PyPy.js – PyPy in Your Browser - <AUTHOR> http://talkpython.fm/episodes/show/32/pypy.js-pypy-python-in-your-browser <comment><USER2> Instead of yet another .js to run * in the browser, maybe we should return the web and browser back to it's pure days of marked up text documents with images and move "web apps" to a generalized, native runtime designed explicitly to run dynamically fetched untrusted code. Might be better than the current mess.

Edit:

And to all those thinking "but that's the browser", that's my point. We have the browser and while it works, it's incredibly broken in a lot of ways. I'm proposing a system designed from the ground up to do the job that the browser has currently been hacked and add-on'd into doing.

<comment><USER3> While I completely agree, since it will never happen, why not strip javascript out of a browser (FF?), come up with a new catchy name, and market it as a safe browser. Just need a catchy name..., hmm, maybe Lynx? ;

<comment><USER4> Links, perhaps...

<comment><USER5> Links used to support JavaScript some time ago [1].

[1]: [http://links.twibright.com/user_en.html#ap- javascript](http://links.twibright.com/user_en.html#ap-javascript)

</comment></comment></comment></comment><comment><USER6> I may get criticism from some, but sometimes I wish we did get other languages supported by most browsers such as maybe Lua, of course Python, as well as maybe a few others as an alternative to the JS. It would be useful for those whose workflow doesn't fully involve JS.

<comment><USER7>
        <script type="text/vbscript">
           Sub link_onClick
              ' Do some processing!
           End Sub
        </script>

<comment><USER8> What's funny, is I wrote and used a lot of JS in classic ASP... the only PITA was dealing with COM iterators in JS was just not intuative at all. But it did save me a lot in being able to reuse validation logic client and server.. it also allowed for some nice serialization/communications... probably why I like node so much now.. it's just less of a disconnect...

Closest I've come to JS client and server was with ActionScript via Flex/Flash and VB.Net on the server... having XML literals on both sides was really nice, though I prefer JS on both ends... I don't miss C# much at all.

</comment></comment></comment><comment><USER9> How does it compare with Brython? [http://www.brython.info/](http://www.brython.info/)

<comment><USER10> PyPy.js literally starts with PyPy compiled to asm.js, so you intrinsically get relatively comprehensive Python compatibility right out of the box. Brython, as I understand it, is an independent attempt at implementing a subset of Python in JavaScript.

Edit: rfk addresses this directly around 46:00 in the interview. Paraphrased: "The big trade-off Brython does to get good performance is the number model. Things there map pretty directly to JavaScript. But if you overflow or do something different, you suddenly won't get Python's semantics. If you're writing new code for Brython, it's a good set of trade-offs, and in some ways you get tighter integration with the browser and the DOM. But if you're trying to take some existing code off the shelf and run it... you're more likely to run into issues."

<comment><USER11> However, he is wrong about the state of Brython [https://groups.google.com/d/msg/brython/NRHEaoxAfgw/xMipOAYN...](https://groups.google.com/d/msg/brython/NRHEaoxAfgw/xMipOAYNBAAJ)

</comment></comment></comment><comment><USER12> In the future we might be able to compile to Web Assembly.

[https://github.com/WebAssembly/design/blob/master/README.md](https://github.com/WebAssembly/design/blob/master/README.md)

</comment><comment><USER13> I'm amazed that it works, but not sure it's all that useful. Python is OK, but it's not really much better than Javascript for the things people do client- side.

Why do so many people hate the DOM? You need some kind of representation of the page, and the DOM is just a tree representation of it. It's not hard to access or modify from a program.

And why this sudden enthusiasm for running programs in the browser? Is it because Java applets and Flash have finally been removed from most browsers, and people needed those capabilities?

<comment><USER8> It comes down to people do need to do things in a browser context... Java and Flash just had horrible security track records. In the end, if Adobe had made flash more standardized. If they could have gotten the format closer to xapp/silverlight packages, around JS, SVG and MP3 native in the browsers, they could have kept making money on the tooling, and been better off. That was my hope when Adobe bought out Macromedia... didn't work out that way.

In the end, people are learning what works best... In the end it depends.. I think it comes down to being that people want cleaner application development targetting the browser.. I think modern node/babel/webpack apps are much better as a workflow (I also like React). However, I don't begrudge people wanting to target other environments.. I think source maps go a long way to making it nicer to do in practice.

I'm also appreciating the resurgence of more FP concepts over OO everywhere... Outside of controls/components, I don't think classes work well for most JS needs.

<comment><USER13> Java and Flash were supposed to be sandboxed, but weren't. Is there a convincing demonstration that "asm.js" is more secure? Or is it just that nobody has done a big "asm.js" exploit yet. "asm.js" exploits have been found.[1][2] There are probably others already being exploited.

[1] [http://www.scip.ch/en/?vuldb.12180](http://www.scip.ch/en/?vuldb.12180) [2] [https://www.mozilla.org/en- US/security/advisories/mfsa2015-2...](https://www.mozilla.org/en- US/security/advisories/mfsa2015-29/)

<comment><USER8> asm.js should have the same sandbox model that JS in general has. Which, while not perfect, has been a bit better than Flash/Java... Removing all programatic functionality from the browser simple isn't a reasonable option. And imho it's better than the binary plugin option.

</comment></comment></comment></comment><comment><USER14> Seriously... do we really need to invent yet another implementation of Python that runs on the web in Javascript? I mean it with heart. How about we just have one language and one implementation forget about it? Wouldn't that be super ideal?

<comment> emily-c Even if it's not extremely useful it's an interesting project. People tend to like doing interesting things for fun.

<comment><USER15> Per comments above, pypy.js is not presented as an trivial but interesting thing, but as something useful.

<comment><USER16> It's easy to see how this could be useful for somebody though.

Imagine you're a scientist, and you have a large, pure python codebase - let's say for intelligently predicting the number of foos in a bar - and you want to make that available via the browser, in order to visualize the progress of your foo-hunter.

This makes it a trivial task - and means you can use cool web-based visualization tools (D3, etc), and combine with other useful APIs.

<comment><USER17> I think most scientific apps written in Python rely on native non-pure-python (written in C, Fortran etc...) modules which I'd expect to not work in this context.

<comment><USER18> If you wanted to go crazy you could use Emscripten but I could easily see pushing the C+Python parts to a server-side web service and then using Pypy.js for the rest.

</comment></comment></comment></comment></comment></comment><comment><USER19> I wonder if this is a toy/technology demo, or a really solid Python execution environment.

Tech demos/toys are an interesting distraction for a minute. Deep efforts to build a full execution environment warrant deeper attention.

</comment><comment><USER20> A browser is not a decent platform for anything.</comment>


The Long History of Debt Cancellation - <AUTHOR> https://bostonreview.net/class-inequality-politics/olivia-schwob-long-history-debt-cancellation <comment><USER2> If you cancel all outstanding student debt owed to the government, you cannot offer government-backed student loans in the future, because people will not make payments on loans they expect to be forgiven. A massive contraction of government money going to higher education may be a good idea, but I don't think that's what cancellation proponents intend.</comment>


Ask HN: Can aquarium UV lights be used to kill coronavirus? - <AUTHOR> The below paper suggests that with approx 2.4mWsec/cm2 it's possible to inactivate 99% of viruses. No specific mention of coronavirus, but could we use 13W aquarium UV lamps (are they UVC?) for an effective solution?<p>https://www.researchgate.net/profile/Chun_Chieh_Tseng/publication/239392662_Inactivation_of_Virus-Containing_Aerosols_by_Ultraviolet_Germicidal_Irradiation/links/54f823b80cf2ccffe9dce501/Inactivation-of-Virus-Containing-Aerosols-by-Ultraviolet-Germicidal-Irradiation.pdf <comment><USER2> What's the usage idea?

UV sterilizers do work on most all viruses from what I understand but the issue is the the further from the light source the less effective it becomes and time, temperature and humidity are all factors which can affect the effectiveness. A UV-C light strong enough to clean a 100 sq ft room would be dangerous to humans so it could only be used as a sanitary item and not on all the time. At least as far as I understand it.

edit: just saw your usage idea. Not sure it would be doable and safe for humans but packages seems totally fair game.

