GIT is the new FTP - <AUTHOR> http://coderwall.com/p/xczkaq <comment><USER2> Every time someone comes up it with a "cool" way to deploy via Git, it turns out their definition of "deployment" is nothing more than dumping something on a server. It completely ignores every aspect of deployment other than putting the files somewhere else, which is 5% of the work and 1% of the complexity of deployment.

That's not even a sufficient professional scenario for anything but the simplest of non-essential website. Hell, this won't even do for the simplest of WordPress sites.

BTW, who on earth still uses FTP?

<comment><USER3> _BTW, who on earth still uses FTP?_

I use Transmit to FTP updated files to my web server. Then I send smoke signals to my colleagues to inform them of the changes, and document the updates on a papyrus using quill and ink. Should I be doing it differently?

<comment><USER4> I actually assumed "smoke signals" was some sort of Mac app that I didn't know about (it actually sounds like it could be a 37 Signals product). I even wondered if "papyrus" was a team-management wiki or the like. Then I got to "quill and ink" and realized you were joking.

<comment><USER5> He wasn't joking. "Quill and ink" was a Microsoft prototype tablet.

</comment></comment></comment></comment><comment> loup-vaillant Err, what about rsync? My blog is versioned with git, but compiled with USSM¹. I don't want to version the generated html code, so I deploy it with a one line shell script that just calls rsync through ssh. Simple, and fast.

So in my case, rsync looks better than git at deployment. I can't imagine a scenario where the reverse is true. Does someone have a counterexample?

[1] My home-made Jekyll clone: <http://loup-vaillant.fr/projects/ussm/>

<comment><USER6> An alternative, if you do want to use VCS for deployment, is rather than versioning the compiled HTML, create a hook that compiles it.

My website is stored in mercurial currently, and when I push to the server it runs bundle and compiles the site.

</comment></comment><comment><USER7> This tutorial is missing a lot of steps. It therefore expects the user to know how to use Git in order to consistently commit and push their changes under such a scheme. If the reader is a self-sufficient Git user (i.e. doesn't need a full step-by-step walkthrough), they wouldn't need this tutorial.

Anyhow, this scheme sort of old hat for Git users. Most of us require a build to deploy code, which generally results in SCM-polling continuous integration solutions like Jenkins to fully automate the preparations required to run new code.

This blog post sort of suggests a WordPress crowd's version of continuous integration. Go ahead and use it for a blog theme, or a set of assets. If you're doing this for a web application, you're probably doing something wrong.

<comment><USER8> Hello, I am learning git. Even if this tutorial does not comply to the rules of the art or omit basic git knowledge, it fits exactly my actual learning level. I have read the most basic tutorials and this kind of "almost second" level tutorial is perfect to have a better understanding of how pieces fit together.

Thank you Kerrick Long

</comment></comment><comment><USER9> The very first sentence is why Git is _not_ the new FTP:

> First, create a directory on your server and initialize an empty git > repository.

The number of people who deploy sites via FTP who also have SSH access and the ability to install Git on their hosting is small. Most people deploying to the web do not control their own servers.

<comment><USER10> I almost got kicked off of my old shared host for installing Java on my machine after I faxed them a copy of my driver's license to get SSH access. Got myself a shiny new VPS a few months ago and haven't looked back. I can finally do things I could only dream about with the shared host.

</comment></comment><comment><USER11> Unfortunately, this doesn't take into account the fact that stuff you keep in your development repository is almost never identical to stuff you want on your deployment server. There are files you keep in the former but not necessarily want/need in the latter (unit tests, documentation, etc.). Similarly, there are stuff to be put on deployment server which don't want to clutter your dev repository, like compiled CSS/JS assets.

As other have said, deployment should really be done by continuous integration server, and preferably using a protocol that's designed for transmitting files, not version control.

</comment><comment><USER12> Wow, my coderwall post got posted to HN? That's pretty cool! Interesting title choice, though... FTP will still be useful for a long time.

I didn't really write this as a tutorial as much as an easy way for me to look back and find the commands when I have a forgetful moment. That's why it doesn't go into explaining how or why things work, explaining how to set up git, explaining how to set up your web server to serve files from a directory, or other preliminary information.

<comment><USER13> That's interesting, haha. Would you or somebody be willing to give explanations for the instructions?

</comment></comment><comment><USER14> Just a bit feedback on the blog: The background image was very distracting for me. My eyes were always wandering off from the text. Not sure if that's just me or if others had that problem too.

<comment><USER15> Me too.

Had similar problem with a site called TVCatchup. They stream free TV in the UK. Their player sits in the middle of the page and that is surrounded by an advertising border. Nothing else on the page of consequence. What I found was that I found it very hard to focus on the player in the middle. Often I would get a headache watching. Told the admins, who didn't want to know. Basically I got an angry "Foxtrot Oscar". Ended up using an ad blocker until they found a way to defeat that. Now I don't use the site any more.

<comment><USER16> Completely off topic, but TVCatchup provide an XBMC plugin which completely avoids the advertising they add. No idea why, since it presumably destroys their business model, but it's great.

</comment></comment></comment><comment><USER17> I would rather say ssh (scp) is the new ftp.

<comment><USER18> I just found out recently that SCP is horribly slow when transferring lots of small files. I found a blog post showing how to send compressed tarballs over SSH and it worked really well:

ssh username@from_server "tar czf - directory_to_get" | tar xzvf - -C path_to_save

<comment><USER19> ...or use rsync?

       rsync -avz somehost:/path/to/src /path/to/dest

<comment><USER20> For a more accurate sync, you can also delete obsolete files on the destination:

        rsync -avz --delete src dest

This assumes there are no files you want to keep on the destination, of course. You can exclude them or reorganize to keep them safe.

</comment></comment></comment></comment><comment><USER20> This is clever, but the idea of serving a website directly from a repository makes me very uncomfortable. If you already have git and ssh access on a server, then you probably have rsync access, as well. I simply include a Makefile in my repo with a publish target that runs a command like this:

        rsync -avz --exclude '*.swp' --delete site/ $(WEBUSER)@$(WEBHOST):site/

This way I'm only putting the necessary files on the server and transferring changes is incredibly fast and secure (ssh is used by default).

In rare cases where I need to deploy from a repo on the server, I'll clone it to the remote host and use rsync locally to copy the files. But I still avoid serving directly out of the repo. There's too much sensitive information in version control to even risk exposing it during a misconfiguration.

<comment><USER21> I'm curious what kind of sensitive information you're concerned about exposing. I don't mind deploying with rsync--in fact, I'll do it quite a lot when the remote host lacks git--but I'd usually prefer to use git where possible.

I typically deploy with a similar setup that you described, but instead of rsync'ing the files locally I just make a clone of the repo and serve that. Though it is another step to fetch/merge, it stops me from losing any changes that someone did to production without telling me.

I only recently used Capistrano to deploy a project and it was very satisfying, so I'm gravitating towards that as my default deployment method.

<comment><USER22> > I'm curious what kind of sensitive information you're concerned about > exposing

+1. Secrets should not be in your VCS repo. I'd guess the parent is talking about user/pass or pub/priv key creds.

I really wish "we" had better tools for passing around config, and secrets in particular. Chefs data bags are close, but I still don't want the master knowing my secrets.

</comment></comment></comment><comment><USER23> In my node.js application I use the excellent Up[1] library along with the Up- Hook[2] plugin.

This allows me to update my code locally, push to github and have my server automatically download the changes (using girror[3]) and update the code, all with zero downtime.

What I like most about it is that it's all nicely contained inside the same code as my application!

[1] <https://github.com/LearnBoost/up> [2] <https://github.com/LearnBoost/up- hook> [3] <https://github.com/node-migrator-bot/node-girror>

<comment><USER24> I like this girror thing, it looks like it will fit my non-node projects much better than Capistrano's awkward git integration. (For some reason you linked to a fork, but it's no longer current)

<comment><USER23> woops! the correct link is: <https://github.com/eladb/node-girror>

</comment></comment></comment><comment><USER25> Wouldn't this approach also put the .git directory below ~/www, making it accessible to the world? That might not be such a good idea.

<comment><USER26> Hidden directories are usully not accessible from outside I think.

<comment><USER27> I had to change my Apache config on OS X 10.6 _exactly_ because I was leaking .svn directories. Unbelievable.

</comment></comment></comment><comment><USER28> When git software is easy for ordinary people to use and install on windows, easy enough that people are using it to share porn and pirated material, then maybe it will be like ftp.

As it is to run git on windows you, best case, have to install a lightweight nix OS. Cygwin mingw,whatever. I think we techies and power users don't realize how messed up that is if you want git to be more than a program for programmers. Ftp was a protocol, you could make a native client for everything. Git is a great tool, but not yet comparable to ftp.

</comment><comment><USER29> Once, I had to maintain a website on godaddy, where I only had ftp access. I hated it. We would have interns working on it, and giving them the ftp password sucked. Having git as a proxy, hooked to sync master on ~/www and staging on ~/www/staging was awesome. If you want it: <https://github.com/ezyang/git-ftp>

</comment><comment><USER30> If you do this make sure you set the permissions such that it is not possible to make changes to the files on the server independently of the remote otherwise next time you push you'll end up with conflicts and, if you're using an interpreted language, the version control markup that indicates where the conflicts are in files will break your code and bring down your website.

<comment><USER31> Best way to do this is to init the remote repository using:

      git init --bare

<comment><USER32> Bare repositories cannot have a working tree.

        fatal: core.bare and core.worktree do not make sense

</comment></comment></comment><comment><USER33> We use TeamCity and deploy right from our build server. We have a build configuration called "Deploy" that requires a couple parameters - the artifact to deploy, the environment to deploy to, and the build number (so we can deploy past builds, ie roll back). Our application software is built of a series of distributed .war and .jar files, but each represent a complete "service" within our system, and can be upgraded independently. This means we can deploy single artifacts and not cause conflicts within the overall system.

