to advocate falling back to a remote browser when the site is potentially risky, which sounds reasonable.

> then for clients with browsers that support WebP (chrome) I switch on WebP > since the quality increase is a LOT

Yeah, I first tried the service on my iPad Pro, image quality was terrible. I have since tried it again in desktop Chrome and it's definitely passable. That's unfortunate.

Anyway, I'm probably not in the target market, but best of luck to your business.

<comment><AUTHOR> Thanks a lot for that response!

Interesting hearing you know about RBI. Did you evaluate any of the other services? What did you feel about them?

I definitely think the approach you say (host level blocking, content blocking and some lightweight virtualization, like Edge/Windows Sandbox, or a local VM) is a valid one that reduces risks.

I think it comes down to considering, when attacks inevitably occur, where do you want to be doing the cleanup? Zapping a few containers, or instances in the cloud and starting them frehh, or decontaminating the local machines and network?

That's the biggest convenience for me so far.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Great work, and so great of you to open-source this - I really hope you keep it that way!

Would be really cool to set this up and set the server up to do some proxy- hopping to make IP tracking more difficult as well, regardless of client device and when roaming.. While I'd be more leaning towards self-hosting, if you set this up as a subscription service, your users will also benefit from sharing the same pool of IPs (though I imagine you'd also face issues with getting flagged/blacklisted/CAPTCHAd a lot through abusers and bots, that will be significant work to polise if you go that route).

<comment><AUTHOR> Thank you for this!

</comment></comment><comment><USER7> Darn... I'm working on almost exactly the same project. The big challenge is getting access to server hardware that is actually meant for webbrowsing. Not only are AWS et al expensive, they primarily offer "webservers" which are optimized for very light not very CPU intensive workloads and needless to say they also don't offer hardware accelerated video decoding.

<comment><AUTHOR> Hey! Sorry for taking so long to get back to you. I saw your comment and wanted to respond, and I have been very busy today because of this post.

Thanks for sharing your feeling about this.

It looks like you're working on almost exactly the same project, and that the big challenge is getting access to server hardware for webbrowsing, because not only are AWS etc expensive, they primarily offer "webservers" optimized for very light not very CPU intensive workloads, and needless to say they also don't offer hardware accelerated video decoding.

Wow! Sounds like you're doing something interesting. Are you uninterested in collaboration? I was thinking of ways to make the video better, but right now I'm basically just using DIY "MJPEG" over websocket.

As for the server hardware, I was decided to join the Stripe Atlas program at the start of 2017, and from that I was able to get 5K in AWS credits, and then more Google Cloud credits, and I also applied to IBM and Digital Ocean on my own and got credits from them as well.

So, so far I have been able to develop and then demo this (like today) without significant monetary cost.

I also have some tips for you, because resource usage was one of my concerns, but TBH I find Chrome headless actually always uses less CPU than I imagine. It's all about the page that it is rendering. The page determines everything, but Chrome itself is very light. So when I've budgeted for like 1 CPU per user, it's actually possible to get much more than that. And memory is the big thing that Chrome does lightly, it uses barely any RAM even with 100s of users on a machine. I was surprised by that. 100 users running Chrome and only ~ 20 Gb of RAM used.

Also, regarding video, because I'm avoiding expensive video encoding (just sending screenshots) I avoid the CPU load of doing that. I've experimented with doing more processing of the frames, but it just throws the load way off.

I chose to keep it simple and I'm pleased with that. At the same time, I want to explore ways to improve image quality.

<comment><USER8> I did an experiment a while ago with streaming chrome to twitch from a gpu- enabled ec2 node and it worked quite well. Was able to stream a webgl experience at 60hz.

<comment><AUTHOR> That's good to know, thank you. What made you do that? Would it be too annoying to share some more about it?

<comment><USER8> We have a webgl app (hubs.mozilla.com) we wanted to determine the viability of doing cloud streaming of remotely.

here's some personal notes from this. i didn't work on containerization, just raw VM setup. had to get x11 up and running and then set ffmpeg up for hardware streaming.

[https://gist.github.com/gfodor/3c88700ee81a10e01c783019b8a64...](https://gist.github.com/gfodor/3c88700ee81a10e01c783019b8a6420a)

<comment><AUTHOR> Hey, thanks a lot for that!

</comment></comment></comment></comment></comment></comment><comment><USER9> Hmm, I'm not sure if people in the western world can use it but in South Korea (with a 1Gbps network) this is basically unusable.

It has too much latency, text doesn't get entered, scrolling doesn't work, etc... Is the experience from US similar? Or is this just b.c. of server latency?

<comment><AUTHOR> I'm really sorry you're having this trouble!

If you want, I can test it. I'll open up an "East Asia" instance and we can see how if it's any better.

<comment><USER9> I would like to test it! It would be great to have an East Asia instance for this.

<comment><AUTHOR> Cool! I'm just setting it up now. Please hold on a little bit.

Edit: Okay an instance in East Asia is up and running!

[https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz)

<comment><USER9> Okay, much better now. I'm writing this comment in the Cloud Browser on my iPhone! :-)

It's now 'usable', but definitely not a good environment. Scrolling is unbearable, and once you start scrolling it doesn't stop, so it's a pain to navigate.

<comment><AUTHOR> Hahah! That's awesome to hear you're writing it in the Cloud Browser on your iPhone!

But I'm really sorry about the scrolling. Sounds like it's unbearable. I need to fix that!

I added a "fast mode" for scrolling where if you scroll more than 40% of the screen in one go, it accelerates the amount, so you could try scrolling smaller, but I don't feel that's a satisfying solution for you. Scrolling is really important to get right, I'm very sorry about that!

If you want, email me at firstname.lastname@example.com and I will work on it and let you know.

Edit: I've had other reports about Safari / iOS being really unusable today. I just tried turning up the image quality for iOS / Safari it should make things better.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> I just want to let everyone know there's also a version for Asia-pacific (in a HK Google datacenter) that will probably be faster if you're not in a US timezone.

[https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz)

</comment><comment><USER10> A while ago I wrote something very similar - [https://fasterbadger.com](https://fasterbadger.com) \- see discussion at [https://news.ycombinator.com/item?id=9679464](https://news.ycombinator.com/item?id=9679464) \- based on PhantomJS - didn't put nearly as much work into it though, it's still very much in prototype stage - the goal was different though, not so much for privacy but for browsing JS- and CSS-heavy sites (e.g. most news sites) on legacy devices/phones, especially where bandwidth is at a premium.

<comment><AUTHOR> That's very cool!

Thank you so much for sharing this.

I'm looking at your app and I _love_ the long scroll feature. How did you do that? It's so cool how you can scroll down the page natively, and the image updates, that's really incredible.

And I'm reading the initial discussion, and it's ... in 2015! Wow, how did you do this back then! I think thing's are so much easier now with all the features in the protocol.

I am really interested in how you did this and I love the site. It's very cool and I prefer it to my own work in many ways. Would you be a terrible idea for you to contribute to BrowserGap?

About half way through development, I was travelling and buying 4G data sims and I also thought I needed to use it for that (easily use 50Mb just on a news site).

So I made a HTML only version (no images, just stripped back HTML, you can see the work in the various 'appminifier' subdirectories somewhere in the repo). It saved me data, but introduced lots of quirks. At some point I realized it was too difficult, and I was committed to another idea with it, rather than this low bandwidth, so I stopped working on that feature.

Also, I love the _Open in new tab?_ feature you have. This really rocks. It made me so happy to see this work! Thank you so much for sharing with me. :)

I wanted to get a scrolling feature like you have and I couldn't think of a way to make it work. If yow could do that in BG I'd love it!

</comment></comment><comment><USER11> Get ready to be hired by Mighty XD.

Liked your product from your previous submission and liked this one as well. I think it can help some people where censorship is present, but not particularly for me.

<comment><AUTHOR> Thank you for this!

</comment></comment><comment><USER12> Interested to hear about professional use cases for this kind of tool. I am working on a cloud-based sandbox browser very similar to the OP here: [https://www.sandboxbrowser.com/](https://www.sandboxbrowser.com/)

My target audience is software developers, QA engineers, and Ops people who want a predictable isolated browser environment for doing various forms of testing / hacking.

</comment><comment><USER13> Cool idea at first, but on second thought, how is it supposed to mitigate internet threats? Users need to download files, open them with local apps, upload local files. All necessary channels for RCEs and exfiltration are still there. Current malware codebase might get stuck with it, but it's a matter of time and adoption. Other threats like clickjacking, cryptomining, phishing would just work as before.

Am I missing something?

<comment><AUTHOR> First up that is some great feedback and raises a lot of really good points.

I don't know if you're missing anything but this feedback about files is on point. I really appreciate it. And I'm surprised no one raise this until now. Thank you for your time thinking about this and for making the space for me to speak about it.

> Users need to download files, open them with local apps, upload local files.