<comment><AUTHOR> Correct - the idea is mostly for ebay/amazon small packages, gloves, mobile phones and glasses (maybe even shoes though I don't see them as a big threat). Never directly applied to skin nor pointed at face/eyes; I'd probably use some tin foil to reflect part of the light, and use sunglasses as precaution though I need to check if they filter UV-C. Any ideas of sensors that could be used to measure W/cm2?

</comment></comment><comment><USER3> the overhead lamps are not what you want, you want the bulb for the UV sterilizer that is normally used for UVirradiation of water circulating through a manifold.

you dont want to use this as normal illumination, it is damaging to the eyes.

there is a system where microbiological labs are under constant intense illumination with UV while they are unoccupied. you would be doing something similar i suppose?

have look here as an example of what you would need to do a proper job:

[https://www.light-sources.com/solutions/germicidal-uvc- lamps...](https://www.light-sources.com/solutions/germicidal-uvc-lamps/uv- light-applications/uv-light-sterilization/)

[https://www.light-sources.com/solutions/germicidal-uvc- lamps...](https://www.light-sources.com/solutions/germicidal-uvc-lamps/uv- germicidal-lamps/low-pressure-mercury-lamps/high-output-quartz/)

<comment><AUTHOR> I was thinking something like this [https://www.ebay.co.uk/itm/283782783926](https://www.ebay.co.uk/itm/283782783926) or even this [https://www.amazon.co.uk/gp/product/B00J3EUJPA](https://www.amazon.co.uk/gp/product/B00J3EUJPA) to build some kind of wand to sterilize packages or clothes as I walk through the door. Just checked your links - I'm surprised the output is super low: 48W only yields 120uW/cm2. Does it mean a 12W UVC lamp would yield ~30uW/cm2? In terms of virus sterilization, would I need to expose the surface to a 12W for 80sec to get the 2.4mWsec/cm2?

<comment><USER3> ahh ok its not like a light sabre :)

its like a half life thing, the energy from the UV radiation makes the molecules of the virus shimmy and shake until it breaks, and this is time dependent so for a given |dosage| of UV you need wattage over time at distance from the source. it might be better to hang the garment in a closet or enclosure and expose it for a period of time.

in particular, the cuffs, and the upper chest lapel area, and the hip/pocket area these are typical hotspots.

<comment><AUTHOR> just pictured myself with a Darth Vader mask and a UVC portable sabre to kill covid-19... re-reading those specs "Measurements were performed on a high- frequency, current limited electronic ballast and represent average values at 1 meter" \- this means the output could be considerable higher at a few inches and it'll take only a few seconds to sterilize small garments (and mobile phones). It could work.

<comment><USER3> you just have to be carefull about repeated exposure of skin and eyes. light energy dissipates as a square function of distance the general idea is quarter the energy for 1 foot distance increase a quarter of that again when you get to 4 feet away...

maybe this is more concise:

[https://en.wikipedia.org/wiki/Inverse- square_law](https://en.wikipedia.org/wiki/Inverse-square_law)</comment></comment></comment></comment></comment>


"Users want control" is a shoulder shrug - <AUTHOR> https://www.ianbicking.org/blog/2019/04/users-want-control-is-a-shrug.html <comment><USER2> I'll offer a contrarian opinion. A lot of the issues raised recently in our industry around privacy or algorithmic bias come from the fact that as an industry tech has the hubris to believe that it knows better than its users what is best for them. Under the pretense of simplicity and scalability, we think that every individual behavior and tastes can be reduced into a one- size-fits-all product and business model, sprinkled with machine learning to give the illusion of a product experience tailored to different people, when in fact it is only mildly so. And I'm saying this as someone building machine learning models for a living.

<comment><USER3> Perhaps I am thinking too narrowly, but I think the algorithm-driven approach is much less hubris than someone at the company making a decision. These models reflect what users do -- isn't that much more democratic than employees deciding?

There is an orthogonal argument that this is also harmful to some people's aspect, but "give the people what they want" doesn't seem like it's reductive. Especially when it seems like people in our society can be clustered and have some clear groupings occur.

<comment><USER4> >These models reflect what users do -- isn't that much more democratic than employees deciding?

What users do is different from what users would like to do. If people's aspirations lined up with their real behaviors, Planet Fitness wouldn't have a business model. But when navigating the world people often want to improve themselves into something they want to be, not fall deeper into the worst tendencies they exhibit in any given moment.

</comment></comment></comment><comment><USER5> The truth of "users want control" depends on how closely your users' preferences resemble each other with regards to the particular service you're providing. If you can make one set of choices that works for all users, then no, users don't want control. If you can't, then the users will be demanding that control whether you give it to them or not, and if you don't they'll go elsewhere.

If you're small, you get to sidestep this distinction by defining your market carefully. Apple is one company that famously does not give users control. Is it true that PC users don't want control? No. That's why Windows has 80% market share in PCs and Android has 75% market share in mobile. But it's true _of Apple customers_ , and in return for giving up control, they get a well- integrated user experience that's relatively bug-free, just works, and requires no extra thought on their part. You could look at dealing with hardware incompatibilities, avoiding crapware, integrating systems, and so on as services that Apple provides to its customers, and as a result they can charge a premium on their devices and make handsome profits.

This model falls down for public policy, like privacy, because people have _different_ priorities that lead to _different_ tradeoffs. I will happily give Google my location if it helps me avoid traffic jams, something many HN readers object to. I will post semi-identifiable comments on Hacker News, because I've derived fairly significant benefit from comments here. I don't generally post pictures of my family on Facebook. I certainly don't document my every waking moment with Instagram. Many other people make different tradeoffs, and that's their right.

It's debatable which bucket health care falls into - I suspect most people are in the "just make it work" camp until they dig into the details of exactly what experience and cost "just make it work" entails. I'll point out that the Apple experience for health care is completely possible with Kaiser Permanente and other managed HMOs, if you are willing to give up your choice of providers. Stay within their network and everything "just works", but then you have to stay within their network.

<comment><USER6> Apple gives their users forms of control, but not necessarily the forms that HN commenters agree with.

For example, this week I was explaining to someone how different the iOS (possible) and Android (impossible) processes are for finding and removing spying crap if you don't know how to operate technology very well.

I showed them Settings > General > Profiles on my phone, explained briefly that I'd opted in to them, and that they wouldn't have that because they weren't a developer.

They had it! For a coupon email spam account. That they'd tried out a year ago and were now unable to completely remove. They removed it immediately.

No, we can't root iOS devices reliably (rarely at all), but in exchange, non- technical users gain control over their device to a degree that rootable devices make impossible.

It's not about whether you have control, it's about whether you have the degree of control you desire, and whether that control provides the needs you desire.

I, an advanced technical user, use iOS because I can prove efficiently that it's unharmed. I consciously gave up a rooted device with a keyboard for it. I have a 50% typo rate and I miss a lot of things. But the need for safety is paramount, or else everyone protected by my MFA tokens is at risk from attacks so severe I can't even fathom.

<comment><USER7> Different people want different things.

I can't use iOS because it doesn't meet my needs: T9 Dialer, Homescreen customization, Guest mode/Multiuser (not Guided Access), better notifications, real Firefox, better multi-tasking etc.

Add: I also think it's unfair to compare the security capabilities of a handful of Apple phones with the countless Android phones out there. People have the option of buying Android phones from Google, which have comparable security guarantees as any iOS device (while allowing root access to people who actually desire that).

<comment><USER6> If it can be rooted by you, it can be rooted by someone close to you, at which point it can be modified to install competent spyware tooling that hides that it's rooted. Women who have been stalked by their exes will be quite familiar with the risk this poses. So will people who need Tor Browser to keep them safe from their governments.

I'd accept this as fine if I had to order it rooted from Google in hardware, so that the bootloader could show an unskippable "This is a rooted device and lacks critical security protections against malware attacks" warning.

Sadly, that's not currently on offer. While your needs are legitimate, offering rooting in software on consumer-facing devices is more dangerous than they can afford. To me, the harm that comes to others isn't worth it.

<comment><USER8> > I'd accept this as fine if the bootloader could show an unskippable "This is > a rooted device and lacks critical security protections against malware > attacks" warning. Sadly, that's not currently on offer.