When we click the build button, a small Python script is called that rsyncs over ssh the already built artifact (pulled in from the existing TC build) over to the environment, which runs JBoss, and gets auto-deployed.

For our developers, our build process amounts to committing their code, getting an email from TeamCity when the build completes, then clicking the Deploy button. The tools take care of the rest, and we end up with a nice trail of logs available in case anything goes wrong, and a clear rollback strategy.

We also don't get an ever-growing git repository, or have to maintain a bunch of FTP configuration. Everything is done over ssh via passwordless pki. Best of all, it didn't take long at all to set up (the longest part was probably writing the python deployment script, which has some basic logic to know which environments live at which addresses, and also how to run some post-deploy commands for the 1 non-JBoss deployed .jar based service we have).

It's not perfect - we don't have an automated database migration mechanism right now, though in a distributed system like ours I'm not entirely sure one would work at this point (and we've got other plans to deal with that weakness anyway). I'd also like to move to Hudson or Jenkins at some point, as there is a real attraction to the rich ecosystem there (TeamCity is a commercial product).

</comment><comment><USER34> One problem with this technique is that over time you will end up with more and more data on the production server, even stuff that has since been deleted. Even for a small website over the course of a few years can end up being GBs of wasted space which on production VPSs can be quite expensive.

<comment><USER35> Also, if your production server is breached, attackers can mine that data, for example for that accidentally checked-in password, or to search for security fixes that other sites might not have applied.

</comment></comment><comment><USER36> Using post-commit hooks to handle your deployment for you can have undesired effects if your scripts aren't perfect.

I would recommend looking into continuous integration over this method. I've been using TeamCity for just over a year and it is fantastic for a staging environment.

</comment><comment><USER37> Reverting a push should be at least as fast and easy as the push itself. This minimizes downtime if you introduce a new bug. (Which I know you, the reader, would never do, but other people might, so this is for them.)

Using this workflow, if you break your site, reverting would require either a) fixing the bug and then doing another push or b) looking up and typing in the hash of the last known good commit. Neither of these are as fast and easy as "git push".

Our solution is to deploy with tags. Every push to production gets its own tag, and that is what we checkout into production. If the site breaks, you just checkout the previous tag name and you're reverted. This way reverting is exactly as easy and fast as pushing new code.

<comment><USER38> You could even streamline it a bit, by having a 'previous' branch that you automatically sync with the previous tag on deploy. So if something goes wrong you can always just `git checkout previous`.

</comment></comment><comment><USER39> No it's not. Let's revisit this in 5 years. We'll still be using FTP. Thanks though. :)

</comment><comment><USER40> Best move I did for a past client was getting them to deploy using Assembla's FTP tool. There is essentially a post-commit hook in their SVN repo that automatically pushes to the test environment on every commit. Deployments to prod use the same tool, but it is manually triggered rather than on every commit. (Competing for best move, was getting them to have separate test and prod environments.)

If you (or an unfortunate client) are using a cheap shared host that only provides you with FTP, this approach at least guarantees that the only code on the site is what exists in your VCS.

</comment><comment><USER41> I almost never FTP stuff except when I have to get a single, unimportant file somewhere or if we're sharing stuff between friends' houses.

Springloops has a useful deploy-by-ftp feature. When you commit a change using their Subversion host it automatically pushes it out to the development or production server.

It's easy for designers to use since they can update a jpg or two for a client, commit a change, then hit refresh on the live site and it shows up.

I know it's not perfect, but for small web shops and non-technical people, it works great.

</comment><comment><USER42> As someone who uses FTP (it's all I've ever known, at work I just check my work into CVS and I have 0 idea how the build process works), what would be a better way to deploy a website?

<comment><USER43> It depends on the site, and the stack you are using to manage it, but ideally you would have the following features.

1\. All assets are under version control.

2\. Committing code of any sort (HTML, CSS, Javascript, Ruby, Python, PHP, ...etc) triggers the unit tests and a failure of the unit tests prevents the commit from completing. #unit tests should take n < 3 seconds

3\. Pushing the code to the deploy repo (or branch) triggers the acceptance tests (behavior driven tests that look at the functionality of the site overall, account creation, login, profile_view, checkout) failure of the acceptance tests sends an email to the whole team. Code changes affecting security sensitive modules should be considered failing until they have been manually qualified (e.g. anything touching passwords or money).

4\. If the acceptance tests pass and no critical modules were affected by the commit, that commit gets deployed into the production environment. That fact is recorded on the dashboard and emailed to the team.

This is difficult to achieve but once reached, it's like being over the step on a boat that hydroplanes; friction is reduced and you get greater velocity for the power expended.

</comment></comment><comment><USER44> I built a system to deploy to our test servers that uses a git repository on the test server, clones the repo into a named folder, and checks out a specific branch. QA is able to use a webpage to select a branch, which is automatically checked out in its own folder and a subdomain or cookie is used to do isolated testing of that branch.

So for us, git is an important part of our deployment process, though there's more that goes on especially for production deployments.

</comment><comment><USER45> The first thing that came to mind after reading this post's title was insecurity (e.g. .git directories accessible in the wwwroot)

Isn't that what FTP is most known for - being insecure?

<comment><USER46> I agree the blog post should warn about it - but it can be perfectly secure if you do it correctly. I usually put all public files inside a directory inside the repo, e.g. public_html, and/or block access to dot-files altogether in the server configuration. E.g. in Apache 2:

      <Files ~ "^\.">
          Order allow,deny
          Deny from all
      </Files>

</comment></comment><comment><USER47> I'd question the assumption that ftp was ever the old ftp, if by "ftp" we mean "deployment channel to production services". As soon as your web site is complicated enough to need a database, you have database migrations or their moral equivalent to worry about as part of the upgrade process, an simply dumping files in a directory somewhere doesn't cut it

</comment><comment><USER48> I've been looking into git (or dvcs generally) for deployment and have realised that deployment is like the inverse (dare I say dual :) of normal version control.

vc: metadata (permissions) are irrelevant. dep: metadata is critical

vc: version everything by default (explicitly exclude) dep: version by explicit inclusion

I've have a doc with numerous links and notes that I should share sometime.

</comment><comment><USER49> I thought SCP was the new FTP. Or rsync.

<comment><USER50> git is closer to rsync than to ftp. scp and ftp are file transfer protocols, while git and rsync are higher-level systems that can use other underlying file transfer protocols

</comment></comment><comment><USER51> I feel, Your exact method might be useful for Test servers. I won't want all my git pushes reflect on the live server. For deployment, I think it's better if one maintains the post-commit-hook to a certain branch, named, say, "Deploy". Any push to Deploy branch would make it deploy maybe?

<comment><USER52> That sounds exactly like a system I set up with Jenkins a while back. It would deploy to a test server and run the tests from any branch. If you pushed to the deploy branch, it would deploy to the real server assuming all the tests passed.

The actual deploying and testing was all done with Fabric, but the idea was the same.

I think that's a pretty good case for using a CI system like Jenkins, especially because it's _really_ easy to set up. It didn't support Git by default, but there was a plugin that was both easy to install and fairly comprehensive.

</comment></comment><comment><USER53> I think posts like this tells you only part of the story. Ops it is not just pushing code live.

I'd be great they explain how to know which code is live (ie. tag "releases"), how to revert to a previous version (ie. something went wrong), potentially something needs to be restarted, etc.

</comment><comment><USER54> FWIW if you use Bash shell you can also use history expansion to shorten the mkdir && cd line further (the line already includes tilde expansion):

      mkdir ~/www/example.com && cd !$

!$ is the last argument of the preceding command

<comment><USER24> You mean "$_". !$ refers to the previous command in the history.

<comment><USER55> !! refers to the previous command in the history. !$ refers to the last cmd- line option in the history.

<comment><USER24> I know that, the bit I want to emphasize is that it won't be the mkdir argument that is on the same line.

</comment></comment></comment></comment><comment><USER56> I could do automated deployments via FTP (I wrote scripts to upload certain parts of a project during the build process) with a cron job on the server. Just check for changes and do the real "deployment" stuff on the server itself.

</comment><comment><USER57> Here is the same principle, but better documented: [http://www.saintsjd.com/2011/03/automated-deployment-of- word...](http://www.saintsjd.com/2011/03/automated-deployment-of-wordpress- using-git/)

</comment><comment><USER58> There was a post yesterday about deploying small sites and I mentioned that svn export was the way to go, not thinking that there really is no simple git equivalent.

You can do a one-liner with git archive but I don't think it's as easy.

</comment><comment><USER59> While people are not too hot on the idea of pushing the git codeline to the production server, the same idea is actually pretty good for kicking off a build or running test suits after a git push.

</comment><comment><USER60> afaik serving websites from your home dir is a bit odd, since the user running nginx/apache shouldn't have access to it, something like /var/www is way more common.

and asuming you don't just use git for deployment but also for it's core purpose version control you should setup the origin to the actual origin and name the remote where you push to accordingly (production, dev, test, staging) and you shouldn't set it as the default push, to avoid excedently deploying when you just wanted to checkin the code to the origin repo!

</comment><comment><USER61> text looks very much like a copycat of this tutorial, minus all the explanations: <http://toroid.org/ams/git-website-howto>

<comment><USER24> No, the toroid one is much better because it changes the worktree to export the data. That way the git directory won't be exposed to the web server.

</comment></comment><comment><USER62> I've been following this <http://toroid.org/ams/git-website-howto> for several years now.

</comment><comment><USER63> saying that git is the new ftp is to my mind not correct. I read that git doesnt handle big files very well the coder from the backup tool "bup" has written. That was why he invented bup.

Correct me if I am wrong, I would really love to replace ftp with git.