Ideally, user's don't download files, they use the Secure remote file viewer[0] (which currently handles PDFs, DOC/X, XLSX, etc), so that helps with exploits from there (such as the Chrome zero day from PDFium that recently occurred). No configuration is required, it automatically jumps in whenever a download starts.

Also, because the browser is running in the cloud, that "download" actually only happens between the web and the cloud. The file literally goes down to a temporary directory on a server in the cloud, before being sent to the secure file viewer. That file _never_ touches the client's device or network. And the secure file viewer only sends pixels to the client, because it converts all documents to images, and then, the browser sends a screenshot of that page. So it's like... two layers of images.

Anyway, that helps mitigate the RCE threat from exploited file objects, browser and device zero days. And no HTML,JS,CSS from the browsed page is ever sent to your device.

As for opening with local apps, that's debatable with things like G Suite and Office 365. But we can integrate with a corporation's SWG (secure web gateway) and file policy so BG doesn't degrade their existing security, but it does provide an extra layer.

As for uploading that is absolutely required, otherwise many things would be unusable. I don't pretend that BG provides any sort of malware or virus scanner (mainly because there is not download), but as for uploads, it's possible to integrate into an organizations' existing SWG technology to gate- keep content that leaves, and also white and black list accessible sites.

> Current malware codebase might get stuck with it, but it's a matter of time > and adoption.

I agree that to some extent, security is an ongoing "arms race". But there seems to be limits to what malware can achieve through the exploitation of pixels sent to the device. It puts a big limit on their attack vectors.

It sounds like there's no point taking any steps, because malware can always find a way through. When you say something like this, I feel like I'm wasting my time talking security, because it looks like you'd never adopt a mitigation anyway.

> Other threats like clickjacking, cryptomining, phishing would just work as > before.

That's a great point. I don't think this tool can prevent against social engineering threats like phishing, fraud and deception. It may even may them worse by allowing users to feel "more secure" and therefore act more rashly.

No tool provides perfect protection, but BG can reduce the attack surface and isolate and contain many threats away from the device and network of the client. In the case of clickjacking, older browsers can be vulnerable because of CSP headers, but with BG you always proxy through the latest chrome.

As for cryptomining that will simply not work well at all. We have monitoring software that puts hard limits on CPU, memory and bandwidth for each browser and each user. Please, go ahead and try it.

[0]: [https://imgur.com/gallery/Z32ZPg3](https://imgur.com/gallery/Z32ZPg3)

<comment><USER13> Remote file viewer is a good idea. The hard part is convincing users to a workflow where they can't save their files, only view or print them. There are tons of software with tons of proprietary file formats. One day you'll have to give up and allow downloading.

But I see a certain segment of small business users who have everything cloud- based, where this might take off.

<comment><AUTHOR> I agree that downloads are important, so I'm committed to integrating with org's existing file/firewall policies and secure web gateways.

I'm interested in what you said. Would it be a terrible idea for you to tell me some more about this certain segment of small business users?

<comment><USER13> I've seen a couple of them during my consulting gigs. They don't want to own any infrastructure and don't want to keep IT staff to maintain it. They indeed use G Suite, Office 365 and cloud varieties of line-of-business apps: order processing, inventory, accounting etc. If an app doesn't have a suitable cloud alternative, it's moved to VPS and accessed via RemoteApp (at this point you apparently get some IT guy).

They keep client PCs as "thin" (read "cheap") as possible. They don't have a "SWG" or "file/firewall policies" or anyone who can implement and enforce it. It's just stock desktop AV software perhaps with some initial tuning. And this resource-hungry beast is there only to scan incoming files for the ransomware- of-the-day, either downloaded from the Internet or copied from USB thumb drives. If they could deny users from downloading anything, disable thumb drives and drop AV entirely, they'd be much happier, especially that poor IT guy.

<comment><AUTHOR> Wow, this was really useful. Thanks for that! :)

</comment></comment></comment></comment></comment></comment><comment><USER14> This is cool, but to me it sounds like you are building high value targets for a hacker.

Hack one instance and get access to hundreds of users browsing the internet.

<comment><AUTHOR> The risk you point out is extremely true. That's one reason why corporate/paid deployments are single-tenant. So everyone (not hundreds, it's more compartmentalized than that) on an instance belongs to the same company, or if desired, the same unit.

Even in this free demo, every user has their own browser process, with its own uid owner, and that OS uid has its own limited permissions.

At the same time, it's not an insignificant risk at all and you raise a very good point, which I'm surprised no one brought up before. Thank you for bringing it to everyone's attention.

An instance is a single point of failure, it's also less attack surface. To some extent, that's a tradeoff. Relative to all devices and network infrastructure in a typical company that access the public web, there's less attack surface if all web access funnels through a BG instance. On the other hand, it's a concentration of the risks into one place. My belief is that makes it easier to manage, and that the "gap" between the client infrastructure and devices and the cloud (through which only pixels, and a wire protocol of user intent pass), makes it more secure than accessing the public web directly.

Even tho it's a single point of attack, a compromise of a cloud machine, is not the same as a compromise of a device in a company intranet, or a mobile phone of someone in the company. In order to exploit the user's local machine or their organization's network, an attacker would still need to convert any instance access they had into access of a company device or network. This could happen through attack vectors in the pixels for the screen view (less likely) or through compromising the source code that serves the thin client (more likely). This is why monitoring of source code integrity is important. Open Source is an important part of that.

At the same time, in these free demo versions the browsers only exist for 10 minutes, and, exactly as you say, hundreds of strangers are all browsing from the same machine together.

TL;DR - It's a tradeoff of centralized infrastructure. There's less attack surface, but there's also a single point of failure.

Also, if you want to responsibly dislcose any security vulnerabilities you discover, please report to email@example.com and if you want I can acknowledge you here [https://github.com/dosycorp/vulnerability- reports](https://github.com/dosycorp/vulnerability-reports)

</comment></comment><comment><USER15> Some what relevant

[https://ungleich.ch/u/blog/how-to-run-your-browser-in-the- cl...](https://ungleich.ch/u/blog/how-to-run-your-browser-in-the-cloud/) (which will ultimately lead you to [https://guacamole.apache.org/](https://guacamole.apache.org/))

</comment><comment><USER16> Just tried it acouple times and keep getting hit by google captcha...

Maybe this is the Google AI team trying to get more people to solv'em? ;-)

<comment><AUTHOR> Good point, let me temporarily switch the default search provider to DuckDuckGo. This will take a while to propagate to the browsers.

A workaround in the meantime is to enter a URL in the box instead.

Edit: Switched to DDG as default search provider for this. Back up at 21:24 PST.

Edit @23:00 PST: I've opened an issue with Google Cloud Support (the system is hosted on GCP even tho it is cloud-agnostic) and I don't expect they will be able to provide a resolution because this is probably the CAPTCHA behaving correctly.

BTW, it _could_ be the AI team getting some more data, who knows? ;)

Somehow tho I think whatever we do is simply a drop in a bucket for them.

</comment></comment><comment><USER17> Surprisingly usable, considering it's on the other side of the globe. Personally I don't see myself having a use for it, but I'm sure it could find its users.

Two thing I noticed. You have to enter address including "http(s)" to avoid searching it in DDG. And more annoyingly I couldn't select text on web page.

<comment><AUTHOR> Thanks for saying that!

As for text selection, the best I have so far is

right click to open context menu

select "Copy text from here"

And you should get a box pop up with text you can select. :)

</comment></comment><comment><USER18> Just tried the demo on your website and it seems to be quite slow and unresponsive. If this a load issue?

Also it gives me a feeling that I'm not in control of what's happening on the screen. Could you please let me know how is this solution better (or more secure) than using remote desktop with disposable VMs?

<comment><AUTHOR> I'm sorry about that! That's sounds like a really terrible experience you had trying this out today. It must feel really uncomfortable to not be in control of what's happening on screen.

Edit: the HK site is back up. [https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz)

There's a couple of factors that could be playing into this. Primarily it's likely just the application itself. It _is_ more slow, _and less responsive_ than using a regular browser on your device.

The frame-rate is capped very low, the image quality is lower, and there's more lag to each interaction since it involves (at the very least) a WebSocket round trip and a screenshot.

Secondly, you could be affected by geography, which has a very significant effect. If you are close to the primary server (US East, Virginia) you'll have a faster more responsive experience.

In a few minutes I'll have the HK server (Asia Pacific) back up ( I was just resizing it down, it was seeing significantly less use than the US server), and if you're closer to that you can try there.

Also, the free demo has many caps (so as to control costs). I cap the outgoing bandwidth of each user to a very low 3Mbit/s, and I use multiple ways to cap CPU usage, including (in extreme cases) killing the process. All of this means that if the page you are using wants to eat a lot of CPU (happens sometimes) then the app will slow right down for you (to preserve resources for everyone else on the system).