It is on offer, that is already how Android rooting works on most phones (at least, every Nexus, Motorola, HTC, and LG I've used already does this). You already get that warning you requested _and_ your phone shows some sort of "unlocked" icon on every single startup to remind you your phone has been rooted _and_ your phone auto-wipes all data itself before unlocking too.

Screenshot of the warning message (Motorola) -> [http://androidadvices.com/wp- content/uploads/2014/11/unlocke...](http://androidadvices.com/wp- content/uploads/2014/11/unlockedbootloader_320-1024x1024.png)

Screenshot of the warning message (HTC) -> [https://img.xda- cdn.com/zgUZzE19yICj6wdJm--RJopG_-U=/http%3A...](https://img.xda- cdn.com/zgUZzE19yICj6wdJm-- RJopG_-U=/http%3A%2F%2Fwww.htcdev.com%2Fimages%2Fuploads%2Fbootloader%2Fstep13.jpg)

Screenshot of the every-single-boot reminder icon (Google/Nexus) -> [https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT-...](https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT- Nexus-5-boot-unlocked-w628.JPG)

We can argue over the particular clarity of the wording and icons and such. But generally speaking, the functionality you are asking for has already been Android standard default for many years now.

<comment><USER6> The Motorola one is partially acceptable. I had no idea, thank you! It's unfortunate they fail to mention the threat of spyware, since that would make more sense to a typical consumer than "you'll shoot your eye out, kid" as shown here. More work to do here, Motorola.

Do all manufacturers offer that sort of clear warning text, or just Motorola? The unlock icon alone is meaningless.

<comment><USER9> Samsung phones also warn you if there security features of Knox (their security platform) have been bypassed or turned off in red letters at boot.

<comment><USER6> Do they warn non-technical users on every boot that their device could be used to spy on them in language plainly understandable to a consumer?

I'm glad they have any warning at all - but warning in tech developer terms and warning in consumer-understood terms are entirely separate problems, as Motorola's insufficient developer-focused terminology demonstrates.

<comment><USER10> You have moved the goalpost quite a bit by expecting such high standards from Android. As in you're asking for a message that absolutely every user can understand, while for iOS you've been totally fine with power users being necessary to identifying threats.

My Sony and a Huawei I set up for a family member show similar warnings after unlocking them, btw.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> > _Control is what you need when you want something and it won't happen on its > own._

Err. Well. No, not usually. Usually it runs the other way. I want control because I specifically _do not want_ you taking over my life, not because I disagree with the way you're taking it over. I _don 't want_ it to happen on its own.

I can imagine the author in an automaker board room, arguing vehemently that if they only move from a ten-speed automatic transmission to a twelve-gear, the smoothness and low-end power will make it so nobody wants a manual transmission anymore.

But that simply isn't the case. Freedom has inherent value. Simplicity and approachability have inherent value. People prefer to drive rather than fly or take a train because they want to be in the front seat - literally. Control has a value to it that far exceeds the mere pedestrian concern of whether your approach was good enough.

<comment><USER12> I think this "a car give you freedom" American thing to be somewhat funny because to me it's the opposite: a car is a huge investment, it costs you a ton of money per year, puts you down in one place (and thus prevents you from moving to another place easily), makes you mostly sit in traffic while going to work while contributing heavily to destroying the planet. I personally enjoy taking a train to where I'm going much more, especially in places where it's convenient.

<comment><USER13> It's definitely _very_ American, but the feeling of cruising down an empty highway in a piece of "Detroit iron" is something that has to be experienced to be understood --- if all you've ever driven or ridden in are smaller or less comfortable vehicles, I can see how you would think driving isn't very enjoyable. Even with lots of traffic around, I still think that sitting in my own "personal lounge" is better than sharing a cramped train or bus with all sorts of strangers.

<comment><USER14> The train doesn't need to be cramped. And if you aren't occupied with controlling a vehicle, you can actually use your time for something useful or enjoyable.

And while cruising down an empty hightway might be very nice, it's excedingly rare for anyones daily commute to be like that.

<comment><USER15> > you can actually use your time for something useful or enjoyable

I'm doing something enjoyable. I'm cruising down the freeway with the windows open, good tunes on the radio, and I can choose to go anywhere I desire.

<comment><USER14> That is not a commute. That you can do what you describe on holidays and weekends when the weather is fair and there isn't much traffic is not a good reason to create traffic, destroy the climate and the local environment, waste your own money and being frustrated in traffic jam.

People are buying cars because they believe in the commercials where the car means freedom. But people use cars to waste their lives in traffic.

</comment></comment></comment></comment></comment></comment><comment><USER16> > For instance, we say "users want control over their privacy," but what > people really want is some subset of:

> To avoid embarrassment

> To avoid persecution

> … sometimes for doing illegal and wrong things

> To keep from having the creeping sensation they left something sitting out > that they didn't want to

> They want to make some political statement against surveillance

> They want to keep things from the prying eyes of those close to them

> They want to avoid being manipulated by bad-faith messaging

\</comment><comment>-----

You forgot the two most important ones. Users want their privacy because.

A) they do not trust you.

B) They expect that everything they do, will be used against them. (eg providing an email address will result to receiving spam. Providing personal details to advertisers using them etc).

C) Info they leak, is leaked out forever. Today that might be ok, but circumstances might change tomorrow.

It is a bit dishonest to say that users want privacy because they want to do illegal things. Or that they want to make a statement against surveillance.

Wanting privacy is not a statement, it is an end-goal on its own.

Yes I am missing the point of the article but I had to point the above out.

<comment><USER17> The author addresses you pretty directly.

>There are some cases when a person really does want control. If the person wants to determine their own path, if having choice is itself a personal goal, then you need control. That's a goal about who you are not just what you get. It's worth identifying moments when this is important. But if a person does not pay attention to something then that person probably does not identify with the topic and is not seeking control over it. "Privacy advocates" pay attention to privacy, and attain a sense of identity from the very act of being mindful of their own privacy. Everyone else does not.

<comment><USER18> But privacy advocates do it on behalf of everyone else

Even if some majority of users do not care about privacy i dont believe our most fruit bearing path is build w/less autonomy.

There is so much distance between how things need to be built and whether or not end users identify with some component of the system.

</comment></comment></comment><comment><USER19> It's unrealistic that an organization can predict exactly what users want. If you try to do that, it's like central planning of the economy. It just doesn't maximize people's happiness.

However, if you give them lots of control and monitor choices, you can modify your defaults to improve that situation... but don't expect preferences to remain static.

<comment><USER20> > ...and monitor choices, you...

So... more telemetry. This user says no thanks.

</comment></comment><comment><USER21> > People don't want to lose their data, but having personal control over your > data is a great way to lose it, or even to lose control over it.

I don't think "personal control" implies that nobody else has full access to one's data. If that were true then NDAs would be useless.

The idea of users "wanting control" simply means they want ubiquitous software to work like the _best_ parts of ubiquitous social structures they've grown up with that _aren 't_ the internet.

That is: facilitate personal growth and self-expression in a framework where individual failures and oversights don't accumulate to create a goddamned international environmental hazard.

For example-- I'd bet there are a lot of Youtube posters who would _love_ the following two features:

1\. Painlessly upload videos that assert their opinionated world view at that moment in time.

2\. Have people find it without plugging into a recommendation rabbit hole of contention that reframes their content as yet another rusty nail in a goddamned international environmental hazard.

> But if, as technologists, we can't map functionality to desire, it's a bit > of a stretch to imagine everyone else will figure it out on the fly.

And one level above that-- if you don't have a legal framework where it's against the law to put cocaine in soft drinks then mapping functionality to desire will often be an unethical endeavor.

</comment><comment><USER22> True. People didnt care about who had their data until the data started being used unethically. But now these unethical practices are so common, they are considered ethical. We used to print books with everyones name and number in the city. You would give your phone number out freely. But now, people keep their phone number hidden because its abused more then its actually used these days.

</comment><comment><USER23> I am reminded of a passage in the book "the subtle art of not giving a f*ck":

"For a relationshipt to be healthy, both people must be willing and able to both say no and hear no. Without that negation, without that occasional rejection, boundaries break down and one person's problems and values come to dominate the other's."

The problem is that users are not given the choice to say no.