<comment><USER53> You're right. git may require lots of RAM for big changesets (involving big files), and definitely more RAM than SFTP (oh, please never use FTP).

But the post is about deployments and not about transferring files.

</comment></comment><comment><USER50> As used, I think the more appropriate comparison is

        GIT is the new RSYNC

</comment><comment><USER64> For non-technical users, dropbox (self hosted) is a good replacement for FTP, IMO

<comment><USER65> How do you self host dropbox?

<comment><USER64> [http://www.readwriteweb.com/cloud/2011/05/4-ways-to-build- yo...](http://www.readwriteweb.com/cloud/2011/05/4-ways-to-build-your-own- dropbox.php)

[http://lifehacker.com/5821145/how-to-set-up-a- file+syncing-d...](http://lifehacker.com/5821145/how-to-set-up-a-file+syncing- dropbox-clone-you-control)

</comment></comment></comment><comment><USER66> This is kinda what Heroku does, right?

</comment><comment><USER67> can anyone recommend a tutorial for diving into git?

<comment><USER68> The book on the Git website (Pro Git) is an easy read (at least to begin with): <http://www.git-scm.com/documentation></comment></comment>


My HP laptop transmits built-in mic audio on ~38 MHz, also with deactivated mic - <AUTHOR> https://www.reddit.com/r/RTLSDR/comments/3ocxx3/my_hp_laptop_transmits_builtin_mic_audio_on_38/ <comment><USER2> That is kind of interesting, I wonder how it got through EMC testing.</comment>


How much a baby is touched leaves measurable effects on DNA methylation (2017) - <AUTHOR> https://www.miamiherald.com/news/nation-world/national/article186889938.html <comment><USER2> Hmm...

I have three children - and all are intelligent, beautiful well adjusted kids. 5, 7, and 15.

One thing I made a point of as each was born - I maintained as much physica contact with each immediately after birth. I didnt allow them to leave or be examined without me there, touching them.

I did it not for the posted reasons, but just beacuse it felt right to me.

ALso - I would hum and sing to them a tune while they were still in the womb.

As soon as they came out, I held them and sang and hummed the same tune to them. It immediately calmed them - with my first, she immediately relaxed and stopped crying whil the nurse took her vitals, measurements and pricked her heel.

It was magical.

<comment><USER3> Not sure how much it is related, but I learned how touch has a powerfully lasting impact when I read about babies from an underfunded Hungarian orphanage having lots of health problems later in life because of how little they were touched.

<comment><USER4> Seems very probable that an underfunded orphanage will have other areas like healthcare, sanitation and nutrition lacking as well. Was there something specific about what you read that related to touch?

<comment><USER3> [https://www.livescience.com/21778-early-neglect-alters- kids-...](https://www.livescience.com/21778-early-neglect-alters-kids- brains.html)

[https://www.nytimes.com/1988/02/02/science/the-experience- of...](https://www.nytimes.com/1988/02/02/science/the-experience-of-touch- research-points-to-a-critical-role.html)

This was something I quickly found. I can't seem to find the very article I read however.

<comment><USER4> Years of neglect is quite a bit broader than just touch. I would expect years of neglect in early childhood to have a long lasting effect on the mental development of kids.

</comment></comment></comment></comment></comment><comment><USER5> The epigenome isn't some mystical thing, it's just a manifestation of the environment on cellular function. These kinds of sensationalist articles are exquisitely frustrating as a genomicist.

<comment><USER6> You need to give that knowledge time to spread. The vast majority of living adults learned in school that the DNA is fixed and the surrounding stuff is just junk. Eventually everyone will know about epigenetics but how else would you spread the information if not with articles like these.

<comment><USER5> A few months ago, I spoke to my uncle, who's an endocrinologist at a medical school, and when I told him "Your organs are different because of epigenetics" a lightbulb went off in his head. I think outreach is just doing am awful job of explaining epigenetics. Even his colleagues in genetics hadn't really been able to explain it very succinctly.

Instead, articles are full of explanations like this one, leading you to make outlandish conclusions. Hell, even in one of my community outreach events, a farmer came up to me afterwards and said he doesn't want to grow any crops with methylated DNA.

</comment></comment></comment><comment><USER7> It's very hard for a non-expert in the field to estimate the correlation vs. causality fallacies in a study like this.

<comment><USER8> This is an example of the sort of cases in which I worry that experts become clouded by zealotry; I think it's more likely that a generalist-at-a-distance will poke the right holes in the methodology of these kinds of studies.

<comment><USER9> I wonder why they don't have independent statisticians review each paper doing statistics? Seems weird and abusable that only people from the same subfield reviews the papers.

<comment><USER10> It's hard enough to find reviewers in the same field. I imagine finding statisticians to review papers from fields they don't care about would be problematic. You probably know that reviewers work for free.

</comment></comment></comment></comment><comment><USER11> IIRC DNA methylation (sp?) is used in blood tests to determine the rate at which you are aging biologically. This article does claim that the children who are touched less _develop_ at a slower in addition to having a lower DNA methylation. So in a sense, the less a child is touched, the slower the child ages biologically according to this marker and observation.

Anecdotally, there are environmental situations where animals can significantly increase life-expectancy but at the expense of delayed sexual maturity.

It would be interesting, but of course not conclusive, to see if these children experience puberty later and if they also live longer. Perhaps some neglect has some benefit.

<comment><USER12> That would make a good sci-fi - an army of sociopaths that live until they're 200 years old.

<comment><USER13> Star Trek II The Wrath of Khan is basically this.

</comment></comment></comment><comment><USER14> Actual study this article is referencing:

[https://www.cambridge.org/core/journals/development-and- psyc...](https://www.cambridge.org/core/journals/development-and- psychopathology/article/epigenetic-correlates-of-neonatal-contact-in- humans/9BD9799A7C6E0859B93E092EA0727A4B)

Abstract:

Animal models of early postnatal mother–infant interactions have highlighted the importance of tactile contact for biobehavioral outcomes via the modification of DNA methylation (DNAm). The role of normative variation in contact in early human development has yet to be explored. In an effort to translate the animal work on tactile contact to humans, we applied a naturalistic daily diary strategy to assess the link between maternal contact with infants and epigenetic signatures in children 4–5 years later, with respect to multiple levels of child-level factors, including genetic variation and infant distress. We first investigated DNAm at four candidate genes: the glucocorticoid receptor gene, nuclear receptor subfamily 3, group C, member 1 (NR3C1), μ-opioid receptor M1 (OPRM1) and oxytocin receptor (OXTR; related to the neurobiology of social bonds), and brain-derived neurotrophic factor (BDNF; involved in postnatal plasticity). Although no candidate gene DNAm sites significantly associated with early postnatal contact, when we next examined DNAm across the genome, differentially methylated regions were identified between high and low contact groups. Using a different application of epigenomic information, we also quantified epigenetic age, and report that for infants who received low contact from caregivers, greater infant distress was associated with younger epigenetic age. These results suggested that early postnatal contact has lasting associations with child biology.

</comment><comment> 08-15 Even if this result is real (I smell bad statistics), it's completely useless.

All cells in our bodies have the same genome. But a hepatozyte and a neuron are very different cells, aren't they? The difference is that cells specialize, and they do so by selectively methylating their genome (not the only mechanism, but an important one), thereby modifying the expression of genes. So a liver has a very different epigenome than the brain of the same person. Now here we're looking at a study of the saliva epigenome, apparently the most important tissue they could come up with.

Then they don't analyze the epigenome in any interesting way. Generally, the more a cell specializes, the fewer genes are active. Expressing this as "more mature" is rather dumb. "More geriatric" would be equally appropriate. Does it not matter at all, _which_ genes are methylated?

So, let's summarize the study properly:

"If you don't touch your child enough, his saliva with age more slowly."

<comment><USER15> Can you back up your implication that the saliva epigenome has no other meaningful and impactful correlates?

<comment> 08-15 Why do you expect me to prove a negative? These "scientists" (really just tinkerers) need to argue for their implicit claim first.

But they don't. They take the (correct, but hardly useful) statement "methylation generally increases with age" and instead say "with maturity" to make it sound impactful.

</comment></comment></comment><comment><USER16> Not too surprising that earliest experiences in life are going to color an individual's expectations of the world, and how to respond to it.

"consequences on the epigenome" as the article so charmingly puts it.

<comment><USER17> > "consequences on the epigenome"

Indeed such a stupid phrase. Any dynamic activity in the body, every process or change which happens due to dynamic actions during life is technically a consequence on the epigenome, because it requires some cells/organs to change some chemical reactions, produce more of this stuff and less of that stuff - it requires activating some genes and deactivating other genes. You drink tea - it has consequences on the epigenome. You think happy thoughts instead of sad ones - it has consequences on the epigenome... You excercise - it has consequences on the epigenome...

<comment><USER18> Your talking about the epigenome has consequences on the epigenome.

</comment></comment></comment><comment><USER19> I think there is a high chance that is 100% bullshit.

Most likely has to do with confusing cause-and-effect.

It could be just as well that highly methylated babies cry more and could be more demanding or parents with highly methylated babies are themselves less tolerant to crying thus end up handling babies more.

The problem, they way it is being reported, and they way it lines up with pseudo-scientific mumbo-jumbo groupthink makes it stink. That's why it is newsworthy. People _want to believe_ that handling a baby will change their DNA.

Same bullshit like papers like this:

\- Scientists Say They've Found a Code Beyond Genetics in DNA - [https://www.nytimes.com/2006/07/25/science/25dna.html](https://www.nytimes.com/2006/07/25/science/25dna.html)

<comment><USER20> I'm not a professional scientist, but shouldn't the spirit of science be curiosity and exploration at all times, not shooting down a new idea as soon as you hear it?

If such an attitude were present in every person, science would not progress at all.