I can say confidently that it is not about the number of users. We had More 100s at peak before and a single browser still felt snappy. So if you're getting slow down I think it is (to summarise), either:

\- You are experiencing the app for the first time, it is different to using a normal browser, interactions _are_ slower and more choppy (but page loads should be as fast or faster).

\- The page you are browsing is hitting the resource monitoring and being downregulated.

\- You are link-wise far from the server (which is often, but not always, related to geography).

If you're interested to give it another try I'm at another time I'm happy to arrange that. Would you be unwilling to leave your email at this form, and I can let you know a quieter time? Also, if you just email me at email@example.com and let me know your approximate location, I can set up a server near you and we can attempt to work out any leg issues still occurring.

</comment></comment><comment><USER19> Would this have problems with sites like LinkedIn that aggressively ban address blocks from cloud providers?

<comment><AUTHOR> Thank you for this.

First up, have you had any issues with site banning or CAPTCHA?

After I saw your question I wanted to know so I just tried signing into my LinkedIn from [https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz) and I'll share my experience.

And first they sent a code to my email because "something seemed suspicious":

[https://imgur.com/gallery/2lflmjf](https://imgur.com/gallery/2lflmjf)

When I put in the code from my email I could sign in and it worked as usual.

I have noticed that everytime I land at [https://bloomberg.com](https://bloomberg.com) I get a CAPTCHA (1 only) and then I could read the site.

I opened a support ticket with BB but they said they don't need to do anything right now.

I felt OK with that. 1 CAPTCHA is not too bad.

</comment></comment><comment><AUTHOR> Hey HN, thanks for all the love on this, and for helping me think about other use cases for and how to communicate about this product. I really appreciate this!

Also, I noticed I spent a lot of time maintaining the demo instances (resizing). In a real deployment the number of users per machine is pretty much static, but here I've had to deal with scaling and spikes.

It occurred to me today that I could probably put the free demos behind a load balancer (smaller basic machines, and scale them up or down), so that I don't have to manually resize the instance.

I've taken down the two demo sites (free & hk) for now, while I work on the load balancer setup. Should be back up in a couple hours.

<comment><AUTHOR> Edit: Servers are back up

I moved from a single massive instance to a target pool behind a load balancer with health checks based on if there's available queue.

[https://free.cloudbrowser.xyz](https://free.cloudbrowser.xyz)

[https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz)

I have not worked out how to geographically load balance both of those from a single domain based on which you are closest too, but I want to see if these new smaller instances in load balanced target group pools can scale to take the load like a larger instance.

<comment><AUTHOR> The load balancing setup I used today has issues, which you can see if you're using it now (very slow).

Namely, load balancing and scaling based on CPU is not a good metric, because new instances (which are still serving multiple users), will keep absorbing new users before the metric is triggered, and even when it is triggered, a new instance will take a while to spin up and build some browsers, so scaling lags too far behind load and the effect is existing instances get and stay overloaded.

So, I have an idea for a new autoscaling system that puts 1 tiny machine per user, but it will take some reconfiguring. So, in the meantime, I'm switching back to the old system (massive instances, vertical scale).

I'll do that now and the servers should switch to the new system in about 30 mins.

</comment></comment></comment><comment><USER20> Just had a quick check, some web page will fail the click event(mouse click won't do anything).

on the other hand I have been using novnc to do similar things for my own testing purposes(running chrome inside chrome remotely), it worked very well for me so far.

<comment><AUTHOR> Thanks for the report, it's very valuable and thanks for pointing me to noVNC, it looks great!

I'm very serious about usability issues, would it be impossible for you to provide some examples of sites where the click failed and what you clicked on?

I try to get those things fixed ASAP because the experience of using is so important, I think it should be as familiar to a regular browser as possible.

</comment></comment><comment><USER21> Bleak future flashed in front of my eyes - Google Chrome v100 - browser runs on google's cloud, you are just being streamed view to your Chrome Client™. So secure and you are so out of control.

<comment><USER22> Which would definitely be in-line with what they're doing presently with Stadia.

<comment><USER21> To be fair running browser sessions should be so much less demanding than running triple A games.

<comment><USER22> I don't doubt it for a second, but if you can make one happen why _not_ the other? if you already have a very powerful video compressor with low latency, why not do hosted applications?

Totally makes sense because you unconstrain yourself from supporting all web- browsers, rolling out features gradually, and it unconstrains you from javascript too.

Imagine instead of google docs you had microsoft excel but surrounded by a browser window, everything else is the same. I know people would pay for that. (even if I personally prefer google docs)

</comment></comment></comment></comment><comment><USER23> I must be missing something but can someone please explain

how browsergap > self-host on your own machine (at home, or in a VPS, VPC or the public cloud)

is more secure/private then just setting up a VPN on that machine?

<comment><USER24> As I understand it, it's like an extreme sandbox -- a completely separate computer (or a VM) where all the web stuff happens (javascript etc), which just ships pixels to your computer (phone/laptop etc). Ideally the complexity of the client software is low, i.e. not a web browser, and there is strict site isolation (VMs) at the sandbox side to prevent leakage from one site to another. I'm a little vague as to how this implementation works.

So this is nothing to do with a VPN as such, but of course you could host it in the cloud, or run a VPN to a cloud endpoint.

<comment><AUTHOR> Yes, that's correct, thank you for helping explain things! :)

<comment> o-__-o What I used to do was launch a browser in an Xvnc or RDP session in a VM somewhere. Then do all my browsing from there. Later, I worked somewhere where RDP was blocked so I started using Guacamole (RDP/VNC over websocket).

What this author is providing is a similar and all-in-one npm solution for the above. Also has use-cases outside of secure runtime environments...

<comment><AUTHOR> Thank you for your explanations here, you really get this category! I'm sorry but do you mind if I ask what's your background?

I'd like to ask for your advice, I'm at email@example.com .... Would you be uninterested in discussing over email?

<comment> o-__-o Hey Cris! I saw your email in another thread and I was gonna reach out but for different reasons! My background is software dev with an emphasis on systems infrastructure and release management. I've worked enterprise and startups and my niche right now is M&A transitions. Look out for my email later today!

<comment><AUTHOR> Thanks, I'll be looking out for it!

<comment><AUTHOR> You might need to reach out at firstname.lastname@example.com I think the G Suite email (dosycorp) is dropping mails.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> I have a few questions. Does it update the whole screen each time something is changed on the page? How have you got rid of Google captcha? I didn't get any while I was using it.

<comment><AUTHOR> Yes, it listens for LayerTree.layerPainted events, and queues a screenshot on that. It also queues screenshots on other things, such as on "clicks", "scrolls" and a few other interactions.

After Screenshots are queued, they're throttled to a low framerate, and then each frame is compared with the last sent, before it is sent to the client, and dropped if there's no change.

I got rid of CAPTCHA by changing the search provider to DDG.

Thank you for your comments, I really appreciate it! :)

</comment></comment><comment><USER26> Does this support Flash Player? Having plugins like that RBI'd would be very useful as they're big attack vectors and usually not supported on mobile.

<comment><AUTHOR> Not flash, but PDF and DOCX/XLSX should work okay.

I have not thought about Flash, but I totally get the point you make. It looks like it would be very useful as they are big attack vectors and usually not supported on mobile.

Thank you for this feedback.

</comment></comment><comment><USER27> This makes little sense, it doesn't protect you from exploits, they just run on the cloud instead.

If an attacker has a browser exploit, they can still..

\- read all your email

\- log all your passwords

\- wait for you to login to online banking and transfer all the money.

You also have to worry about the host being compromised, or the operator logging your activity, etc.

If this is something you really want for some reason, why not just RDP/VNC/Chrome Remote Desktop back to your office/home network.

<comment><USER28> > This makes little sense, it doesn't protect you from exploits, they just run > on the cloud instead.

I am in no way endorsing this product (or the category of products), but it is incorrect to say that it doesn't protect you from exploits.

It protects against _your machine_ being compromised, and while the browser VM can be compromised, it can theoretically be ephemeral, possibly even only having the lifetime of a single tab (some products in the space does this IIRC).

It's all just a matter of what your threat model is.

> If this is something you really want for some reason, why not just > RDP/VNC/Chrome Remote Desktop back to your office/home network.

You could make a minimal linux VM with only a web browser, keep good discipline and never do anything else on it, and RDP into it.

However, these products commonly provide much smaller attack surface than such a setup, and combined with something like VM-based tab isolation, you wouldn't be anywhere near the security features of such a product.

</comment></comment><comment><USER29> Hey, this is super cool and interesting! Are you using puppeteer to do this? Might be cool to partner on some of it if you're looking into that (I run browserless.io).

Best!

<comment><AUTHOR> Hey!

Thanks for the message. I like browserless!

I don't use puppeteer. I use Chrome DevTools Protocol heavily tho. I started using chrome-remote-interface but hit limits in what it can do with Targets (specifically, flat session mode) and the latest versions of the API. Now I just use the WebSocket directly.