</comment><comment><USER24> It's not about knowing better, it's about actual conflict of interest.

Think about how much of the internet runs on advertising dollars. This leads to a situation where much of the internet serves the interests of people trying to maximize profits when selling stuff over the interests of people wanting to be well-informed about stuff they buy and looking for the best possible deal. -- When you search for "usb stick", of which there are gazillions, in an online store, which one will you be shown on page 1? The best product at the best price? Or the product made by the person who payed them to show their product first? (advertising expenses that they'll have to recoup by making that stuff more cheaply or selling it more expensively)

Think about how copyright owners instrument digital rights management to try to maximize monetization of content over allowing users to make good use of rights in copyrighted material that they already possess. -- If you're 70 years old, and you're into the beatles, you probably paid for that music at least four times. You bought a record when it came out, buying the right to listen to that music for the rest of your life. But for some reason, you paid for buying that right a second time when it came out on CD. A third time when you bought an MP3 download. A fourth time as part of a subscription package that you now have. -- The development of the technology did not serve the interests of the user. Otherwise, a RW-medium like minidisc would have won over CDs, allowing you to maybe record from vinyl to minidisc. "Copy Protected" CDs would have never happened but instead ripping-friendly CDs would have been produced because this was what would have been in the user's interest. And streaming would have happened on the basis of making micropayments when streaming stuff you don't already own instead of turning everything into a subcription package.

Think about how insurance companies might use the information gathered by the surveillance system which is the internet.

People THINK that when they are the ones paying for a computer, for an internet connection, etc that they are paying for technology that should now serve THEIR interests. The fight for user control is the fight to actually make that happen. And a fight it is. It's not a given that technology is made to serve the user's actual interest.

<comment><USER25> _If you 're 70 years old, and you're into the beatles, you probably paid for that music at least four times. You bought a record when it came out, buying the right to listen to that music for the rest of your life. But for some reason, you paid for buying that right a second time when it came out on CD. A third time when you bought an MP3 download._

Why would you buy an MP3 download if you already had the CD? The most popular MP3 player at the time - the iPod was used with iTunes that it made it very easy to rip your own CDs. There was a way to rip CDs in Windows 2 decades ago.

 _A fourth time as part of a subscription package that you now have._

If you didn't want the benefits of having access to all the music out there and just wanted your own library, you still wouldn't need a subscription service. In the case of iOS, you could pay a one time fee of $25 for Apple Match and you would have up to a year to use it. With Apple Match, it will match all of the music in your library no matter where you obtained it and count it as purchased song that you can redownload from iTunes DRM free.

 _The development of the technology did not serve the interests of the users._

The user has a choice between subscription music that has DRM, purchased music that is DRM free, or easy to use software that lets you convert physical CDs.

 _Otherwise, a RW-medium like minidisc would have won over CDs,_

CD-RWs were already backwards compatible with CDs. I was burning CDs using a parallel port CDRW in the late 90s.

 _allowing you to maybe record from vinyl to minidisc._

You've been able to take a record player, connect it to the audio in Of a computer, record the audio and burn it to a CD. I'm sure there were standalone boxes that let you do it. _"Copy Protected " CDs would have never happened but instead ripping-friendly CDs would have been produced because this was what would have been in the user's interest._

Copy protected CDs were really never a big thing.

 _And streaming would have happened on the basis of making micropayments when streaming stuff you don 't already own instead of turning everything into a subcription package._

People _wanted_ subscriptions and not micropayments.

<comment><USER24> You're coming at it from the POV of a "power user". Most people aren't that.

> Why would you buy an MP3 download if you already had the CD? The most > popular MP3 player at the time - the iPod was used with iTunes that it made > it very easy to rip your own CDs. There was a way to rip CDs in Windows 2 > decades ago.

...actually, if you ripped a CD with iTunes, it would turn into a format that almost no software other than iTunes could read. The same thing was true about Windows media player. So you COULD rip stuff, but you would get from one kind of vendor lock-in into another kind of vendor lock-in. If you wanted MP3, you had to put a fair amount of thought into it, download special software, etc, i.e. you had to be a power user, and you had to put a lot of work into it if you had a couple hundred CDs on the shelf and wanted your collection to go on a hard disc. Besides myself I know only one other person who did that.

Also: I was making a more general point here. Substitute "DVD" for "CD" and "movie" for "music" and the argument still holds. DVDs had encryption that had to be cracked by somebody, the crack having to be obtained illegally by anybody who wants to rip a DVD.

The actual point I was making was the following: These examples show how, in one area, the tech industry will be hard at work trying to make certain things DIFFICULT (like cancelling a subscription deal, where they might accept fax as the only method of communication, or copying copyrighted material) and hard at work trying to make other things EASY (like signing up to a subscription deal, re-purchasing stuff you already own). Most people go the way of what's EASY. But that does not usually serve their own interests.

> The user has a choice between subscription music that has DRM, purchased > music that is DRM free, or easy to use software that lets you convert > physical CDs.

Purchasing music that is DRM-free happened very late in the game and is still a niche topic. The first businesses to try and offer downloads that you'd pay for (like napster when it tried to go legit) failed because they couldn't get content deals, because the music industry didn't want DRM-free downloads for fear they would be copied illegally. The first service that actually made it commercially viable was iTunes, and they only managed it because they could get the content industry on board through introducing DRM. -- The fact that we now have DRM-free downloads in certain niche areas is a side-effect of the fact that most people have subscription packages now anyway, and offering DRM- free high-quality music is now a way to charge them YET ANOTHER time. (purchasing that Beatles album for the fifth time).

> CD-RWs were already backwards compatible with CDs. I was burning CDs using a > parallel port CDRW in the late 90s. You've been able to take a record > player, connect it to the audio in Of a computer, record the audio and burn > it to a CD. I'm sure there were standalone boxes that let you do it.

That made YOU a 1-percenter when it comes to technology. Most people I knew in the late 90s could have never figured out how to hook up a record player to a computer, record a WAV file, and burn it back to a CD. -- You're not representative for how that industry works/worked at any point in history.

<comment><USER25> _actually, if you ripped a CD with iTunes, it would turn into a format that almost no software other than iTunes could read. The same thing was true about Windows media player. So you COULD rip stuff, but you would get from one kind of vendor lock-in into another kind of vendor lock-in. If you wanted MP3, you had to put a fair amount of thought into it, download special software, etc, i.e. you had to be a power user, and you had to put a lot of work into it if you had a couple hundred CDs on the shelf and wanted your collection to go on a hard disc. Besides myself I know only one other person who did that._

iTunes has never ripped music from CDs into a DRMd format. By default it used (and popularized) AAC after the iTunes Music Store, but you could change the preference to MP3. AAC was never owned or controlled by Apple. It was just another format that was licensable to anyone just like MP3. Within two years of the iPod, most players supported DRM free AAC.

Don't forget that the whole "Rip,Mix, Burn" commercials that Apple used for advertising iMacs came out two years before the iTunes Music Store. Before the iTunes Music Store, the iPod could only play MP3 files.

They required a firmware update to play AAC files.

It also wasn't the "tech industry" that introduced anti copying measures to video. The video industry did that during the analog days with Macrovision.

 _That made YOU a 1-percenter when it comes to technology. Most people I knew in the late 90s could have never figured out how to hook up a record player to a computer, record a WAV file, and burn it back to a CD. -- You 're not representative for how that industry works/worked at any point in history._

That maybe true. But when Apple introduced iMacs with CD-RWs, it was already behind. PCs had started coming with CD burners and Roxio software by 2000.

</comment></comment></comment></comment><comment><USER26> Nobody ever has your best interest in mind except yourself.

You can throw all the money in the world at healthcare, you can make it free, and you should still get a second opinion and be involved as a direct agent in your health choices.

Humans are agents, that is to say, they have agency. There is no single optimum outcome for all people - there may be an optimum for a business (the most profit), a healthcare provider (the least amount of getting sued) or other entities, but there is no single best outcome for agents.

Given that no system can give the best outcome for all people, the system shouldn't even bother but instead empower people to make their own outcomes. The problem is that sometimes people choose bad outcomes - but that is also an expression of agency.

<comment><USER27> Sure. But _only_ giving users control, in the form of being able to choose between the available providers, does not solve the problem by itself.