I'm not that long a veteran here, but I think at HN we are more interested in having our minds and ears open and feeling we can comfortably share and discuss articles that make us think, than fostering an attitude like this.

I mean this with respect, whoever you are.

<comment><USER21> I think that science works best if we marry two mindsets: the joy of seeing something novel, and the suspicion of seeing something too good to be true. They don't have to be present in equal measure for every article, and while I wouldn't word it the same way as the parent, I appreciate the healthy skepticism on this topic.

<comment><USER22> Yes: a good reasoner is charitable _and_ critical. You need both.

</comment></comment></comment></comment><comment><USER23> N = 100, and all of the physical contact data seems to have been reported through journaling by the parents. I wonder if that data is actually reliable.

</comment><comment><USER24> Wait... Does our DNA change as we age??

If so, to only sample the DNA _after_ the study and not before seems crazy.

<comment><USER25> The article is talking about methylation, which I always interpret to mean they're referring to the epigenome. It doesn't change our DNA, so much as the expression of it.

<comment><USER26> How much state is in the expression of DNA? Will all this type of state be lost eventually, or is there also persistent state in the expression of DNA?

<comment><USER27> The field of study is called Epigenetics [1]. I know practically nothing about it, but it seems that some of these alterations to the expression of DNA are not only persistent, but can also be inherited. Which is why some of these discoveries have been called a revenge of Lamarck over Darwin...

[1] [https://en.wikipedia.org/wiki/Epigenetics](https://en.wikipedia.org/wiki/Epigenetics)

</comment></comment></comment></comment><comment><USER28> So, just how mutable is the DNA? For the sake of the discussion, I don't know anything about DNA that I can say I didn't get from a sci-fi flick.

<comment><USER29> There's a special thing called "Epigenetics". The genes coded in DNA don't change. But how they're used can change.

There's methyl groups that attach to the DNA. These stop parts of the DNA being read.

There's Histones which wind up your DNA and control how much can be read.

These are used control which parts of DNA are used by which cells. Evey cell has the same Genome, but each cell needs a different program to function, so changing the _Gene Expression_ you get a different kind of cell.

</comment></comment><comment><USER30> I initially misread as "How much a baby is touched _by_ leaves [leaves] measurable effects on DNA."

Leaving me with an idle question: has the effect of interaction with plants on child development been studied?

<comment><USER31> Ditto :D

</comment></comment><comment><USER32> This interview sounds like unpublished bullshit, it would never stand reviewing. To claim this from the survey they conducted is just wrong. Every science student learns about the difference between causation and correlation.</comment>


Hooking C Functions at Runtime - <AUTHOR> http://thomasfinch.me/blog/2015/07/24/Hooking-C-Functions-At-Runtime.html

<comment><USER2> That's a lot of work for something that the dynamic linker on OS X supports out of the box. See, for example, [http://toves.freeshell.org/interpose/](http://toves.freeshell.org/interpose/) or search for "OS X interpose" on your favorite search engine.

</comment><comment><USER3> Interesting.. in the linux/unix world I've always intercepted functions with LD_PRELOAD. I'm guessing that's not an option on OS X?

<comment><USER4> DYLD_INSERT_LIBRARIES is more or less the OS X equivalent of LD_PRELOAD.

<comment><USER2> With a big bias towards "less". Dynamic linking on OS X uses strong binding (unless you specifically link your binaries with the option that disables strong binding). That is, symbols are associated with libraries. So for example, when your program wants the symbol for e.g. malloc, the symbol table will also have the information that the symbol is in libSystem.dylib (or whatever the lib for that is), and the dynamic linker will pick malloc from there, even when DYLD_INSERT_LIBRARIES contains a library exporting the malloc symbol. On GNU/Linux at least, even with symbol versioning, which adds some binding information linking symbol version names to library names, ld.so still resolves symbols with versions to the symbol exported by a library in LD_PRELOAD.</comment></comment></comment>


Phaser 2.4 Released - <AUTHOR> https://github.com/photonstorm/phaser/#whats-new <comment><USER2> Phaser is the perfect framework to get started making HTML5 2D games. I can't wait to look into this new release!

If you want to learn more about Phaser, you can check out my Flappy Bird tutorial here: [http://blog.lessmilk.com/how-to-make-flappy-bird-in- html5-1/](http://blog.lessmilk.com/how-to-make-flappy-bird-in-html5-1/)

I also wrote and self-published the first book about Phaser: [https://www.discoverphaser.com/](https://www.discoverphaser.com/)

Let me know if you have any questions! :-)

<comment><USER3> I just started with Phaser last month and it's great. Your tutorials page was a great reference for me([http://www.lessmilk.com/phaser- tutorial/](http://www.lessmilk.com/phaser-tutorial/)). 2.4 looks great. Have you experimented with the support for boned Creature animations? I've ben testing out Creature for 2D skeletal animation and it seems quite nice.

</comment></comment><comment><USER4> It's my favorite library for building small video games for fun. I recommend it to anyone who wants to build a 2D web game. It has good docs and the code is fairly simple to read and write.

<comment><USER5> Has anyone compared phaser with impact? They both seem great.

<comment><USER6> I've used both extensively. Here's my take:

* Impact is a lot more low-level. If your game is complicated, you will have to get into the weeds of the canvas API.

* Phaser supports canvas and WebGL. Impact supports canvas exclusively.

* Impact costs $99. Phaser is open source.

* Impact rarely ever receives updates. Apparently the creator is working on 2.0, but nobody knows if or when that will be released. Phaser is updated very frequently.

* Phaser has the edge in terms of popularity. You will find a lot more articles and books for it.

* Phaser has batteries included. Impact is more bare-bones.

* It can be a pain to keep your local changes synced with upstream changes in Impact unless you go through a bit of hassle. (You will -probably- need to modify Impact's core if your game is complicated.)

* Impact has a level builder and some other tools out of the box. I personally don't use it. Tiled is better, and Phaser has good support for Tiled. Actually, I've had better luck using Tiled in Impact, but it required writing a lot of custom code. Most people will probably have more luck using Tiled with Phaser.

* Impact is a lot faster in my experience, even with WebGL enabled in Phaser. YMMV.

* Impact has far superior support for high DPI screens last time I checked. (Disclaimer: was a year ago.) Getting stuff to look good on retina screens in Phaser was hellish and things would randomly break.

* The learning curve of Impact is extremely low. However, you will feel constrained for bigger projects, which may require lots of custom visual and audio handling.

* Impact uses its own module system. Using browserify or webpack with it isn't really feasible.

<comment><USER5> Thank you for the list, I appreciate it!

Regarding Impact (canvas) being faster than WebGL in Phaser. It's not the first time I hear canvas being faster.

two.js had the same problem, and from what I gathered it had to do with not caching something. Maybe you know more about it than I do.

Again, thank you!

</comment></comment></comment></comment><comment><USER7> This, this is the best JavaScript game framework. Been using it for a few years and it never let me down. It is constantly updated and has lots of examples to get you started.

I have just created a small game and exported it to an android .apk and easily runs at 60fps on Nexus 7 (2013) at 1920×1200 resolution.

<comment><USER8> What did you use to export to the android .apk? Cordova?

<comment><USER7> I use CocoonJS: [https://www.ludei.com/cocoonjs/](https://www.ludei.com/cocoonjs/) . You just upload the archive with your HTML5 project and it compiles it for you and gives back .apk and iOS files.

</comment></comment></comment><comment><USER9> Seeing updates for Phaser makes me so happy! It really is a gem of a library.

A nice thing about it too, is that it is very easy to make something that is compatible with both desktop web browsers and smartphones. When presenting at a game jam or hackathon, it's nice to be able to push what you've done onto GitHub pages and encourage your audience to try things themselves.

</comment><comment><USER10> Phaser is such a fun platform. Great to see it continue to improve.

</comment><comment><USER5> I am wondering if Phaser with TypeScript would make things easier for someone like me who like static typing.

The only problem is type definitions have a habit of lagging behind releases.

</comment><comment><USER11> If I make a game in phaser then what are some server hosting options? Are there good and free ones?

<comment><USER12> Anything that can serve static web pages will work, you can even share it from Dropbox and people will be able to play the game in their browsers.

If you want free, a Github page is a good option.

</comment></comment><comment><USER13> How Phaser compares with Cocos2D?

<comment><USER12> Phaser has a cleaner API, is more popular and has way better documentation.

</comment></comment><comment><USER14> Does it use FRP?

</comment><comment><USER15> The documentation of Phaser is the worst i've seen to a popular framework. The website is very bad in the design, styling as well as content.

<comment><USER16> Hm, I had a very different experience. The extensive example library makes the Phaser documentation excellent, in my opinion. The API docs are average, by no means terrible. I've used Phaser, Unity, or SDL for various projects and I've hit the documentation fairly hard for each, so I hope I might have some perspective on this.

[http://phaser.io/examples](http://phaser.io/examples)</comment></comment>


Illegal-Goods Site AlphaBay Shut Down, Admin Hanged in His Cell in Thailand - <AUTHOR> https://www.wsj.com/articles/illegal-goods-website-alphabay-shut-following-law-enforcement-action-1499968444 <comment><USER2> TIT (This is Thailand), we can only speculate what happened here..</comment>


The Financial Times and the Future of Journalism - <AUTHOR> http://www.newyorker.com/news/john-cassidy/the-financial-times-and-the-future-of-journalism <comment><USER2> What I've found looking at the _Financial Times_ is that it's among the media sources at the very top of my list based on mentions of the _Foreign Policy_ 's top 100 global thinkers mentions. Its sister publication, _The Economist_ , does even better. The only publication doing better yet is _The New York Times_ , though _its_ results are exceptionally skewed by references to Paul Krugman (a _Times_ columnist and blogger).