I'd like to partner. Email me email@example.com

<comment><USER30> Hi, is there any reason to avoid using puppeteer? Does it lack something you need when using the devtools protocol? Is it buggy?

<comment><AUTHOR> Thank you for the great question.

Thinking back to when I started this I initially just wanted to keep everything simple and so I avoided putting in a large and high-level lib like pptr, and went with chrome-remote-interface.

I looked at pptr and IIRC at that time (~ 12 months ago) there was not a clear way for me to handle multiple tabs (a key "real UI" use case). The same goes for Cyrus' lib too.

With Cryus' lower level lib I could hack around that, by doing my own target and session management, but at some point in the last couple months I hit a wall with chrome-remote-interface. Cyrus' lib was not up to date with the latest ToT API (specifically flat session mode) and I worked out I could replace the entirety of chrome-remote-interface with some simple code that sent messages down a WebSocket, saved a Promise (by message id) and returned it, and resolved that promise when it received back a message tagged by corresponding id. It was also simple to write an 'on' function to add listeners for various events. So that was that.

Basically, the DevTools protocol is a well specced, well tested, simple protocol and all these libs (like pptr and chrome-remote-interface) began simply as wrappers around the WebSocket, with an API to map function calls to protocol messages and add listeners for events. PPTR has evolved into much more than that now, and during the same time period, I evolved my own "BG protocol" atop the CDTP (Chrome DevTools Protocol). It became easier to deal with the single source of truth that CDTP is, and get the full expressibility of the latest ToT protocol than deal with the limitations and abstractions of other things built atop that.

Specifically, PPTR did not (and I believe probably still does not, tho I have not deeply checked) an easy way to control and manage multiple tabs. And even if it does, I'd have no use for it, because I already have the code that does all that anyway. Scanning PPTR docs now I see that I prefer the abstractions, naming, etc of the CDTP protocol itself, rather than the ones PPTR provides. Like I said, the CDTP protocol is very comprehensive, consistent and makes a lot of sense, and I know it very well. For me and my use case, it's just a better fit.

The way I think about this is not that "PPTR" has some problem, it's that the "BG protocol" and PPTR (et al) are trying to solve (basically) fundamentally different problems. PPTR (et al) try to provide a clean developer experience for common tasks related to browser use cases (such as automation, getting screenshots, PDFs, testing, etc). That's a particular domain, and not exactly the same as what BG protocol does. BG protocol attempts to provide as realistic and familiar as possible experience of using a browser (when you're actually controlling a remote browser through the CDTP). That's not entirely the same domain, because some things that users want, are not required in automation, and some things that automation does are not required or done by users.

One of the ways I code is by picking the right tool for the job, and if that tool doesn't exist, or no longer works, I build the tool. I want to work with tools that fit right. So for this domain and use case BG protocol is a better fit than PPTR.

</comment></comment></comment></comment><comment><USER31> Is it more secure than Guacamole + libvirt + chromium os?

<comment><AUTHOR> If you mean running the VM locally, then that has a risk of any exploits being able to escape the VM, and attack your machine directly.

That seems less secure than facing the risk of any exploits being able to escape the hypervisor in the cloud, someohow come through the text protocol connection to your computer, and exploit you there.

The extra layer of security provided by the remote cloud is important.

If, on the other hand, you mean using Guacamole to connect to a desktop running headless in the cloud, I'd say that's a similar level of security to BrowserGap.

<comment><USER32> What about a vm inside another vm?

<comment><USER33> I heard if you run VBox inside of QEMU inside of VMWare all running different flavors of linux then you good, dawg.

</comment></comment></comment></comment><comment><USER34> So is this using the canvas? What about accessability?

<comment><AUTHOR> That's a great point, and something I have not considered.

It's a big oversight, I'm sorry about that. Let me think about it.

There must be a way to do this.

<comment><USER34> For screen readers you could run it server side. Then stream audio/video to the client. Although I dont think this is the best sution to the problem. A better solution would be to run the browser with a hardware abstraction layer, like a virtual machine.

<comment><AUTHOR> That's a clever idea about running screen readers server side, thanks!

</comment></comment></comment></comment><comment><USER35> BrowserGap recursion [https://i.imgur.com/RRC5Eh6.png](https://i.imgur.com/RRC5Eh6.png)

<comment><USER36> The free version is kinda unstable, but this is as far as I got:

[https://imgur.com/QMQVDrk](https://imgur.com/QMQVDrk)

[https://imgur.com/E2ZZBaZ](https://imgur.com/E2ZZBaZ)

<comment><AUTHOR> Wow, that is far! It might have been the 10 minute time limit I put on the free version. It used to be 30 minutes but today there were hundreds of people and many people getting told it was already full, so I tried to let everyone have a go.

But, haha, I'm really glad that little modal dialog bubbled up the layers! XD It's kind of crazy when you think about what's happening ~~ you're chaining 7 browsers in row, using each to automate the next. It's crazy! Haha! XD

You really got me with this, it's so funny! Thanks for giving me a huge smile.

<comment><USER36> Also, what does the "saved" value refer to? It's quite easy to make it have strange (negative, or very large) values.

<comment><AUTHOR> Oh, sorry. It compares the amount of data you are receiving, versus the amount of data you _would be_ receiving if you were browsing directly.

Saved = (total resource weight of original browsing) - (screenshots + protocol)

</comment></comment></comment></comment></comment><comment><USER37> How does the Screen sharing work. Is it pixels out with noVNC or similar?

<comment><AUTHOR> It's just pixels out. It's very basic. It's just screenshots and compressed with WebP (if client supports), and adjacent frames are dropped if they are the same.

</comment></comment><comment><USER36> How is the user agent set? I'm trying out the free demo (free.cloudbrowser.xyz), and two different browsers (Chrome and Firefox) produce different and consistent user agents.

<comment><AUTHOR> Both the user agent and navigator platform strings are mirrored from the client.

<comment><USER36> Could that cause any issues with browser-specific features? I'm not sure what browser/renderer you are actually using, but if I'm using something different, there could be a mismatch in advertised capabilities (through the user agent).

<comment><AUTHOR> Yes, but generally, web apps detect features not browser versions, because UAs are already an unreliable signal of features, from long before BG.

Things like privacy extensions, screen readers, crawlers have various user agents.

At the same time, you make a good point. I'll consider your reflection if I come to re-decide if this is a sensible default.

</comment></comment></comment></comment><comment><USER38> Does this run on raspberry pi? E.g. could i get a rpi4 (which seems powerful enough), connect it to my router and install this on it?

<comment><AUTHOR> It should.

If you do this, please post an issue or PR on the REPO. I'd love to include something cool like this in a "built with BG" section.

</comment></comment><comment><USER39> Can someone explain me the major difference of this with being on a vpn along with a private tab? Thank you.

<comment><USER40> Browser fingerprinting, for one, is something that can be avoided.

</comment></comment><comment><USER41> On ios safari, browergap is unusable. Screen is totally pixelated after hitting the search button.

<comment><AUTHOR> Thanks a lot for your time on this report, and I'm really sorry about that! It sounds like the screen is pixelated and unusable. That must be very annoying!

I don't have an iPhone next to me right now, and I have not tested in Safari for about a week. Would you mind sharing a screenshot?

I know that because iOS Safari does not support WebP, I'm just using JPEGs which means the quality is worse there.

As a short term workaround, I'll now turn up the JPEG quality. This will take some time to propagate to browsers.

Again, I'm very sorry you had this experience today! I will test on iOS and improve the usability. I've had other reports that scrolling is terrible in iOS.

I'm just adding the iOS issues to the GitHub repo now. It could be great to contribute your screenshot to there! :)

Edit: Also, I'm sorry but would you be able to tell me are you using [https://free.cloudbrowser.xyz](https://free.cloudbrowser.xyz) or [https://hk.cloudbrowser.xyz](https://hk.cloudbrowser.xyz)?

Because I am testing serving HK with imports rolledup for speed (less requests), and wonder if this caused a further issue.

<comment><USER41> Give me your email, i will send the screenshot of what I see. Any random emIl is fine.

<comment><AUTHOR> Thanks for offering to send a screenshot of what you see!

Sorry I don't have a random email, but here you go: email@example.com

</comment></comment></comment></comment><comment><USER42> Someone else already mentioned being hit by Google captchas and the developer of this service said that he switched to DDG as the default search provider. Nevertheless I tried Google and kept working through 15 (yes, fifteen) captchas in a row and Google still wouldn't let me through, and then I gave up. What the hell? Surely even after 1 captcha, Google should be amply convinced that I'm not a robot and let me did a single search.

Can anyone explain the purpose of Google putting up an apparently impossible barrier like that? Is it because my searches are comingled with dozens of other people attempting Google searches at the same time from the same IP address? Or Google decided to blacklist his IP address?

<comment><USER43> That is a "feature" of ReCAPTCHA, and I believe there might even be a patent on it. The idea is that if you are sure it's a bot and want to deny them access you still waste their resources by making them solve impossible captchas.