Say you sprain your pinky finger and your insurance covers two doctors: Donald Drugmeister who can afford to pay his office staff only by pushing the latest offerings from Pfizer, and the excellent surgeon Carl Cutter who will decide your root problem is in some organ that needs to be removed. You may feel vast relief that you're able to choose Donald over Carl, but in actuality you'd be better off going to your mom who will give you an ice pack (not covered by your insurance!) and kiss you on the forehead.

The US healthcare system, at least, cannot be fixed simply by handing over all control to the patients. That'll just end up with even more strenuous efforts by the pharmaceutical companies to convince of us, the non-medically astute population, of the necessity for various drugs that they happen to make money off of. And even more antibiotic overuse and unnecessary procedures.

I think having choice of doctors is part of the solution, as is having a pretty high degree of control over what procedures and drugs are used in each personal situation. But if the only fix on offer is to allow more control over the choice between mediocre or bad options, then we're all screwed. (And the less privileged are even more screwed than the rest of us.)

I agree that the system shouldn't even bother to guarantee the best outcome for all people, but I don't think empowering people to make their own outcomes is going to get us very far.

<comment><USER26> Whether it's the US or the UK or wherever, you need to be an active participant in your health choices and reading up on the materials available to you.

That isn't affected by whether your healthcare is socialized or infinitely expensive.

You probably have more choice in a non-totally socialized healthcare setting, but only to the extent you can afford choices. Neither extreme is any good, but the ideal is a golden median with many affordable choices.

</comment></comment></comment><comment><USER28> Let's put it in simple CRUD terms. Users want to:

C - control when you collect it.

R - read what you have on them, and know how you read it and/or share it with others.

U - update it, e.g. when it is wrong.

D - delete it.

Most users just want non-hostile defaults, but all users should have CRUD- control.

<comment><USER29> I'm not sure why this is downvoted - it's a little bit counter to the scope of the parent article, which applies to all sorts of design decisions, not just data retention and usage, but I would agree that this /is/ the base level of control over any data that a third party has from me and should be enshrined in law.

It has been great to see Apple, for example, move more towards better awareness and defaults for C, but by and large the internet is still a mess of hostile defaults, opaque privacy statements, and no way to know that this weather app is selling your location to advertisers when they could've just asked you for your location, if they wanted to be a weather app.

</comment></comment><comment><USER30> related tweet from @SwiftOnSecurity yesterday.

"The difference between Excel and a database is if they use Excel they don't have to talk to your elitist ass."

Too true

</comment><comment><USER31> > For instance, we say "users want control over their privacy," but what > people really want is some subset of:

> (...)

> To avoid persecution

> (...)

That's like saying "drivers don't want safe cars, they just don't want to die in a car accident".

Will you stop making safe cars, then? If not - how is that an useful information?

I understand it wasn't the main point of the article, and I might even agree with the main point in general (I'm not sure, there are exceptions), but that was bad example.

</comment><comment><USER24> ...kind of reminds me of a slogan by "Die Partei", a political party -slash- set of comedians that runs in German general elections as a platform for political comedy. The slogan goes "We'll do it right!" \-- Laugh about it for a moment. Then think about why it is so funny. Then stop laughing when it dawns on you how f*ing terrifying it is that this is where society is headed.

</comment><comment><USER32> For me, control in technology does not mean being able to go and press buttons in a maze of options. Control means being able to use an ad-blocking plugin in a browser written by an ad-tech company, to use off-brand ink in a printer, or to use a government API with a program written to optimize my taxes.

</comment><comment><USER33> "try and understand underlying motivations whenever you see 'want control of X'" is neat point.

I'd think "if the system satisfies all the desires, people don't need autonomy" and "people need control/power, because systems inevitably fail" are two contrasting viewpoints.

</comment><comment><USER34> Most users want to take back control when the default behavior stands in the way of their current workflow. So the best scenario is the default configuration is handy for basic uses, and the behavior can be tweaked extensively when needed.

</comment><comment><USER35> > Making the claim "users want control" is the same as saying you don't know > what users want, you don't know what is good, and you don't know what their > goals are.

Yup, that's exactly what I'm saying. There might be overriding concerns coming from _community_ needs (which is where arguments for things like ACA and other public healthcare come from, actually, and why I might not give a user a particular configuration option), but while I might know better what a platonic ideal of a user wants, what any particular user wants _I do not_ unless I ask them.

</comment><comment><USER36> Having control is just the least common denominator.

Sure, in the end, people want other things and control is just a basic tool to reach a goal, but as long as we are not 100% sure what they want we will hold them back on their way to reach their goal if we take away their control.

\- First, give users control (enable them to reach their goal, whatever that might be).

\- Second, reason about what their goals are and make those easy to achieve (reduce friction, without taking the control away).

</comment><comment><USER37> How does he know what users want? I presume by the term "user" he means someone is not one of the authors or who cannot1 themselves modify the software as they wish.

As a user, I do not ever recall being asked what I wanted by anyone at Mozilla nor have I ever heard of any other user being asked.

1 I could modify Firefox but the compile process requires more time and resources than what I consider reasonable.

<comment><USER38> Mozilla uses telemetry in their products to try to understand what Firefox users want. We only use telemetry to improve our products (which is directly related to understanding user desires), and we have a data review policy to ensure we are collecting data in an attempt to improve things for those people we collect data from.

Additionally Mozilla regularly surveys samples of its user base, and conducts in-depth interviews of the public to try to understand desires.

<comment><USER37> Are the dates, detailed methods and raw results of the "surveys" and "in-depth interviews" made available to the public?

</comment></comment></comment><comment><USER39> As a control freak I don't agree. I feel uncomfortable even with good solutions I don't understand and have no control over. I think a lot of Linux users like myself have chosen it because of that in the first place.

And the same holds for privacy even more. I'll prefer encryption on my machine with my keys to the best permission model in the cloud.

</comment><comment><USER40> you have to define control first. personally i think it is a dev to users in the form of options but you have to create options that will get the most need and has mostly the most following for the most part. with advanced users almost on par with developers some times a light hackable modular design is better.

</comment><comment><USER41> Sometimes what users want is what users think of as a solution to their problem in the context they have. For example, users want better taxi services -> turns out ride-sharing is a better solution. Taxi service is a solution to the problem of getting point A to B.

<comment><USER27> Ride-sharing is a better taxi service. Or rather, the uber/lyft thing that is misnamed "ride-sharing" is a better taxi service. Better because of the experience of hailing a ride, and better because it is cheaper due to externalizing a bunch of costs onto the drivers and society. But not different.

</comment></comment><comment><USER42> Users dont want plugins or extensions. They want features that are missing from the product.

</comment><comment><USER43> > People want good health care. If they don't trust systems to provide them > good health care, if they don't trust their providers to understand their > priorities, then choice is the fallback.

Applies to any settings page with too many options.

</comment><comment><USER44> As a user of services, I _do_ want control. Whether my privacy needs are met is not good enough unless mathematically guaranteed, and even then there are social/integration features that may add side channels that require control. An example of such a feature would be Signal requesting your contact list to find out whom, among your friends, is also using Signal (which isn't too horribly an anti-pattern in this case because the app still works without read access to your contacts).

Why? Because I want to be able to revoke access to any of several specific details about me or my device based solely on whether I feel like it. As soon as this is taken for granted, it is devalued and users lose leverage. Then the conversation during development becomes whether a proposed new feature is "worth" an encroachment on user privacy.

</comment><comment><USER45> Reminds me of when Gordon Ramsey tried to explain to a clueless "chef" not to just give endless options. " Well why are you here then ? "

</comment><comment><USER46> I just saw ads on that blog post. I thought that was odd given the context. I went back to see again, and they were not there anymore. Is one of the included script tags up to no good?

<comment><USER38> :( Probably Disqus, I turned off ads but it looks like they've turned them back on for free accounts. I'd change comment providers, but doing it for new posts while leaving Disqus on old posts is beyond my energy level.

</comment></comment><comment><USER47> As a counterpoint, if you give users control, you don't have to figure _exactly_ what they want. They can also get creative.

And _in some cases_ that is exactly the right approach.

</comment><comment><USER48> I did a thought exercise and replaced users with pilots in light of the Boeing 737 Max crashes. Pilots wanting control is not just a shoulder shrug.