The results are based on searches for the names of the FP global thinkers members, and was a bit of research I'd conducted for my own benefit looking for sources of potentially interesting discussion and insight online, including social media, mainstream and altnernative publications, academic, and other institutions.

Not a subscriber, though I'm considering it.

Details:

[https://www.reddit.com/r/dredmorbius/comments/3hp41w/trackin...](https://www.reddit.com/r/dredmorbius/comments/3hp41w/tracking_the_conversation_fp_global_100_thinkers/)

</comment><comment><USER3> Going to try to apply the £1/$1/€1 trial subscription to my startup - at 80% conversion, it sounds worth a shot, even if it's nowhere near there. The idea of forcing a small commitment seems solid, and is far from new.

</comment><comment><USER4> Good writing.

Creative writing.

And delivering this multiple ways. They have an audience that works at multiple levels.

Universities - Send free or hugely discounted copies of the newspaper to universities or departments with people likely to stick to their content.

Free giveaways - Station people at underground stations across London with copies. It's more attractive than Metro.

Corporate subscription - If a company buys unmetered access for all staff, this is really habit building, and lets people explore. Aside from the above, this is how I was hooked not to give it up, as the value becomes enforced via exploring. This is very similar to the point the article makes "The idea is that for a nominal amount you can read as much as you like, and that creates a habit."

Editorial - Reflects this. It is not 'city boy' speak. It makes efforts of similar publications' business sections look like shoddily written and put together opinion pieces appeasing their respective editors across a spectrum of readers. [I'd contrast this to The Economist which often lacks the quality The FT has for insight. In many cases it is FT Lite.]

Actually useful - Walk around a bank and not see a copy. When working in a job in the City it was encouraged for new hires to include it (and other sources) in daily/weekly brainstorming meetings. This includes toilet breaks sitting reading the FT while putting the world to rest.

A lot of content is actually free - A lot of the non-daily-news sections are always free online. Particularly editorial, multimedia, things via RSS (they still do RSS).

Clearly I'm sold. The reasons above are why. Tangentially, they seem to have very low staff turnover and a clear vision and culture for achieving their vision.

</comment><comment><USER5> I'm surprised and disappointed at the quality of reporting here by Cassidy, and the quality of the quotes by the FT's CEO Ridding. Cassidy is playing softball, letting the executive get away with the usual corporate propaganda:

"Number one is they are fundamentally supportive and excited by the strategy," Ridding said. "Like us, they believe in the value of quality journalism, both as a mission and also as a business. They also think the language of business is English, and if you are going to be a global player you need a strong English-language position, or voice, or publication. So it made perfect sense from their strategic global perspective."

Seriously? Are we supposed to read this and think it's news? News organizations are sometimes guilty of a certain hypocrisy, going easier on themselves, and each other, while they treat the rest of the world with more skepticism.

</comment><comment><USER6> I'm on and off their subscription for a couple of years now. What I noticed is that they make it extremely challenging to cancel. While that doesn't matter for the first subscription it certainly is something that makes me hesitate to come back to them. In the end their journalism usually wins me over, though :)

<comment><USER2> The journalism's good. Sticky subscriptions (or other sales models) really _are_ a turn-off though.

</comment></comment><comment><USER7> They implemented shareware.</comment>


Birds that seemingly commit suicide - <AUTHOR> http://www.bbc.com/earth/story/20151129-the-birds-that-seemingly-commit-suicide <comment><USER2> Werner Herzog's amazing documentary on Antarctica ([http://www.imdb.com/title/tt1093824](http://www.imdb.com/title/tt1093824)) briefly discusses depression and suicide among penguins.

It's pure Herzog goodness. Though he sounds almost like a caricature of himself in the passage the reflection is still thought provoking: [https://www.youtube.com/watch?v=zWH_9VRWn8Y](https://www.youtube.com/watch?v=zWH_9VRWn8Y)

</comment><comment><USER3> Nothing in this article suggests that the birds die intentionally (suicide). They drown accidentally. Linkbaity title?

<comment><USER4> Very linkbaity title - content of article is not in the slightest like title. And the title on HN is not the title from the BBC article anyway.

Better title: When Starlings drown accidentally, group mentality causes them to drown in groups.

Not an exciting title, but accurate.

<comment><USER5> Actually, that title isn't accurate either because the article doesn't claim that to be the case; it only speculates. Nor does it even rule out some form of "suicide".

</comment></comment></comment><comment><USER6> > They can't be suicidal

Maybe they could. We know of various parasites which turn their hosts suicidal: [https://en.wikipedia.org/wiki/Behavior- altering_parasites_an...](https://en.wikipedia.org/wiki/Behavior- altering_parasites_and_parasitoids)</comment>


PgREST: Node.js in the Database, compatible with MongoLab and Firebase API - <AUTHOR> http://pgre.st/

<comment><USER2> ... if I didn't know better I'd assume that headline was spat out by that Markov chain doodad from the other day.

<comment><AUTHOR> ... it was, in fact, partly inspired by the Markov chain hack. #BuzzwordBingoButTrue :-)

</comment></comment><comment><USER3> Looks quite interesting, but I can't help but admit some of these Web 3.0 solutions are getting a bit ridiculous nowadays, especially when it comes to data storage and processing.

<comment><USER4> _> Web 3.0_

Is that what we're calling this whole 30 lines of javascript, mongo and redis behind the WAN, dynamic language runtime inside the DB era?

Cool.

EDIT: saying that, some kind of featureful document store implementation inside postgres seems inevitable. Isn't that all going to be hstore-based though, what with the new stuff coming in 9.4? I thought the json type was meant to be kind of a stopgap until the full hstore functionality is finished, ie. nesting?

See: [http://obartunov.livejournal.com/175235.html](http://obartunov.livejournal.com/175235.html)

<comment><AUTHOR> Yup. Nested hstore and JSON are going to be semantically equivalent ("cast" works both ways), and PgREST will support them equally once 9.4 is released.

PgREST also comes with a shim JSON type for Postgres version 9.1 and earlier, so the column type implementation is mostly hidden from the user.

<comment><USER4> But hstore will be faster/better because it's a binary representation, right?

<comment><USER5> JSON will be getting binary representation. Its just a matter of organizing sponsorship of the project.

<comment><USER4> I assumed everyone would be encouraged to just convert their json columns to hstore if they wanted the extra speed, being as theyre equivalent. What would be the reason for funding JSON-as-binary?

<comment><USER6> Traditional databases use complicated indexing and storage structures in part to minimize the need to examine unrelated data. hstore is better than plain text for JSON but a scheme closer to the existing PostgreSQL table/page/row/value hierarchy could be better still.

I'd recommend reading the recent post [https://news.ycombinator.com/item?id=6813937](https://news.ycombinator.com/item?id=6813937)

<comment><USER4> Of course if I need it to be eye-wateringly fast I wouldn't be using a document store. I'd use good old relational or something like redis. Often though you just need a sensible place to put some unimportant schemaless key- value data without a half dozen extra dynamically created tables or whatever. EAV makes me very sad.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I need a simple rest json store, and this could come handy. I'm using openkeyval right now, but they have a value size limit much too low (which seems to be a bug).

<comment><USER8> Have you looked at Cloudant ([https://cloudant.com/](https://cloudant.com/))?

</comment></comment><comment><USER9> So, is this a competitor to couchbase (thinking of kanso and couchapp)?

<comment><AUTHOR> Yes, we're certainly inspired by Kanso.

PgREST was originally designed for a large, in-production Postgres app (i.e. Socialtext), so we can get all the model, validation, view & trigger code in one place, getting the benefits of CouchApps while maintaining the underlying data layer.

For new projects, the main difference is likely familiarity with the toolchain (npm+Pg vs Kanso+CouchDB).

<comment><USER9> The word I want to use for this is "refreshing".

Back in the day, I thought Couchapps and Kanso + CouchDB were great and I hoped they would lead an entire new breed of web applications.

Thank you for making it happen!

</comment></comment></comment><comment><USER10> Another killer product from Firebase. They seem to be one of very few startups in the city that are executing smart and can prove it.

Looking forward to seeing what else the team comes up with since I've already replaced my MUNI estimation time app with the Firebase SF Muni app :-D

<comment><AUTHOR> Well, this is more like an open-source (partial) reimplementation of Firebase so anyone can host it... :-)

Firebase++ for an extremely well-thought-out API, though!</comment></comment>


Why is there no $2000 phone that replaces my laptop? - <AUTHOR> Just curious, but after the whole '$3000 macbook' discussion going on the internet, it made me wonder.
With Windows continuum and Ubuntu, that can both transform a phone to a desktop, why is there no octa-core 8GB 6-inch phone of lets say $2000-$3000?
Lot of developers would love to only bring a phone to work and than connect to screen/keyboard and you are ready :)
This way you only buy 1 device instead of 2, for the same money (or less) <comment><USER2> One reason may be that a high-performance computer (with a fast CPU and GPU) would generate more heat than can be dissipated in a box the size of a phone.

<comment><AUTHOR> True, but to be honest I wouldn't mind having a slightly thicker 'heavy duty' phone to add proper cooling.. Phones are ridicules thin as they are already

</comment></comment><comment><USER3> Because every time they make the processors faster and add more RAM to mobile phones, they add more pointless bloat to the operating system, so you need faster processors and more RAM, just to run the OS smoothly.

On paper, the phones of today are as good (spec wise) as the desktop computers of only a few years ago. But we never seem to reach the goal of the truly capable pocket computer.

<comment><AUTHOR> But even then it would still be attractive.. Just flash the rom and put linux on it.

Maybe its because most general heavy-duty 'laptop' work, requires an x86 cpu? Just a guess

</comment></comment><comment><USER4> "Why aren't laptops smaller?"