<comment><USER44> It also happens if you have extensive anti-fingerprinting measures in place. It doesn't go on forever though. 1 minute of captachas or so.

<comment><USER45> Not true. I've spent 5+ minutes trying to get through this captcha system multiple times, never getting through.

It really fucks with you when you're on TOR, especially.</comment></comment></comment></comment>


Ask HN: How much of your time do you actually spend coding? - <AUTHOR> How much of your time do you actually spend coding versus say thinking about and discussing design, architecture, etc. with your colleagues or attending meetings, etc? <comment><USER2> You can log it via rescuetime.com. 53% of today was in software development. That's a good day. It typically goes between 30% - 45%. This is baring in mind pretty much all I'm supposed to be doing at the moment is coding, ie no support and less than 5 emails a day.

That figure is skewed downwards as there is 15% for reference / learning which is a ton of me watching coursera videos in the evenings.

<comment><USER3> Out of curiosity what sorts of things do you watch on Coursera? I was a big fan in 2013-2014 and did a bunch of courses. Some of them, like the Scala course, were very self-contained and great, especially with the automated graders. Mostly, I found the platform frustrating, though.

The artificial pacing of the courses made it essentially impossible to go through any faster than you would in an an in person class. Also the honor code prevents people from actually helping each other when they're stumped in the forums. There's clearly some tension between my goal of learning and the platform's focus on credentialing (via credentials that carry almost no weight).

Many courses were watered down versions and since different institutions break up their coursework slightly differently, there was a constant problem of repeating material or missing parts of prerequisites. Now it seems nearly all the courses are watered down and most don't seem to have any prerequisites at all.

Is it possible to do an entire technical degree's worth of material on Coursera, even at the undergrad level? Regardless of the value of their own certificates and capstone projects, if a student could learn enough to pass a GRE subject test, _that_ credential that would actually carry some weight.

<comment><USER2> Andrew Ng's Machine Learning 18 months ago and now his deep learning course. I do them because he's the best lecturer I'll ever have. So I'm not so bothered about credentials because I know I'm learning valuable information. The ML course was a bit limited as it was all Matlab, but the deep learning is all python and tensorflow. I also started the Scala course, but stopped as life was too busy, and I'm half way through Geoff Hinton's NN but he's just not as good at explaining things as Andrew Ng.

</comment></comment></comment><comment><USER4> I spend almost all time programming and thinking. Occasionally, I discuss some issues with colleagues. Other than that, I attend approximately one hour of meetings per week in total. I like this hands-off kind of management.

</comment><comment><USER5> Depends on the structure of your team and the stage of your company, doesn't it? For example in the first year of STOMT i developed STOMTs backend / API but in the meanwhile i do not code anymore and my focus fully transitioned to other things: sales, hiring, fundraising, legal, bureaucracy, etc...

Which is a good sign i guess. I miss my IDE though... a little bit. :)

</comment><comment><USER6> I'm in a semi-management role, so 10-15 hours working directly on programming projects on a good week, zero on a bad one.

Of that time, probably a quarter is spent running tests over and over again. For a project that's just applying something I've done a dozen times before, I'll probably spend half of the rest of the time just understanding the part of the codebase I'm applying it to. For something that's new or rusty, I'll spend 90% of the time in the beginning and 20% at the end researching or planning or just looking up APIs in the documentation.

</comment><comment> github-cat Personally I think most of time is spent on either design or debug. The actually coding period would be short if you have a clear design. And you would spend much of time on debugging some really rare but strange issue. If you are in the correct direction, the issue would be found quickly, otherwise it may take hours if not days to dig out the issue.

Another point is that it also depends on the familiarity of the technology/language you are using.

</comment><comment><USER7> Logged at my day job using toggl: around 50% at most (if you include reviewing others' code). Closer to 25%-30% if you're only talking about writing. Another solid 25% of my average day is taking breaks.

</comment><comment><USER8> 4 hours a day max. Any more and I get exhausted.

I'd actually count design and scheduling as coding, because that's where most of the code is written.

</comment><comment><USER9> Probably 50/50 over the long term, but I'm usually either in a mostly-design mode or a mostly-coding mode. If in design mode, I'm spending 1/3 of the time doing productive work, and the rest procrastinating. If in coding mode, I'm spending 8-12 hours a day head-down writing code, with small breaks to step back a bit and think.</comment>


25 years of HyperCard—the missing link to the Web - <AUTHOR> http://arstechnica.com/apple/2012/05/25-years-of-hypercard-the-missing-link-to-the-web/ <comment><USER2> Apple should make new version of HyperCard for iOS. Take some of the functions of Automator, add a whole lot more access to OS functions, media and have people make their own Apps.

Throwing together a program in a fun interface would be nice to get all those people creating, rather than playing Angry Birds on their way to work.

Let them combine their Garage Band songs, photos, videos, art, and writing into a nice little package that utilise functions of the device, their computer, Apple TVs, etc.

I'm not a programmer (and never used HyperCard) but I'm sure I could handle making something like: When [my Location data] is within [Y radius] call [vibrate; play song], [show this picture; display text "You've arrived at your station!"

Or I could prototype a point-n-click adventure with graphics drawn on my iPad. Or I could tell it to play an alarm every morning at 7am, then take a photo. Backup photos on X device. On the 365th day make all photos into a movie. Add text "A year in the life of [ENTER NAME]"

I think Apple needs to remember the reason a lot of people bought Apple products in the first place was because their simplicity allowed the technology to get out of the way and let people create. iPhones; social networks are all one-sided consumption, and people are getting bored. They love making stuff.

I think if Apple doesn't give people more of this kind of creativity, then people will flock to whoever does.

...Even cooler would be a combination of Project Glass and that LEAP system. I could be drawing blueprints, shaping 3D models, or making programs in augmented reality. It would be cool to look into a room and see dimensions of all the walls - see virtual previews of furniture in the scene; pull and arrange table sizes, shelves, bend and alter models. Then you could package it up to make a catalogue for other people to browse and choose options from.

I'd have a stack of cards, media files, functions, etc. in front of me. Draw lines between objects, stack, rearrange cards, manually code some parts. Some kind of combination of making an art collage and a circuit board.

Hmmmmm....

<comment><USER3> Hypertalk has gone on from strength to strength. I'm surprised that the Ars Technica writer should be so uninformed.

Runtime Revolution have been providing a Hypercard environment for at least a decade, and the technology they acquired had been in use since about 1992 (it was originally designed for Unix environemnts).

Runrev's Livecode produces hypercard-like applications that run on Windows, OS X, linux, android, and iOS. It also runs server-side, but I have no use for that part of the tecnology.

<http://www.runrev.com/>

And no, I don't work for them. I've just been using the technology for the past 10 years or so.

<comment><USER4> I used RR a looooong time ago to write a configuration wizard for a Java development tool set. The product used text files for configuration, and over the years the files had swollen in incomprehensible ways as programmers stuck new options into them willy-nilly.

Project management decreed that a wizard would ship with the next release. I was a full time development manager, but and as all the programmers were busy building features, I could get away with grabbing this task for myself. I used RR and built it in a week-end. A week of polishing and catering to PM requests followed, and we were ready to ship on Windows and several flavours of Unix.

Then somebody blabbed that it was written in HyperCard rather than Java. Faeces was Flung Furiously at Fans. In the end, it was rewritten for the next version over the course of a month or two. But it was Java! I engaged in a little revisionist history: Instead of saying that my work was thrown away, I took credit for building the successful prototype.

</comment></comment></comment><comment><USER5> Arthur van Hoff (who wrote the first Java compiler in Java, developed AWT and HotJava, founded Marimba and more recently Flipboard) developed a user interface tool for the NeWS window system inspired by HyperCard, that was called GoodNeWS, HyperNeWS and then HyperLook.

<http://www.art.net/~hopkins/Don/hyperlook/index.html>

It used NeWS PostScript both as its graphics model and its scripting language, and it extended the HyperCard Object=>Card=>Background=>Stack delegation model to send messages over the network to the client (what we now call the web server -- the terms client and server have switched place since then).

Wikipedia describes NeWS: <http://en.wikipedia.org/wiki/NeWS>

In many ways NeWS had an excellent design for thin-networked clients

\+ moving much of the processing to the display

\+ allowing clients to reduce network traffic by defining new operators

\+ separating graphical user interface semantics from client program semantics.

\+ the PostScript drawing model, which is far easier to use and more powerful than other graphical APIs, even compared to ones being used 20 years later.

NeWS was architecturally similar to what is now called AJAX, except that NeWS:

\+ used PostScript code instead of JavaScript for programming.

\+ used PostScript graphics instead of DHTML/CSS for rendering.

\+ used PostScript data instead of XML/JSON for data representation.

I worked with Arthur on developing HyperLook into a commercial product, and used it to port SimCity to OpenWindows on the Sun workstation.