<comment><USER49> How about a thought exercise where you replace users with the customers of the Boeing 737 Max flights---the passengers? They don't want control. They want to be flown somewhere without dying.

</comment></comment><comment><USER50> True, but also possible that users want control.

</comment><comment><USER51> OK, users don't want control. I'll start a Netflix with only one movie because they don't want control over what they watch.

</comment><comment><USER52> The economist Theodore Levitt said "consumers don't want to buy a quarter-inch drill, they want a quarter-inch hole."

</comment><comment><USER53> How can you trust a system you don't control or see how it uses your data? With this premise the main claim becomes invalid imo while I agree with your point what users desire but I still think control and sovereignty are major points

</comment><comment><USER54> Lost 5 minutes to wondering what other thing you can shrug...

</comment><comment><USER55> In fact it is actually mutliple things, depending on the situation. I think the people Ian is talking about really exist. But I don't think it applies to health care. In health care it's actually a cost saving effort by politicians not unskilled providers trying to hide their lack of knowledge, i.e. reason (5) not reason (1). Therefore educating them or the public is also not an helpful action. More reasonable would be to try to figure out the cause of lack of funds and how to counter it, or if there is no way back to help people along the way, e.g. by writing an article about how to find and read research papers oneself as a previous user of a social health care system.

If you don't believe it or don't understand what I mean, read on:

1) In software dev "Product Owners" who have no idea of their job (or simply see that nothing happens and therefore have better things to do in their life than focus all their energy on their job) say that to have some kind of goal to work towards. True. That's probably also where Ian got this idea from. In this situation it's not unreasonable to do that because if he can't even act like he would have a goal he could not stay in that leadership position.

2) Users also really want control when they can't trust the actual service provider. And that doesn't just mean incompetent providers. It also means providers with goals that compete with the users. E.g. many countries now try to figure out how they can do nextgen_after_4g without Huawei, because they fear the political goals that might stand behind Huawei. In this situation it's also not unreasonable to want control.

3) A third reason is people who know the user's situation better than the user (e.g. IT security experts) and who want to help the users. In that case they will basically do the reason (2) fight for the users without much help from the users. It's a naive but admirable position to take. Not unreasonable.

4) Some people act like they would do reason (3) but actually just try to play games with the users on the user's cost. Anti-Vaxxers are such a group of people. Or the nationalist political grups we saw rise up a few years ago. They take an existing fear of uneducated users, escalate that to unreasonable sizes and then act like they would offer some help in exchange for money or votes.

5) Politicians and highest level corp leaders will say "users want control" when they have an area where they were providing a service in the past that the user come to expect, but for political or market reasons they can't provide that for much longer. So they act like someone else would want it. If they stand there in front of the camera in their $5000 suit, $200 hair cut, and their $3000 wrist watch nobody would believe them if they would simply say "all right guys, there is no more money for that service, let's pull our belts tighter". The only practical alternative I've seen is what the new Pope is doing. But that really needs a fanatic who can live an asketic life style which simply is not for most people. If most people can choose between a $5000 suit and a $2 self-knitted, itching rope then most people would choose option 1. So either you need to put one of a very small number of people in a leadership position and defend them there (which will cost you a lot as well), or you need to accept that "users want control" is the strategy the existing leadership is driving.

Imo the best approach is to think about how to deal with reality instead of hoping or fighting for a reality that can't exist. But I can even see the reasons for why one rather dies dreaming than live in reality. ;-)

</comment><comment><AUTHOR> > I first started thinking about this during the debate over what would become > the ACA. The rhetoric was filled with this idea that people want choice in > their medical care: people want control.

> No! People want good health care. If they don't trust systems to provide > them good health care, if they don't trust their providers to understand > their priorities, then choice is the fallback: it's how you work the system > when the system isn't working for you. And it sucks! Here you are, in the > middle of some health issue, with treatments and symptoms and the rest of > your life duties, and now you have to become a researcher on top of it? But > the politicians and the pundits could not stop talking about control.

<comment> swagasaurus-rex I would want to choice not to place my physical and financial health in the hands of profiteering insurers, but that's currently the only reasonable choice we (people in the U.S.) have.

<comment><USER5> That's not true. There are a significant number of non-profit health insurance companies, insuring a majority of the total market:

[https://www.firstquotehealth.com/health-insurance- news/non-p...](https://www.firstquotehealth.com/health-insurance-news/non- profit-health-insurance)

<comment><USER56> Having not-for-profit tax status doesn't mean they aren't profiteering.

<comment><USER5> If you're worried about that you should be worried about government profiteering as well. Particularly since a very common failure mode of publicly-funded services is for the government to give the contract to friends of the bureaucrats who administer the program. If that's forbidden, a common failure mode is to give the administrator position itself (and usually, a fat salary) to friends of those in charge.

<comment><USER57> When you compare the US situation with other western countries your number one fear should be with US private insurances, private or not.

</comment></comment></comment></comment></comment></comment><comment><USER58> I want you to stop telling me what I want, because it is sickening in its own right.

</comment><comment><USER59> Frankly I'd settle for control of the hardware I paid good money for. Root access on my android devices. Full control over Windows Update without having to boot into Linux and rip DLLs straight out of the system folder.</comment>


Hacker reveals dark arts of Russian blackmail and spies - <AUTHOR> https://www.ft.com/content/54715de2-ec57-11e6-ba01-119a44939bb6 <comment><USER2> sorry is secret unless you pay ransom

</comment><comment><USER3> paywalled

<comment><USER4> The web link under the submission title works for me. (Mobile Safari)</comment></comment>


Show HN: My HTML5 animation app now supports WebGL - <AUTHOR> http://radiapp.com/whats_new_in_v090.php

<comment><AUTHOR> Hi all,

this is a new release of my HTML5 animation app for the Mac. Radi is oriented towards canvas animation and video rendering capabilities.

In this release, it's getting on the WebGL action: you can now apply filters to Canvas and Video elements and have them render in realtime in the browser using WebGL shaders.

You don't need to write those shaders manually either -- Radi includes a node- based effect editing environment that's completely visual, so building filters is a drag'n'drop affair.

Here are some demos:

<http://radiapp.com/webgl>

<comment><USER2> Very cool! About your video demo, you should mention on the page that it is not just a pre-rendered video, but actually THE live demo itself :D

Took me a while to realize that you can actually apply effects to the video element!</comment></comment>


Streaming Search on Tweets: Storm, Elasticsearch, and Redis - dallas-stuart http://insightdataengineering.com/blog/streaming-search/index.html <comment><AUTHOR> Question for people in the know: as I read more about Erlang and Elixir, I'm starting to wonder how it holds up in such an architecture. Would it have similar performance characteristics?

Would something like spark/storm/etc be simpler to implement on top of Elixir? Possibly more performant? Or make better use of CPU cores?

<comment><USER2> I'm currently working at implementing all types of ETL & data extraction processes with Elixir, and so far I must say I like this (although I cannot share numbers are the moment, just yet).

My own impression (as the author of [http://www.kiba-etl.org](http://www.kiba- etl.org) which is a Ruby ETL framework) is that Elixir is going to be a great fit for high-quality, decent throughput data processing of all kinds (streaming, batching, or other such as websocket-api-endpoint types).

The immutable data + lightweight processes + ability to go distributed + concise code (testable, composable etc) is truly appealing in my opinion.

I will share more stuff online (at [http://thibautbarrere.com](http://thibautbarrere.com)) when I can, but I can only say this is so far very promising.

<comment><AUTHOR> Great, thanks for your reply!

</comment></comment></comment><comment><USER3> I didn't understand why author used Redis for the final delivery, when a Kafka cluster was already available. Is there a reason to use Redis here?

<comment><USER4> The author here. I used Redis because I needed a simple way to have users subscribe to and follow many different search queries. In Kafka, this would mean maintaining a very large number of lightly populated topics. As I understand it, that isn't a good way to use Kafka.

<comment><USER5> I had the same doubt thanks for clarifying

</comment></comment></comment><comment><USER6> Thanks for sharing.

>In the streaming case, documents arrive at a very fast rate (e.g. average of 6000 per second in the case of Twitter) and with this kind of velocity and volume it is impractical to build the inverted document index in real-time.