<comment><AUTHOR> Cause of 13/15" screens with a full qwerty keyboard and touchpad and bigger speakers, etc etc :)

</comment></comment><comment><USER5> It's a good idea. You should build one.

<comment><AUTHOR> Up for a kickstarter anyone? :p

<comment><USER5> the great thing about kickstarter is that you can start it on your own. Once you have made the kickstarter campaign then you can invite others and see if there is interest to pay for the actual product</comment></comment></comment>


1.37bn records from somewhere to leak on Monday - <AUTHOR> https://www.theregister.co.uk/2017/03/06/researcher_warns_of_one_point_four_billion_identity_leak/ <comment><USER2> 1\. The article's headline seems misleadingly sensational: a news article on a leak of 1.37b records from somewhere will be released tomorrow, NOT the records themselves will leak tomorrow.

2.

 _> 1.4 billion identity leak story incoming Monday morning._

 _> He later offered a teaser of the leak, also reducing the number of identities by 30,000._

1.4b minus 1.37b is 30,000,000.

<comment><USER3> It's The Register. Accuracy is not one of their strong points.

<comment><USER3> And oh look, all that speculation and it turns out it was a spammer backup archive. Definitely high quality reporting from el reg.

[http://www.csoonline.com/article/3176433/security/spammers-e...](http://www.csoonline.com/article/3176433/security/spammers- expose-their-entire-operation-through-bad-backups.html)

</comment></comment></comment><comment><USER3> 1.37bn items stored in a MyISAM table.. I sure hope that's the researchers copy of it rather than the origin.

</comment><comment><USER4> I wouldn't be surprised if it's Yahoo again.</comment>


Show HN: Spingredients – Cooking and Recipe Inspiration (iOS) - <AUTHOR> https://itunes.apple.com/us/app/spingredients-cooking-recipe/id415115813?mt=8

<comment><AUTHOR> I've completely redesigned this recently. Removed the old skeuomorphic UI and replaced with a much cleaner style.

Simplified the functionality, removing all the extraneous synching and user accounts etc (stuff that took forever when I first developed it and definitely wasn't worth it!)

Hopefully people will find the idea interesting. The original data came from a script that I wrote to analyse search engine results for the different ingredients and their combinations.

Is it appropriate to upload some promo codes here so people can try it?</comment>


The Tragedy of One Laptop Per Child - <AUTHOR> http://www.slashgear.com/the-tragedy-of-one-laptop-per-child-3067199/

<comment><USER2> I think the biggest contribution of OLPC was to scare both hardware makers and Microsoft into creating netbooks. We wouldn't have netbooks today without OLPC. No one wanted to sell low end laptops because they wanted to maintain profit margins.

Perhaps OLPC will goad others into making great tablet PCs as well.

<comment><USER3> An interesting take. I do not remember it this way, however. Any links, papers, etc, with supporting evidence?

<comment><USER4> I remember it that way. When the OLPC was first announced in 2005, a "cheap" laptop was $799-999, and a decent one was about $1600. Now an average laptop (as long as it's not a Mac) is around $500, with cheap netbooks in the $300 range.

Citations:

<http://blogs.computerworld.com/what_was_the_first_netbook>

<http://en.wikipedia.org/wiki/Netbook>

<comment><USER5> If you are trying to say that the OLPC was what drove down laptop prices I would have to disagree. The OLPC was made possible by the same forces that drove down other laptop prices: cheaper electronics parts.

OLPC may have had a slight effect, but the larger cause was the natural development of computing technology. As electronics advance prices drop at a fairly predictable rate. What cost $100 this year is probably going to cost $50 next year, and $25 the year after that.

That is the real reason why laptops have gotten so cheap, not because of anything the OLPC foundation has done.

<comment><USER4> So, there's both a proximate and an ultimate cause. The ultimate cause of cheaper laptops is cheaper laptop parts. They wouldn't even be possible if the parts couldn't be had for less than the sale price.

But until somebody in the industry breaks from the pack and says "I'm going to offer this cheaply, damn the profits", all that cost savings accrues in profits to the OEMs. That maverick could be an upstart startup intent on market share with nothing to lose. Or it could be a nonprofit director on a mission to save the 3rd world.

In this case, the OLPC was the catalyst. The technology existed beforehand, and most people _knew_ the technology existed. But Nicholas Negroponte was the first one to say "It can be done, therefore let's do it."

The same structure exists in lots of other industries. Why is broadband 10x faster in Japan than here (citation: [http://www.worldpoliticsreview.com/Images/commentarynews/bro...](http://www.worldpoliticsreview.com/Images/commentarynews/broadbandspeedchart.jpg))? They have the same technology. But the telecom industry in the U.S. is a duopoly between Comcast and Verizon (with a few bit players), and they have an incentive to dribble out only enough in speed increases to stay ahead of their competitor.

Perfectly competitive markets exist only in an economics textbook. In the real world, things don't happen until somebody says "We're going to _make_ it happen."

<comment><USER6> _But until somebody in the industry breaks from the pack and says "I'm going to offer this cheaply, damn the profits", all that cost savings accrues in profits to the OEMs._

...or the manufacturers concentrate on bringing the features of $1500 laptops into the next generation of $1000 laptops, instead of bringing the features of $1000 laptops into a new generation of $750 laptops.

</comment></comment></comment></comment></comment></comment><comment><USER7> I think it is a bit premature to call it a failure. I think there is far too much focus on the hardware going on. The fact is that OLPC is actually doing some pretty good work. Yes, the hardware is more expensive than they had hoped, but it is still really cheap, and the simplified UI does seem to work pretty well.

Their latest deployment is in Rwanda, and although I will fully admit that I was chagrined to see OLPC still selling, once I watched some of the videos and did some reading it was clear that they are actually doing some real good.

See: [http://www.informationweek.com/video/infrastructure/36557810...](http://www.informationweek.com/video/infrastructure/3655781001;jsessionid=EZDAWPSXTDX1VQE1GHPSKH4ATMY32JVN)

There is something to be said for having a bright green laptop that isn't terribly useful for adults and doesn't run a standard OS. It makes them less of a target for theft or resale in poorer countries and keeps them in the hands of the people that need them, the students.

I think a lot of good is yet to come from OLPC, it is just taking a lot longer than they expected. I do however fully agree that the touchscreen vision is a joke.

</comment><comment><USER8> I really hate to see people bashing the OLPC for the wrong reasons. The project has a lot of flaws and a good couple lose ends, but, all in all, it is a great idea that has faced huge resistance from the very governments that should embrace it. I also suspect some governments active sabotage it because such a device allowing communication and free access to information would weaken their grip on local populations.

You really don't need the courseware, at least not at the start. All you really need to start is the regular textbooks transcribed as e-books. The kid can then carry and access all their books, current and future, in one compact volume, breaking any limitation on the kid's reading. Since OLPSs have network connections, governments (and educational associations) can also spend some money translating relevant topics from wikipedia, creating better localized versions. Classroom activities can also be developed on top of the localized software that already ships with them.

It's also lovely to suppose that local people cannot fix the machine because "this intended market is illiterate". Living in a third world country, I am deeply offended. This is, however, a failure of the OLPC plan. The OLPC should also have been directed towards US schools in order to gain momentum, perhaps even before attempting to go after the third world.

It's also foolish to overpromise impossible hardware. XO-2 and XO-3 are ludicrous. XO-1.75 is great, however. I love the idea of Windows-proofing it by running on ARM. I fail to see the educational value of running MS Ofice.

But it's absolutely unfair to expect the OLPC folks to develop courseware for the machine beyond the outstanding materials already there.

</comment><comment><USER9> Huh? In what way is this a "tragedy"? Lack of clean water and mosquito nets is a tragedy. The 2004 tsunami was a tragedy. I don't know if the OLPC is a worthy goal or not but I'm quite sure it's not a tragedy that children don't have access to computers and it's not a tragedy that someone is trying to make them available.

<comment><USER10> In terms of mis-spent resources: i.e. opportunity costs. If the OLPC project is in fact a failure, consider how many mosquito nets could have been bought with the funds.*

* Yes, I know people / companies would not have donated the same amount of $ for a non-sexy cause.

<comment><USER11> It seems more efficient to try and raise economic activity to the point where foreign aid is no longer required; the OLPC was an attempt to do this through jump starting technology education.

The areas for which it was intended did not need mosquito nets - places such as rural Mexico. These places have power and running water.

While saving lives is a worthwhile goal, saving them just so they can carry on being perpetually dependent on foreign aid seems to be pretty unfair on both the nations giving aid and the nations receiving it.

</comment></comment></comment><comment><USER12> There is good that will come from OLPC even if OLPC as an organization were to vanish tomorrow.

PixelQi.com (spinoff from former CTO of OLPC) has developed a high-resolution LCD technology that will compete with e-Ink; since it uses mainstream LCD manufacturing the economies of scale will mean it will be much cheaper to produce an 11" e-reader.

Assuming PixelQI succeeds, this means even more e-readers for less money, and and an increase in whatever you perceive the benefits of e-readers to be (such as less paper waste, or better use of time).

The Sugar project <http://www.sugarlabs.org/> is the software side of OLPC, able to be run from USB sticks on any old PC you have lying around; a P3-700 or higher is still pretty snappy. I know of several test implementations using it, for real, in schools (there are still bugs to work out until it can be deployed widely).

</comment><comment><USER13> Neat hardware progress aside, has OLPC been a success in actually educating the target kids? Just putting laptops in hands doesn't automatically educate them. Here in the U.S., there are plenty of schools with computer labs, computers in classrooms, or even, yes, one laptop per child.

Based all my teacher and parent friends, all the increased access to computers here hasn't really improved education much. And we're buying expensive commercial educational software, not just Sugar or gCompris.

Maybe the time and money is better spent funding CC / public domain textbooks? That and Sugar are what I'm more interested in supporting.