Here are some brochures, manuals and articles about GoodNeWS/HyperNeWS/HyperLook, and the HyperLook SimCity manual:

<http://www.scribd.com/collections/3512581/HyperLook-Manual>

Micropolis is the open source descendent of the original SimCity code that I ported to Unix.

<http://www.micropolisonline.com>

</comment><comment><USER6> I loved Hypercard.

In 1992 I was in my final year of secondary school and got into a science extension program which paired students with industry.

Somehow or other I ended up with a guy from DSTO (Australia's publicly funded defence arm), and he thought it would be a good idea for me to test the results of underwater acoustic transmissions against some results they had (he didn't tell me why this was needed, but it was pretty obvious..)

Anyway, he was a Fortran programmer who used a VAX. My family had a Mac Plus with Hypercard. He gave me "Numerical Recipes in Fortran"[1] and I ended up implementing Newton's method[1] in Hypercard. After that I felt I really understood calculus...

[1] <http://www.haoli.org/nr/bookf.html>

[2] <http://en.wikipedia.org/wiki/Newtons_method>

</comment><comment><USER7> There is a language called LiveCode (<http://www.runrev.com> ) that is the spiritual successor to HyperCard. It uses a modern day xTalk language, it has network and database access and it cross compiles to Mac OS X, Windows, Linux, iOS and Android. Oh and it has a special engine that works like PHP, you can build websites by mixing HTML and xTalk.

I've been using it as my main development toolkit since 2005 and been quite happy. I am scheduled to speak at their world wide conference this month, so if you have any question, just ask. If you liked HyperCard and want to see what it could have been, just check LiveCode

=)

<comment><USER8> I used Revolution years ago. Glad to see it's still going strong. :)

</comment></comment><comment><USER9> I remember creating a hypercard project in college to demonstrate video lighting techniques, allowing you turn on/off the various lights in a setup. Everyone including myself was blown away by that at the time & I think back once in a while how similar it was in a lot of ways to web development.

</comment><comment><USER10> I'm thoroughly convinced that without hypercard my career path would have been very different.

<comment><USER11> Same here! My school was fortunate enough to receive a shipment of Apple computers when I was in 7th grade. I quickly discovered HyperCard, and spent my free time the rest of that year building a "fantasy RPG" with it. Totally ugly, barely worked, only made it about 5 screens deep, but I learned to write "code" without really realizing it, and I fell in love with building.

Who knows when (if) I would have gotten into programming without HyperCard.

</comment></comment><comment><USER12> As a non-coder HyperCard opened the door to interactive media for me and I've never left. I loved that program to death and was still using it to do what we would now call wireframes as late as the mid-90s. What pains me is that I can run the latest version of Windows via VMware on my Mac but can't launch good olde HyperCard and see my old stacks.

<comment><USER13> There are ways to run System 7 and HyperCard today

<http://basilisk.cebix.net/>

<http://minivmac.sourceforge.net/>

<http://sheepshaver.cebix.net/>

<comment><USER14> The harder part is finding a copy of full HyperCard (not just the later viewer) in a format understood by an emulator that runs on modern Mac or Linux. At least, I couldn't the last couple times I tried.

<comment><USER12> I looked into a few of the Classic mac emulation packages and the amount of work always looked off putting -- in fact I think some even required finding a ROM if I recall. It's actually easier for me to dust off my giant G5. And yes abecedarius another challenge you may find is that if you have the real Hypercard it would be a series of floppy discs which can no longer be read.

Side note: My other dream has been to run NeXTstep on my Mac -- I understand that can be done too, but it looks like a ton of work.

</comment></comment></comment></comment><comment><USER15> What about this project I've been working on:

\- HyperCard influenced design (Stacks/Cards)

\- Focused on mobile use, HTML5 with offline use

\- RESTful server component with git as the backend storage

\- Seperate web app for stack access & design

\- JavaScript as scripting language

\- Local Storage/offline cache for data storage

Been toying with it as a personal project - I have prototype working...

<comment><USER16> Sounds awesome. Any samples online?

<comment><USER15> I keep re-writing it... :-)

Taking the week off next week to work on this again - going to _start_ with a demo Stack online.

<comment><USER16> Well, good luck next week! :D

My team has been debating about building something similar for years. I just want it to exist!

</comment></comment></comment></comment><comment><USER17> I think one of the things that stands out is that if the patent laden litigious environment that exists within technology and software today was in effect in 1990 we would probably be still waiting for the internet...

</comment><comment><USER18> I used Hypercard and programmed some, as a teenage. It is a stellar example of how a tech inventor can think of openness vs closeness; www at CERN by Berner vs Hypercard by some typical Apple guy.

<comment><USER19> > "some typical Apple guy."

I'm not sure Bill Atkinson qualifies as just "some typical Apple guy." That aside, in 1987 there really wasn't a concept of "open vs. closed," at least not in its modern interpretation.

<comment><USER20> Indeed. In the 80s and early 90s there was a huge "public domain" scene, but no-one thought about source code.

<comment><USER15> I used BSD Unix on a VAX in the mid 80s - pretty sure that came will full source.

<comment><USER20> Right, but I am talking programs written by hobbyists on Mac, Amiga, ST, and so on.

</comment></comment></comment></comment></comment><comment><USER21> I remember playing Sabacc freeware on a HyperCard stack with my old LCII. Unfortunately I eventually figured out the pseudo-random card shuffling algorithm and it lost all appeal to me.

edit: Found it. <http://hem.passagen.se/johan99/files.htm>

</comment><comment><USER22> I learned hyper card in 6th grade middle school computer class, 1996. It really was great... I created games.

</comment><comment><USER23> Two things:

1) I miss HyperCard!

2) This seems to have been influenced by HyperCard: <http://www.citia.com> (Disclosure: I am not connected to them at all).

</comment><comment><USER24> HyperCard 2012 could be positioned as a better (and more powerful/useful) Powerpoint. Put it on the web and make it multiuser.

</comment><comment><USER25> One big lesson from HyperCard is the need to keep releasing updates.

HyperCard never got around to supporting _color_. At least, not properly; I think there were extensions to do it. HyperCard was released in 1987, the same year as the first color mac, but was only monochrome. The "Color Tools" came out in 1992(!) but still made life difficult by not treating color pictures the same way as monochrome pictures. Given that the whole idea of HyperCard was to have pretty graphics you can interact with, the lack of color was pretty crippling by the time most macs had color screens.

It was finally discontinued in 2004, and they'd _never_ got around to implementing proper support for color graphics.</comment>


Slow Data and Fast Sites: Deploy Searchable Apps with React, Middleman and Parse - <AUTHOR> http://willschenk.com/slow-data-and-fast-sites/

<comment><USER2> Solid.</comment>


BBM (BlackBerry Messenger) for iOS and Android is now live - <AUTHOR> http://us.blackberry.com/bbm.html <comment><AUTHOR> Direct app store links:

Android: [https://play.google.com/store/apps/details?id=com.bbm](https://play.google.com/store/apps/details?id=com.bbm)

iOS: [https://itunes.apple.com/ca/app/bbm/id690046600?ls=1&mt=8](https://itunes.apple.com/ca/app/bbm/id690046600?ls=1&mt=8)</comment>


Visual Design Specifications - <AUTHOR> I am in the position of being, metaphorically speaking, the bridge between a team of visual designers and developers. Making specs of finalized visual designs and hand over the devs. Is it making these specifications as CSS variables an ethical way of doing it and avoid the Zombie Styleguide? <comment><AUTHOR> And eventually, evolve these CSS Variables into a Design System? Having a set of variables defined can keep the design consistent rather than doing it old school by pointing out "XYZ px"on visuals.</comment>


Are Paul Graham and professional golfer Phil Mickelson long lost twins? (something fun for today) - <AUTHOR> http://web.mit.edu/mattz/www/pg/pg.html <comment><USER2> This has come up before

<http://news.ycombinator.com/comments?id=4043>

</comment><comment><USER3> PG is a Lisp hacker, I don't think he plays golf: <http://en.wikipedia.org/wiki/Perl_Golf></comment>


Runnit – Make Terminal Shortcuts - <AUTHOR> https://www.npmjs.com/package/runnit <comment><USER2> I hate having to write this, but this is what happens when you don't understand your shell(s) properly:

* Bash: [https://mijingo.com/blog/creating-bash-aliases](https://mijingo.com/blog/creating-bash-aliases) (TLDP documentation was pretty bad)

* Powershell: [https://docs.microsoft.com/en-us/powershell/module/microsoft...](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-alias?view=powershell-6)

<comment><USER3> I literally _cannot_ find a shell that I've heard of that doesn't support aliases. Surely some must exist, so I'd be delighted if anyone here could point me towards one.

<comment><USER4> The Thompson shell does not.

* [https://etsh.nl/](https://etsh.nl/)

</comment></comment></comment><comment><USER5> > runn cu "curl > [https://raw.blah/master/bin/runn.js"](https://raw.blah/master/bin/runn.js") > ; run cu

\-- vs --

> alias cu="nodejs <(curl -s > [https://raw.blah/master/bin/runn.js)"](https://raw.blah/master/bin/runn.js\)") > ; cu

I dunno man... aha.