Actually, it's completely practical. It's expensive, but it can be done. When I was at Loggly we built a big ES cluster, pumped 10,000s log messages into it per second, and served queries. Ingest to query was on the order of seconds - it still runs today. The key, of course, is not to build a single inverted index.

I don't want to underestimate the work, but it is practical. And expensive.

[http://www.slideshare.net/AmazonWebServices/infrastructure-a...](http://www.slideshare.net/AmazonWebServices/infrastructure- at-scale-apache-kafka-twitter-storm-elastic-search-arc303-aws-reinvent-2013)</comment>


Ask HN: What are some good sites or blogs about the mechanics behind trading? - <AUTHOR> I'm looking for stuff about the technical side of things (I don't mean the tech they employ, but more about HOW they do it).
Things like in-depth analysis of methods, quants, maths involved and such.
I hope I'm not being too ambiguous but I'm not looking to find the latest stocks to make money from or anything, more about the mechanics and maths of trading... I suppose I'm not sure exactly what I want, just that I don't want to get stock tips or any of that.
Does that make sense? <comment><USER2> I used to work as a professional trader. I see this question so often, but it's just a strange question to ask. You are asking something like "I want to learn programming, you know, to make stuff like Apple or Google" \- If you ask a dozen developers they will give you a dozen different answers depending on what their background is. Some will tell you to learn Javascript and React, some will tell you to understand infrastructure and Go, some will tell you to look at REST and Ruby on Rails, and some will tell you to look at Flutter for making mobile apps, and so on. None of them is wrong, but you're getting all these wildly different answers because you're asking an imprecise question.

Trading is the same. There are dozens of different types of "trading" and everyone you talk to will have a slightly different take, depending on their background. They may talk about portfolio management, directional trading, market making, HFT, arbitrage, options trading, exotics, long-term investing, all of this over different time horizons, technical analysis, fundamental analysis, and so on. None of them are wrong and all of these things are related (just like REST and JS may be related), but you need to be more precise in what you are asking. Someone trying to manage a diverse portfolio and trying to get a low-risk return over several years is using a completely different set of technologies and methods than someone working in HFT. It's like comparing someone writing low-level C++ driver code to someone iterating on HTML and CSS. It's just different, but both are programming.

As a side note: 99% of what you find online are gurus trying to sell you something. They are making a living selling and re-purposing educational content, but have never built anything profitable themselves. And even if they have, what worked 10-20 years ago is no longer relevant today. Books that teach fundamentals are generally of higher quality. [0] and [1] are a good starting point, but again, they are quite specific to certain types of trading.

[0] [https://www.amazon.com/Trading-Exchanges-Microstructure- Prac...](https://www.amazon.com/Trading-Exchanges-Microstructure- Practitioners-Association-ebook/dp/B003ZSHIPE/)

[1] [https://www.amazon.com/Concepts-Practice-Mathematical- Financ...](https://www.amazon.com/Concepts-Practice-Mathematical-Finance- Mathematics/dp/0521514088/)

</comment><comment><USER3> All the money in quant investing is currently coming from analyzing data sets that are not publicly available. Things like credit card data, mobile phone locations, receipt data, etc. When those are crossed with traditional economic indicators and equities prices, a fuller picture emerges.

When a data set is updated, i.e. credit card transactions come out for last week, retail stocks will move accordingly. Modeling this as an outsider without access to that data is like trying to predict a black box.

</comment><comment><USER4> Have you tried [https://blog.quantinsti.com/](https://blog.quantinsti.com/)

Your question got me thinking too and I found that on page 3 of DDG.

It's something I'd quite like to know abit more about too.

</comment><comment><USER5> Google Ernie Chan trading. I don't agree with the trading (I am pro investing) but Ernie explains as a practitioner</comment>


Python moved to GitHub - <AUTHOR> https://github.com/python/cpython <comment><USER2> Part of Github's secret sauce: Web source tree browsing that's front and center, that's relatively decent, with OK search. (versus making the log/history the central part of the Web UI as other tools seem to do)

There are SO many times I need a short peek at something, and am glad don't have to clone/download, etc.

<comment><USER3> > Web source tree browsing that's front and center, that's relatively decent, > with OK search.

The source browsing feels barely adequate to me. There are so many simple things they could do to make it better.

• Show file sizes. When I'm exploring a repo I'm unfamiliar with, one thing that's helpful for me is to get a sense of what the code is like. To do this, I want to look at some of the larger files; that's where I'll probably find the more interesting code. As it is I just click around on random files hoping to find something interesting.

• Show real dates instead of the vaguely rounded off "how long ago". If it says "a month ago", well, what is it, two weeks or six? And why not show the time? A couple of times I've been looking for a code change and I didn't remember what day it was but I did remember it was right before lunch, maybe around 11:30 or so. It feels like their priority is a "clean and simple" display as opposed to a _useful and informative_ display.

• Fix the display for code that indents with tabs. It still defaults to 8 columns, which hardly anyone (with a few notable exceptions) likes. And you, the user, can't override this. They did recently start honoring the indent_size setting if you have a .editorconfig file, but that really misses the point. Many of us who use tabs don't _want_ to specify an indent_size. That's one of the virtues of tabs: people who read the code can use whatever indentation they prefer. The indent size for tabs should be a user preference setting. As it is, I started adding indent_size=4 to my .editorconfig files just to get a decent looking display on GitHub.

• Use a readable font on mobile. Courier, really? And not such low contrast! Everything is hard to read on mobile, and they even disabled pinch-zoom so I can't make the text a little bigger.

• Show a directory tree on the left. If I'm exploring a repo, I'd like to get the big picture of the directory layout, and also have an easy way to click around to look at the various directories. As it is, I have to do a lot of back and forth. Google Code had this from the beginning.

Edit: Thank you everyone for the helpful replies! I learned some great tips from you all.

<comment><USER4> > Show file sizes

Those are at the top of the display of file contents. However, they aren't in the tree view, as you've stated. Unfortunately, this is hard because I don't believe Git stores this info in their index of files, which is what is used to generate the tree view. It might be infeasible to gather that data for the tree view.

> Show real dates instead of the vaguely rounded off "how long ago".

If you hover over any relative date, the real date is shown. It's on the title attribute for any relative date.

> Use a readable font on mobile.

The have Consolas and "Liberation Mono" on the font stack, but those probably aren't on your phone. They are limited in font selection because they have switched to native fonts. This avoids the download of some giant font file that contains all the possible glyphs (which is needed on a site like GitHub's). Unfortunately, the monospace options on mobile are pretty limited: [http://iosfonts.com/](http://iosfonts.com/)

> Show a directory tree on the left.

Best tip I can offer is to type `t` to search by file name. Works great and has partial matching support, which makes it really quick to navigate to certain key files.

<comment><USER5> It's pretty cheap to get the file size with decompressing the whole blob. You can decompress just the first hundred of so bytes of the .git blob object, which starts with "blob {size}\x00". For example, using Python:

       >>> import zlib
       >>> f = open('.git/objects/00/331d4c2e12984f70df4a3dd3bc7296825faab0', 'rb')
       >>> zlib.decompressobj().decompress(f.read(100))
       b'blob 11708\x00...'

So that particular file is 11708 bytes. It still requires an open and read operation. But they could cache that on a per-file or per-tree basis, so it's very doable.

<comment><USER4> At least until you try to open up [https://github.com/Homebrew/homebrew- core/tree/master/Formul...](https://github.com/Homebrew/homebrew- core/tree/master/Formula) :)

</comment></comment></comment></comment></comment><comment><USER6> Yes!

I quite like the idea of "centralizing" development on GitHub, or similar services. It makes it much easier for everyone to fork, test, make a pull request, merge, etc..

For example, one reason why I gave up contributing to OpenWrt was their absolutely legacy contribution system [1], which required devs to submit code diff patches via email (good luck not messing up the formatting with a modern client) on a mailing list. It took me an hour to submit a patch for three lines of code. It seems like Python wasn't much different. [2]

[1] [https://dev.openwrt.org/wiki/SubmittingPatches#a1.Creatingap...](https://dev.openwrt.org/wiki/SubmittingPatches#a1.Creatingapatch)

[2] [https://docs.python.org/devguide/patch.html](https://docs.python.org/devguide/patch.html)

<comment><USER7> Centralizing around proprietary software is not a good idea generally.