<comment><USER14> To paraphrase you, just putting books in hands doesn't automatically educate them, either. There have been, and always will be, challenges in education. But for those who are willing and able to make good use of the resources available to them, computers and the Internet are two very powerful resources.

</comment></comment><comment><USER15> Funny how people with the biggest dreams end up taking the most flack.

OLPC was a big ambition and, like most new initiatives, was probably bound to fail initially. However, he had an idea and he did it! The great success is that future initiatives will have the opportunity to learn and improve upon it.

Are there other things that need fixing around the world? Yes, but the argument that we cannot do anything grand until every single primitive human need is solved is bunk. Innovation does not need to wait for a utopia.

</comment><comment><USER16> "What's the courseware and curriculum?"

And if you don't ask this question first, your well-intended project to 'gift the poor' becomes 'abetting the criminals'. Examples: FM. Television. _Someone_ will fill the vacuum.

I maintain that there's a huge, untapped market for ed. software. Wikipedia is a powerful clue ... and, now, a free resource. But education's a lot more than shoveling data.</comment>


Ask HN: Good video introductions to a start up service? - <AUTHOR>

Do you know any good videos introducing start ups and their service / idea?<p>I like the bitcoin introduction -  http://www.weusecoins.com/ <comment><USER2> Adam Lisagor[1] has made a few great startup videos. Check out the video he did for Flipboard <http://www.youtube.com/watch?v=v2vpvEDS00o> or the video he did for Square <http://www.youtube.com/watch?v=QSzsFAJAKHI> .

[1] <http://adamlisagor.com/>

</comment><comment><USER3> Check out <http://startup-videos.com> for great examples of starup videos introductions. You'll also find a page with a list of agencies/freelancers offering such services. Hope it'll help

</comment><comment><USER4> I like the airbnb intro - <http://www.airbnb.com/info/how_it_works></comment>


Small Strings in Rust - <AUTHOR> https://fasterthanli.me/articles/small-strings-in-rust <comment><USER2> Great writeup, and also an incredible tutorial on how to create a tracing allocator in Rust!

Reddit discussion thread: [https://www.reddit.com/r/rust/comments/hm3zjs/small_strings_...](https://www.reddit.com/r/rust/comments/hm3zjs/small_strings_in_rust/)</comment>


I Failed All My Classes and that's Why I'm Winning — I.M.H.O. - <AUTHOR> https://medium.com/i-m-h-o/af078a64fbeb <comment><USER2> I don't get it. What does failing classes have to do with this? It said about OP not being a good student for 1 second and never talked about that again.

I think this is just yet another "college drop-out/fresh out of high school make big startup" headline? Is that all it is about? I am so confused sorry for being harsh.

I am confused at another thing: are we supposed to find out what your competitors (prior to your entry to the new domain) is doing or should you just ignore what your competitors doing and go for your idea?</comment>


A nuclear startup folds after failing to deliver reactors that run on spent fuel - <AUTHOR> https://www.technologyreview.com/the-download/612193/nuclear-startup-to-fold-after-failing-to-deliver-reactor-that-ran-on-spent-fuel/ <comment><USER2> It would have been a tough regulatory battle to ever recoup an investment in the US even if it did work as advertised.</comment>


Ask HN: Hardware suggestion for entering deep learning? - <AUTHOR> I had been picking up machine/deep learning skills for a while, getting to a stage that my MBP can no longer handle the computation, wondering if there's any hardware suggestion to off load the job?<p>Ps. For learning purpose AWS g2 is a bit pricey and not considered. <comment><USER2> [http://timdettmers.com/2015/03/09/deep-learning-hardware- gui...](http://timdettmers.com/2015/03/09/deep-learning-hardware-guide/)

<comment><AUTHOR> Thanks, reading through it now!

</comment></comment><comment><USER3> I don't know your situation but my suggestion is, if you are really interested in deep learning, get hired by a company that does it.

Deep learning is a hot topic right now and if you have any aptitude in that direction you will get hired very quickly.

<comment><USER4> Deep learning is hot in that everyone wants to do it. But very few companies use it (Google, Facebook come to mind). It's still mostly in research labs and academia.

</comment></comment><comment><USER5> One benefit of using cloud GPUs is the ability to train multiple models simultaneously. This is difficult to do with your own hardware at a reasonable cost, especially since a large portion of your time will be spent on hyperparameter tuning.

While you're getting started with your own hardware I'd love it if you could share any feedback on something we've been building[0] as far as cloud training goes. It's currently in free public beta and works directly with TensorFlow models so there's no lock-in.

[0] [https://fomoro.com](https://fomoro.com) (jim at fomoro.com)</comment>


Popular iPhone and iPad Apps Snooping on the Pasteboard - <AUTHOR> https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-apps-snooping-on-the-pasteboard/ <comment><USER3> The pasteboard API is essentially the same in iOS as it is in macOS. Which means it's an api that was likely designed more than 20 years ago. Because of that, it was not designed for the user-hostile app world we live in, where developers will harness any api that can leak data about the user.

A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-action to unlock them I.e. I can passively ask "does the clipboard contain a photo?" or "does the clipboard contain a url in the *.facebook.com domain?" but in order to get the contents I have to prompt the user to manually paste. Probably this would require putting these queries in the info plist, so that they can be validated by app review and you don't get developers brute-forcing the contents with large numbers of generated queries.

This is very similar to how apple solved apps detecting what other apps you have installed using `-[UIApplication canOpenURL:]`. Apple added rate limiting and an info-plist based whitelist, which essentially put a stop to this practice.

<comment><USER4> > A solution to this is to re-design this api so that it allows developers to > query for specific matches, but requires user-action to unlock them I.e. I > can passively ask "does the clipboard contain a photo?" or "does the > clipboard contain a url in the *.facebook.com domain?" but in order to get > the contents I have to prompt the user to manually paste.

I fully expect apps to try to leak information bit-by-bit to the greatest possible extent.

<comment><USER3> Addressed by the next bit in my post: force developers to list their queries in the info plist. Only allow those queries. Validate that the query list is not malicious during app review.

</comment></comment></comment><comment><USER5> Something that confuses me:

Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along.

Is there a reason whatever security trade offs are OK in Windows, but not on a phone?

<comment><USER6> These security trade-offs are not really OK on desktop either, but Windows (and macOS) have a long tail of backwards compatibility they are trying to maintain and slowly steer towards similar security levels (as in the case of the mac app store or the windows store platform). Both of those platforms are struggling to do that although have made some incremental progress but nowhere near the degree that iOS has.

iOS was designed very early on with heavy sandboxing and as a new platform that was happy to break many of the norms of desktops. They have been very successful in having a usable platform that is heavily sandboxed and closes more of these snooping holes over time. Of course the trade-off has been flexibility and it has taken them a long time to get where they are now and have a usable OS and also have such sandboxing. (remember the first iPhone didn't even have an app store!)

To some extent most applications moving to being web-based has won a lot of this sandboxing on desktop that it wouldn't have otherwise had, and web apps cannot read from the clipboard in modern browsers.

<comment><USER7> The Windows 10X sandboxing for Win32 is yet another step into that direction, each application gets their own little world thinking that they still own the PC, when in fact they are part of a Windows container.

</comment></comment></comment><comment><USER8> I wouldn't be surprised if the apps _themselves_ were not directly responsible here -- that is, the code that's written directly by the app developers.

Instead, it may very well be be some analytics/marketing SDK that has been included in the app because of a business request. These have no privilege separation: they run their code in the same context as the code that the app developers wrote. (Consider the example of games with no text UI; unless they're truly spying on their users, what would they get from doing this?)

I've said before, this SDK privacy hole is something we need to be very aware of as engineers and push our product/marketing folks to recognize as well. I would love to see Apple address it too. (On the other I have no idea _how_ they would.)

<comment><USER9> "We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things."

No.

<comment><USER10> Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.

<comment><USER11> Pretty sure at least some of those are "helpful" in the sense of "this is one of the ways we make money, by installing someone else's sdk in our game and getting paid for it, while not looking too carefully at what it's doing to our users". And I'd be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven't done this in the past even if they're not doing it now. Surveillance capitalists gonna surveil...

<comment><USER12> This comes up all the time on HN and I'm always shocked[1] at how controversial an idea it is that the developer is responsible for knowing what they are shipping in their dependencies. "Oh, woe, how can you audit all of your dependencies and their dependencies and know what's in them?? Oh it's impossible! There is no way to solve this!"

Too few devs are really careful about their dependencies and do good due diligence when evaluating them for suitability. Everyone else is just "Hey our problem is solved by this one. YOLO! Link it and ship it LOL!" I've seen projects that link and ship binary dependencies without even being able to inspect the source. This is, to me, totally insane. But standard practice in a lot of places!

1: [https://news.ycombinator.com/item?id=21439953](https://news.ycombinator.com/item?id=21439953)

<comment><USER11> While I totally agree with what you say here, I think it goes deeper. Some devs/shops are complicit in this, knowingly adding dependencies for shady reasons.

</comment></comment></comment></comment></comment></comment><comment><USER13> Accuweather — com.yourcompany.TestWithCustomTabs

Off topic. I can't imagine how did they shipped this app with this BundleId.

<comment><USER14> Presumably it got developed as such, and it never got prioritized before release.

"Okay we've finished all the must-haves just in time for our release deadline but the name for our app in our code isn't really configured correctly."

"How long will it take to fix?"

"Maybe a week to update our CI environments and be confident that there aren't any regressions related to dependencies on the thing that we're changing, but we can also fix some other issues in parallel."

"What effect will changing it have?"

"Well it will conform with best practice and won't confuse future developers."

"What user-facing change will it have?"

"None."

"Nope, not worth delaying release by a week for."