</comment><comment><USER3> I clicked on the GitHub repo in the hopes that it was going to acknowledge that shells have aliases built-in but that this is somehow different. I'm afriad to say that appears not to be the case. Worst of all, you can't even use your shell's builtins with these "aliases". For example anyone who uses this and makes an alias with `echo` or `time` in it is going to be pretty confused.

EDIT: I hope the OP / author isn't too put off by the criticism. Props to you for writing something and sharing it, and keep coding! But also take some time to reflect on what you're building and the context of its use. Cheers!

</comment><comment><USER6> What's wrong with shell aliases? windows users?

<comment><USER7> A big wart in shell aliases is that you have to reboot all your terminal tabs/windows to see them.

<comment><USER8> Not _exactly_ true. You just need to re-`source` your dotfiles. For example, in Bash this looks something like `source ~/.bashrc`. I have this aliased to `src`, personally.

<comment><USER9> exactly. learn your shell kiddos.

</comment></comment></comment></comment><comment><USER10> The extent of the info on that page is:

      Run it!
        $ runn cu
      Boom!

Hard pass.

<comment><USER11> I think you may have misinterpreted it - the part you're quoting is how to run an alias, the previous couple of sentences are how to create one:

      Save it

      $ runn cu "curl https://raw.githubusercontent.com/shalithasuranga/runn/master/bin/runn.js"

      Run it!

      $ runn cu

</comment></comment><comment><USER12> when all you have is a hammer everything looks like a nail.

</comment><comment><USER9> ... so alias</comment>


Don't Go Pre-Med: My Advice to a Yale Student Worried About Her Future - <AUTHOR> http://calnewport.com/blog/2011/10/12/dont-go-pre-med-my-advice-to-a-yale-student-worried-about-her-future/ <comment><USER2> _Most of the people around me seem to think that the safest route for me is to go pre-med, because it is a well-defined path that leads to a stable career._

These people are idiots. The path to a successful career in medicine is a long and difficult one. There is no such thing as normal hours, you will be working almost all the hours there are. On top of that you will be poor until your 30s, at which point you will still have a staggering amount of debt. A career as a medical doctor is a calling. If you do it for other reasons (such as it being "safe") you will burn out.

<comment><USER3> I definitely agree with what you say about medicine. It's not always that simple though -- some people really feel parental pressure on their lives. And it's not just parental pressure, it's peer pressure too. On top of societal pressure.

I attended Yale and it feels like everyone is pre-med or trying to get into finance (consulting or investment banking). You sort of feel out of the loop if you're not doing these things (I was one of the dozen computer science majors in my year).

A lot of these people don't see the problems until it's too late. The perception by society is that being a doctor is a stable well-paying job -- most people don't take into consideration, like you said, all the tuition costs, and years spent in school.

If you go to Yale, you're expected to achieve great things -- that's just the societal pressure. Not everyone deals with it well. So some hide in the "safety" of what society expects, rather than pursuing their dreams. These people would be too embarrassed to pursue their dreams, if it meant say, being unemployed for years or working a minimum wage job. I suppose that's more of a pride issue, but sometimes it's borne of a want to please others (while unfortunately forgetting about self)

That said, she's not even at the school yet -- she'll probably change her mind when she gets there. Plenty of people do once they're given a chance to think for themselves in a new environment. But plenty of people also ending up burning out because they've pursued pre-med or finance without it really being their calling, or love.

<comment><USER4> I think she's already here since the article says "Earlier this fall."

But yeah, I'm a CS major at Yale too (sophomore), and I almost went the finance route. Over the summer I realized that doing something interesting >> any amount of money. A lot of kids here are pre-meds or future IB/consultants, but there are also a lot of kids who aren't and do all sorts of awesome things.

This year, there's also a much bigger interest in startups. Yale Hackers, HackYale, more speakers/tech-talks, YEI coding workshops, and a lot of other things point to people working on cool projects and doing what they like.

<comment><USER3> Ah nice! Yeah, I'm a part of PaperG which was part of the beginning of YEI (I think they say we're the first funded startup to come out of it). It's really awesome how things have grown in the last couple of years. I was pretty excited when I heard about HackYale -- something that should have been done long ago.

Feel free to contact me if you have questions about startup/Yale/CS stuff

<comment><USER4> What's your e-mail? It would be great if there was a better network for Yale students to talk to alumni. We have that career network but search is terrible unless you're looking for people in big companies. Actually, this gives me an idea... :)

<comment><USER3> Haha, indeed -- the Yale alumni database is super useful, but of course, you won't have access to that quite yet. YEI is helpful for tapping part of the network, but you're right, there's no real good way to do it.

You can find me at email@example.com

</comment></comment></comment></comment></comment></comment><comment><USER5> The only sad thing about the advice to take "core" requirements during your first year and then do your major in your second to fourth years is that it hurts CS majors (and presumably others) who then end up forced to take multiple heavy systems courses in a single quarter, usually due to pre-reqs or every-other-year offerings.

If you take Operating Systems and Compilers in the same quarter, you're just not going to be able to get as much out of them as you would if you took them during separate quarters.

Even if you manage to avoid schedule overload, it still means that you're only just finishing the basic curriculum tree near the end of your senior year. That's too late to start doing independent projects with faculty, which are really the easiest way to both give you a better-looking resume and to find out what the graduate school experience is like.

I see this frequently with the students at the UofC, which actively encourages students to do nothing but general distro courses their first year. That said, I'm also a little jealous! By the time I took freshman physics as a senior, I was far too busy with research to care about anything more than a passing grade, and I probably missed out on some fun party tricks.

<comment><USER6> I like Caltech's approach where freshman year is pretty much the same for everyone, except for humanities and social science where the requirement is just a certain number of units rather than specific classes. Everyone takes freshman math, freshman physics, general chemistry and lab, and biology freshman year (except those few who place out of them).

Students don't start taking specialized courses in their major until second year (they don't even have a major first year), when they take those alongside the required sophomore math and sophomore physics.

</comment></comment><comment><USER7> No. This girl shouldn't be figuring out what to major in, she should be trying to figure out what she wants to do out of college, and be majoring in whatever gives her the best leverage for that. (This is not a 1:1 mapping of Business & Admin -> Business & Admin. Taking a hard major is also good for impressing people in the field you want to go into.)</comment>


An Automatic Computer Science Paper Generator - <AUTHOR> http://pdos.csail.mit.edu/scigen/ <comment><USER2> This is most amusing. A link to one of their papers: <http://pdos.csail.mit.edu/scigen/rooter.pdf>

It really looks like a real CS sorta paper. If you actually spend a second to read it, at first it seems like most dense science reading, but then slowly you realize its just random babble.

The paper I linked even got accepted to a conference. Their grad student salaries couldn't afford it, but they got enough paypal donations to go! Kudos to them.</comment>


Hipmunk (YC S10) Acquired by Concur - <AUTHOR> https://techcrunch.com/2016/09/13/concur-buys-hipmunk-to-add-search-to-its-travel-and-expense-management-platform/ <comment><USER2> Hipmunk has been an excellent flight search tool, the best I have found as of a few years ago. Shockingly better than most of the rest of them back when it started, in terms of being able to understand and choose among numerous choices.

Unfortunately, that was then and this is now. Several of the airlines have dropped out of participating in flight comparison sites, and those that do apparently pay staggeringly little per referral. This is greatly eroded the usefulness of Hipmunk and similar sites, and taken away the motivation for anyone to pressure airlines to participate. Why bother when the most you can win is a tiny sliver?

I wish there is a way to simply pay a little money to get a comprehensive high quality comparison of all available flights from all airlines. I don't want AI, I don't want a travel agent to do it for me. I most definitely don't want to visit multiple airline websites and try to manually compare the offerings. I just want to see all of the different ways to get from point A to point B, in a well engineered graphical representation, all at once so I can quickly and effectively choose the best fit. I would love if there was a way to simply pay some dollars to do so.

<comment><USER3> What is the best flight search these days?

<comment><USER4> Google flights or matrix.itasoftware.com (you can't book here though)

<comment><USER5> Google Flights is simply a pretty UI around matrix.itasoftware.com, no?

<comment><USER6> The matrix has nice features like flexible dates on a multi-leg trip that Google Flights doesn't offer.

<comment><USER7> Google Flights has gradually added ITA Matrix stuff over time.

</comment></comment></comment></comment></comment></comment><comment><USER8> Anyone have insight into the sale price?

Hipmunk raised $55M over 7 rounds [1] and had 51 employees [2].

[1] [https://www.crunchbase.com/organization/hipmunk#/entity](https://www.crunchbase.com/organization/hipmunk#/entity)

[2] [https://www.hipmunk.com/about](https://www.hipmunk.com/about)

<comment><USER9> My guess is that, given it has not been disclosed, the investors got as much of their money back as they could through liquidation preferences and there's not much to get excited about after that.