<comment><USER13> I get this for a scrappy startup trying to move fast. But this app (pretty decent, btw) is 10+ years old.

<comment><USER8> It's effectively impossible to fix this once it's been shipped, though. The bundle ID is the fundamental identifier of the app to the whole system. If they were to change it, they would end up with a completely separate app in the app store. They would have no way (at least no way that's not nasty and convoluted) to move user data from the old one to the new one.

</comment></comment></comment></comment><comment><USER15> > Apps on iOS and iPadOS have unrestricted access to the system-wide general > pasteboard, also referred to as the clipboard.

Yikes. This is horrible, and really it's unacceptable given Apple's privacy rhetoric. Even the web doesn't have this vulnerability. And it's easy to fix, too! Why in the world should an app be able to see the clipboard? It should only see the text I enter into its fields (via pasting or otherwise).

<comment><USER16> Browsers use it to help you with the copied links. When you click into the URL bar they offer you to jump to the previously copied link right away.

<comment><USER17> Should be a permission.

<comment><USER18> I don't disagree but the overflowing of permission prompts is how we get people just clicking Yes to everything. There is a balance. Location services are worth of a permission, but the clipboard seems a bit on the trivial side of things. Then again, people paste passwords, so...

<comment><USER11> > Then again, people paste passwords, so.

It's more serious than that, current security best practice is telling everybody to use a password manager. People are being told that pasting passwords is "the right way to do things". And that behaviour (at least for me) has morphed into keeping account numbers, credit card numbers, and other important private information in the password manager, and copy pasting those when I need to.

(1Password on Mac seems to have a trick where it empties the clipboard after a certain amount of time, I've noticed that occasionally when a password I'd copied a little while ago isn't still in the clipboard when I try to paste it. I haven't been quite curious enough to look into it. Yet...)

<comment><USER4> [https://developer.apple.com/documentation/uikit/uipasteboard...](https://developer.apple.com/documentation/uikit/uipasteboard/optionskey/1829414-expirationdate)

</comment></comment></comment></comment></comment></comment><comment><USER19> Some apps use this to offer to open an URL in the app.

"Your clipboard contains a link to a $localnewspaper article, do you want to open it?"

<comment><USER20> The Deliveries app offers this with tracking numbers and it's very helpful

</comment></comment><comment><USER21> I really hope we don't start getting into a parade of dialogs going "X app requests permission to use Y".

I get why it's important from a privacy-perspective, but most people aren't going to care. They'll just mash the "Allow" button until they get what they want.

<comment><USER15> I don't see why this even _needs_ a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

<comment><USER22> The app might be implementing the paste function. The most common use case of copying and pasting text could probably be hidden inside the standard text fields, but consider images, sounds, or custom data types. The app needs to grab these off the clipboard and do something with them and will be triggering the action from some custom user interface element. Even for text, a terminal emulator or word processor is not going to be using a standard text field as the target.

Most apps could probably live happily with there being an entitlement for 'unsecured clipboard access' to enable anything but text into a text field.

<comment><USER15> The OS could provide a dedicated button of its own for pasting images, etc. It could be recognizable and standard and apps could embed it as needed.

The key is that apps shouldn't have silent, _arbitrary_ clipboard access. The user should have to do an action for the clipboard's contents to be transferred. The only way to prevent abuse is for a system-provided widget to be the one making the actual API call.

Another option would be to provide apps an API call that opens a system "paste dialog", asking the user, "Paste X into this app?". This would have the added bonus of giving the user a preview of what they have in their clipboard before actually performing the paste. It could even show a history of the last several copied items in case they want to paste one of those instead, which would be a genuine productivity-booster.

</comment></comment></comment></comment><comment><USER23> Would be interesting to see this correlated with network logs to see if the apps phone home or just process it locally.

Now you'd never know if the app buffers until a convenient time but a less sophisticated implementation would be instant giveaway.

</comment><comment><USER24> This was quite obvious for a short while after Apple introduced cross-device pasteboards (handoff/continuity) - if your mac had recently copied something into its pasteboard, and you opened the facebook app on your iphone, the system would show a "Pasting from mac..." modal progress bar for a second even with no user interaction.

</comment><comment><USER25> Unfortunately because of the incentives that drive developer business, we have to treat apps with minimal trust for anything potentially sensitive. Clipboards often contain people's names, contact info, passwords, and personal writing. Carte blanche access is something that reveals these and personally I'm not comfortable with it.

There's obviously a balance to be struck with:

a) not introducing unnecessary permissions prompts, causing prompt fatigue in users (thus lowering security)

b) improved UX by saving a step for apps that may use clipboards for legitimate purposes (e.g. shipment tracking numbers, photos, emails, etc)

Here's how I'd solve the problem through improved App Store review:

1\. Carte blanche access to pasteboard is removed, replaced with system data detectors, which delineate common data types like shipment tracking numbers, photos, emails/contacts, plaintext, etc.

2\. During app submission, any request to access a specific pasteboard data type has to be met with a UX justification, specifically that it has to significantly improve the core user experience in a meaningful way, and developers must promise to not scrape or store the data remotely.

3\. If justification is not approved, app may still be published. Routines that call for access to data detector pasteboard must be able to gracefully fall back to non-pasteboard access (since they are used solely for simplifying a UX step).

4\. If it is discovered a developer breaks their promise, their app may be pulled from the app store.

(optional) 5. When users get to the particular part of the app that uses pasteboard data AND the current pasteboard data is of the data type that the app has been approved to use, user is presented with a permission prompt to allow it. The permission prompt should not just be boilerplate, it should show the current contents of the pasteboard the app is trying to access.

The last step is a judgment call based on balance of permission prompt fatigue and user trust. If its believed the app store submission process is believed to be a good enough filtering process, then don't present prompts. One way to approach is add the above 4 and see how developers respond, and if it seems insufficient then add #5 in the next iOS release.

</comment><comment><USER26> What are the security implications for password managers here - <USER2> copy/pasting any passwords?

<comment><USER27> iOS has a system-level interface for password managers so that the passwords are accessed without using the pasteboard.

<comment><USER28> when that works... pretty sure the fallback is to copy/paste, unless copy/paste from password manager apps also bypasses the clipboard

<comment><USER11> Also, once you've got a password manager installed, it tends to get used for more things than just passwords. iOS's non clipboard password/login doesn't help me any when I'm copy pasting, say, my bank details from a secure note in 1Password.

</comment></comment></comment></comment><comment><USER29> Is there a MacOS utility that clears the pasteboard N minutes after its last content change?

<comment><USER30> not sure, but i do seem to remember that passwords copied from the "passwords" screen in system preferences get removed after a minute or so... so that functionality seems to exist in some form... (if i am remembering correctly that is)

<comment><USER31> Having a "password" pasteboard might not be a bad idea. Disallow reading its contents except by built-in system password input fields.

<comment><USER4> Of course, this only solves the problem for passwords.

</comment></comment></comment></comment><comment><USER32> There are probably other legitimate uses of this, but one is dictionary/translator apps. I can copy a word in Japanese, open my dictionary app, and it will automatically open the entry for the clipboard contents without my needing to take extra steps.

<comment> _-___________-_ This is a really tiny bit of convenience in return for allowing every app to read whatever is on your clipboard whenever they like it.

</comment></comment><comment><USER33> As web browsers have gotten more privacy-aware, native apps have fallen behind. This is just another example of that.

Recent versions of Chrome show a prompt when websites do this in javascript.

<comment><USER11> > Recent versions of Chrome show a prompt when websites do this in javascript.

Tin foil hat version: " ... when website's other then Google's do this in JavaScript"...

(It's sad how much trust Goog have lost, at least with me. I don't seriously thing Goog would try to slip that behaviour into Chrome, but it's close enough to believable to make it a funny/not funny response...)

<comment><USER34> Well, I mean...

Chrome does ship with a Google Docs "app" that lets the site access the clipboard for right-click pasting.

</comment></comment></comment><comment><USER4> One good way to find these apps is that they'll often throw up a "Pasting…" alert if you have clipboard sync enabled, as it tries to fetch your Mac's pasteboard contents.

</comment><comment><USER35> If iOS apps are snooping on the pasteboard/clipboard, then surely many Android apps are doing so too. It's worrisome specially when copy-pasting from password managers. Not sure if 1Password, LastPass, Dashlane etc. offer any protection.

<comment><USER12> Android recently [1] blocked app background access to the clipboard.

1: [https://www.xda-developers.com/android-q-blocks- background-c...](https://www.xda-developers.com/android-q-blocks-background- clipboard-access/)

<comment><USER36> This is about apps snooping in the foreground, which is still possible in Android. I don't think iOS offers background access at all.

</comment></comment></comment><comment><USER37> yikes, so many passwords getting snooped on if you copy them to the clipboard

</comment><comment><USER38> Hey Apple - it's simple as creating yet another permission to read/write the clipboard. How many iOS versions before that happens?

</comment><comment><USER39> IIRC Apple syncs (or _can_ sync) your clipboard data to the cloud, which is an issue if you're copying passwords.

<comment><USER4> Password apps should enable this option to disable the behavior: [https://developer.apple.com/documentation/uikit/uipasteboard...](https://developer.apple.com/documentation/uikit/uipasteboard/optionskey/1829412-localonly)

</comment></comment><comment><USER40> 17Track does but only while starting the app and exiting the add tracking number dialog. It doesn't appear to snoop in the background, but there's no way to know for certain. Maybe clipboard access should be gated with a privacy permission like position, contacts, camera, etc.?

</comment><comment><USER41> If the app is free, you are the product. Who knew?</comment>


Engineering Security by Peter Gutmann (2014) [pdf] - <AUTHOR> https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf <comment><USER2> The title should be "Engineering Security". Subtle difference, but a meaningful one.

<comment><USER3> Ok, we reordered those words and added a date.</comment></comment>