<comment><USER10> The employees are probably (mostly) getting to keep their jobs.

</comment></comment></comment><comment><USER11> Concur's core product is shockingly awful. My company recently switched to it, and I don't know anyone who actually uses it. Most of us have figured out we get lower prices and less hassle by just ordering directly from the airlines / hotels and booking them to or corporate credit cards. If you're in a hurry, we can just call AmEx travel and pay $30 for them to book the trip for us using their travel agent terminals -- which of course have every flight from every airline. The end result is usually that we pay more for our travel and our company loses control; but honestly Concur's application crashes 90% of the time I try to use it with JavaScript errors, so I'm not sure it's really a viable solution in the first place.

The problem, of course, is the commoditization of the airline industry. Leisure travelers are, at this point, loss leaders that fill empty seats for their real business: consultants and sales people who travel 50-100+ flights a year. The industry is overly reliant on an increasingly shrinking segment of business travelers who fly on higher-fare tickets and often on short notice, so it does everything it can to make that kind of travel very painful UNLESS you do it all with a single airline and use full-fare tickets. If you thought air travel was unbearable on your last vacation, imagine how bad it is to do that 3 or 4 times a week -- so you try to consolidate to get a few perks like early boarding, lounge access or first class upgrades ( _nobody_ pays for domestic first class -- they're almost always loyalty upgrades).

So the real problem is that the airlines don't care at all about your $200 flight to Tampa to visit granny. They have to fill the seats to pay off the leases on the airplanes, but they make almost zero margin off of you because leisure travelers are so price-conscious. Business travelers are willing to pay an extra $300 for the ability to cancel their ticket on short notice, and often carry less baggage and cost less to serve. So the airlines try to lock in those types of customers with loyalty programs (which are so scaled back as to be nearly worthless unless you fly over 125 segments a year -- roughly 3 flights a week, every week of the year that's not a holiday), by making it harder to comparison shop, etc. and screw the little guys.

<comment><USER12> Concur is quite possibly one of the worst UI's I've ever used, right up there with IBM Rational Atria ClearQuest or IBM Lotus Notes.

<comment><USER5> I have no idea what Rational Atria ClearQuest but the name alone tells me it's awful.

<comment><USER13> I used to use Clearquest when I worked for a bank to hook up to their DB2 and Oracle databases. It was HORRID.

I got to use it with their own homebaked IDE, Rational Developer and VCS, called Rational Clearcase.

I look back at those years and still get shivers down my spine.

</comment></comment></comment></comment><comment><USER14> Hipmunk and Google Flights are my two go-to tools these days for beginning the search for flight tickets. I use Hipmunk when I know where I want to go and when, and I use Google Flights when I know I want to take a trip, but I'm flexible about both when and where.

<comment><USER15> I haven't used Google Flights -- will check it out -- but have taken a similar approach with Skyscanner.com. Basically, if I want to filter a trip based on price without regard to location or travel date. Really fun to play with!

<comment><USER16> Kayak has a nice tool for that too: [https://www.kayak.com/explore](https://www.kayak.com/explore)

Pretty amazing to find flights to Europe from LAX for under $500 for many destinations in Europe and Asia. Sub-$400 for some destinations too

</comment></comment></comment><comment><USER17> Congrats to the Hipmunk team! I've been using Hipmunk since the beginning, and have found it to be a pleasant way to search for flights. They obviously care a lot about creating a good experience for the customer, which is a lot more than I can say about the big travel sites.

I hope that the team had a nice exit, and that they continue to develop Hipmunk within Concur.

<comment><USER18> Unless tech crunch got things very wrong, they didn't.

The investors will get a base hit, the employees, nothing.

<comment><USER19> I bet the investors did OK. Some employees might get a nice retention package, but they'll have to sign a document stating their stock/options are now worth $0, so they can take or leave the retention deal.

The founders probably did OK, but they might have the same type of deal ($0 for their stock, except their retention is probably orders of magnitude better than any employee's).

</comment></comment></comment><comment><USER20> Concur feels like an odd company to acquire them, but maybe it's to streamline business travel?

Also -- I recently used Hipmunk (been using it for a few years now), but found that it didn't find deals that _Chase 's rewards portal_ found, which I thought was terribly odd (why would a rewards portal find better deals?).

<comment><USER21> The difference is Hipmunk is a metasearch site and relies on the connectivity it gets from travel agencies and airlines directly to power their price feeds and then you book with an agency/airline directly. Chase rewards portal is probably acting as a booking agent so may have access to prices/itineraries that are not found on metasearch sites.

</comment></comment><comment><USER22> what a shame... I've always loved Hipmunk and its "sort by agony" filter. I have to use Concur at work and I think it's pretty rubbish.

</comment><comment><USER23> The killer feature of Hipmunk for some of us is the ability to understand some of the ITA Matrix codes and so it's one of the platforms to book an interesting itinerary put together on the Matrix. (If you are interested in this, there is an up-and-coming service which tries to do same called bookwithmatrix and there's a userscript maintained on flyertalk adding booking links to the ITA Matrix itself.)

</comment><comment><USER24> Does this mean Hipmunk (the site) will eventually be going away?

</comment><comment><USER25> Hipmunk was cool when it first came out but I haven't used anything besides Google flight search in years. The speed of the interface alone justifies it.

It's either that or book directly from the site if it involves doing something special (ex: award travel).

</comment><comment><USER26> Their business class search has been broken for months, and they didn't care. Feels like they were on the way out.

</comment><comment><USER27> A flight search engine that I would be interested in:

The craziest routing.

Instead flying for USD 700 A->Destination or A->B>Destination Fly A->C>D>E>F>G>Destination

<comment><USER28> Airlines typically don't allow that (unless you buy one-way segments between those nodes).

</comment></comment><comment><USER29> Concur bought Tripit, which is now in the middle of a bit of a drawn out redesign. They didn't destroy that lovely product, so I have hopes!

</comment><comment><USER30> Congrats to Adam, Steve and team! Flight search is a tough industry to break into, and they did a great job against the odds to get there.

</comment><comment><USER31> Congratulations!

</comment><comment><USER32> Congrats Hipmunk homies!

</comment><comment><USER33> Congrats guys, I'm so happy the product will live on.

</comment><comment><USER18> My sincere condolences to all the option holding employees of Hipmunk who will not likely get back what they gave up in salary (due to liquidation preferences and the like, they will be lucky if they get anything, other than golden handcuffs.)

20 years and no equity has taught me that next time I do a start up, I want restricted stock, not options, with an exercise price of $0.01. Or founder stock. In fact, I think the only way to do a startup is a founder (unless you're just starting out.)

<comment><USER34> I sense righteous bitterness in this post, understand that your life experiences actually happened and respect you enough to come to the conclusion that your response is completely and totally legitimate. Are you comfortable with sharing your life/entrepreneurship story as a HN, reddit, Medium, etc. post or reply to this comment? If not to "get it off your chest" and "move on" so much as to protect others?

<comment><USER18> Thanks. I am doing that, a bit at a time. I'm not actually bitter, though I think I seem bitter. I am maybe cynical. (maybe they mean the same thing in practice.) But I'm doing well, and I'm not slowing down, I've just seen startup employees get a raw deal way too many times and think the entire "startup culture" is oriented in a way that screws over employees, particularly engineers (without whom software cannot be made. While other functions are absolutely critical too, that doesn't mean the people in those other functions should work 30 hour weeks, and take home most of the payday.)

One of the reasons I'm not bitter is that the VC industry is dying. IT's not obvious yet, but like the headphone jack, its days are numbered.</comment></comment></comment>


There Is No "Linux" Platform - <AUTHOR> https://blogs.gnome.org/tbernard/2019/12/04/there-is-no-linux-platform-1/ <comment><USER2> How GNOME-centric!

> Desktops like GNOME have expanded their scope to cover most of the > responsibilities of platforms, and are in effect platforms now [..., ] app > developers target them directly.

> the actual product work is happening at the desktop layer now.

Nope. I understand that from GNOME's point of view it seems this way, but in really most people don't care about desktop layer, unless it crashes or otherwise gets in a way.

In the place where I work, we have hundreds of Linux developers developing Linux products for Linux desktops. We have all sorts of desktop environments on our machine -- GNOME, KDE, LXDE, etc... But we don't care about "platform stylesheet and icons" \-- as long as apps run, it it fine.

(Yes, we are working on a very specialized segment, our products are not likely to be available to download by general public. But in my experience, this is a pretty common thing for software development in general.)

</comment><comment><USER3> Funny how this GNOME article left out KDE. It feels more integrated than Windows. For example, music pauses when I get a phone call using KDEConnect. There's also a developer SDK (including abstractions for Linux libraries or freedesktop libraries) and a design language with tooling (Qt). You can develop software for KDE without having to know much about Linux itself.</comment>