Git is distributed, so when GitHub goes down, every developer has a backup of entire history. However, issues are lost forever. Python does not use "issues" feature for good.

One way to avoid email without centralization is setting up Gerrit. That is how Ring [1] and LineageOS (former CyanogenMod) [2] manage their "pull requests".

Still, being able to submit patches via email is an absolutely necessary skill for everyone who considers himself a hacker. Lack of it makes you unable to contribute to many great projects, such as all suckless [3] projects and Linux itself.

[1] [https://gerrit-ring.savoirfairelinux.com/](https://gerrit- ring.savoirfairelinux.com/)

[2] [https://review.lineageos.org/](https://review.lineageos.org/)

[3] [http://suckless.org/](http://suckless.org/)

<comment><USER8> Everyone I know who has had to use Gerrit has _absolutely, utterly despised_ it.

Until I got a job working as a kernel developer I had never had to use emailed patches. It simply isn't an "absolutely necessary" skill for a good developer these days.

The kernel community is too attached to email patch submission for it to ever move away, and to be fair, email does have the benefit of being scalable and matches our decentralised workflow much better than any of the current alternatives.

But it's still not _good_. There are plenty of ways to screw up email threading or forget conventions on labelling patchset versions or whatever (this happens _all the time_ ). You have to rely on external tools such as Patchwork to provide a bare minimum of state-tracking. There's not much by way of generic CI tooling that's designed with email in mind (I'm working on this!). Doing code review from an email client definitely has its benefits, but it's also limiting - web-based code review tools have much more scope for experimenting with better ways of presenting comments.

I can't see the Linux kernel ever moving away from email, and honestly it's not too bad once you've figured out your workflow, but I would like to see kernel _hackers_ thinking about what it is that the kernel community loves so much about email compared to GitHub and other centralised services. It _is_ disappointing to see other large open source projects becoming incredibly dependent on a for-profit proprietary software company that may well not survive the next few years. How can we do proper decentralised version control and development _better_?

<comment><USER9> I used gerrit and did not utterly despised it. Hi.

<comment><USER10> I have been using it for a few years, and I miss it when I am working on github projects :/

</comment></comment></comment></comment></comment><comment><USER11> More details on the decision:

[https://snarky.ca/the-history-behind-the-decision-to-move- py...](https://snarky.ca/the-history-behind-the-decision-to-move-python-to- github/)

<comment><USER12> this just adds to the mystery

</comment></comment><comment><USER13> Why on earth have they done:

> Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, > 2011, 2012, 2013, 2014, 2015, 2016, 2017

Rather than just

> Copyright (c) 2001-2017

<comment><USER14> This is why: "For software with several releases over multiple years, it's okay to use a range ("2008-2010") instead of listing individual years ("2008, 2009, 2010") if and only if every year in the range, inclusive, really is a "copyrightable" year that would be listed individually; and you make an explicit statement in your documentation about this usage."

Source: [https://www.gnu.org/licenses/gpl- howto.en.html](https://www.gnu.org/licenses/gpl-howto.en.html)

<comment><USER15> Every year from 2001 to 2017 inclusive is listed so this is not the reason.

<comment><USER14> Sure, in this particular file every year in the interval is listed, but in a large codebase that's not always the case. Always listing every year keeps things simple, consistent, avoids complications around extra statement and clauses, and makes auto-generating headers easier.

</comment></comment></comment></comment><comment><USER16> This is a little disappointing for several reasons. I understand the merits of GitHub but I really wish Python at least stuck with Mercurial repository and some decentralization.

It's especially sad because Mercurial is just now starting to be incredibly powerful with evolutions.

I guess I'm an old fart but all the centralization has made me paranoid and I still absolutely prefer Mercurial (albeit with plugins) over git.

<comment><USER17> Bah. Anybody can clone a git repo. It's trivial to move off of github with a git repo if they want, or possible to migrate to another database if they want to go through the disruption.

Going to git is about gaining developer mindshare. There are more people using git now. So being on git will bring in more "drive by pr's". I know for my part, life is too short to keep current on multiple source code control tools. I've done plenty in my time, but git is where I'm at now. I use git now at work, and until now, all of the hobby projects that interested me except for 1, were on git. Now all are on git.

At PyCon 2016 Guido told the story of how Mercurial was selected over git. It seemed like an even match at the time. Guido is very source-code-control-tool- agnostic. But git is the current best path to enabling more people to help with cpython development.

<comment><USER16> It is hardly trivial to move off. Bugs would have to be migrated, links updated, documentation, automated build systems, workflow as well as user remapping.

While not being Mercurial is one thing it is really more about being on GitHub that is the problem. Kings will get complacent (remember how long it took to GitHub to add some features).

I also vaguely remember the github guys trashing Mercurial with arguabley a propaganda campaign (something "git is better than X"). All that content is missing now but I do remember (I'll have to look on way back machine later).

</comment></comment></comment><comment><USER18> Wow if only we could get Gnome and Linux on there and give up this mailing list for patches nonsense we'd be golden.

</comment><comment><USER19> This is scary. For increasingly many potential contributors a project effectively does not exist if it is not on GitHub. And, being a huge centralized service, GitHub is very susceptible to censorship (e.g. repos being taken down via DMCA or Russia blocking GitHub until they started to cooperate with the censors). I see this dependence as very bad and dangerous for the free software movement. Should we even consider convenience of a service that has serious ethical issues?

<comment><USER20> Why is it scary? Is it that hard to move to bitbucket, gitlab, or another alternative git host if needed?

<comment><USER19> This is not about how hard or easy it is to move from GitHub. What scares me is that it is increasingly hard to participate in the open source/free software community without using GitHub, and it is increasingly hard to find contributors for your own project if you are not willing to host it there.

<comment><USER20> Why is it scary to use Github? Is there some hidden cost that people aren't aware of?

<comment><USER19> The programming community became globally dependent on a single commercial company. Using GitHub would mean contributing to that dependence and monopolization even more.

<comment><USER20> Is anyone really dependent when the cost to switch to a different provider is low? You haven't given a good reason.

<comment><USER19> It's not just about moving data from one provider to another. GitHub is not simply a hosting service, it's a large centralized social network, and the cost of switching from it includes reduced project visibility and disconnection from the community.

<comment><USER20> These may be issues for smaller projects, but I don't feel that either visibility or community is a problem for a project like Python. They have the luxury of going wherever they want and people will follow.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I'd really like more big and important projects would move their development to GitHub-styled services. Maybe I'm just not hardcore enough, but I feel they make live easier, both for maintainers, contributors and newcomers.

But it's probably too hard to switch and core developers don't see point in it (since they're totally ok with working their way). Maybe when a new generation developers will take core positions...

<comment><USER22> The idea of GitHub is great, and frightning at the same time. The development community as a whole would be crippled if GitHub went under. Same thing with StackOverflow.

I'm still dreaming of a decentralized GitHub based on something like ipfs.

<comment><USER21> Well, local running copy GitLab (or something other GitHub-styled) with a couple of backups is pretty safe and still gives all the advantages of GitHub.

Decentralized GitHub is a nice idea. We gotta implement this)

</comment></comment></comment><comment><USER23> Wow the black bar settled it for them, huh?

<comment><USER24> I know you're joking but just for the record: this process was started in late 2015, it's a surprisingly complicated endeavour to switch source control hosting.

</comment></comment><comment><USER25> Sad day. Don't forget that github is a closed source tool. This is equivalent to them announcing they are switching to Jira.

<comment><USER26> Both of those products allow for trivial data import/export. What exactly is the problem?

<comment><USER25> They are closed source. People that are really serious about open source software from top to bottom have issues with dependencies on closed source tooling because it promotes an ethos they don't support.

<comment><USER26> Ah.. I was hoping there was a substantial practical reason that I had overlooked.

<comment><USER25> Ah, the classic open source freerider. Only support it when convenient, ignore every other situation.

</comment></comment></comment></comment></comment><comment><USER27> [https://news.ycombinator.com/item?id=13614253](https://news.ycombinator.com/item?id=13614253)

</comment><comment><USER28> Background info about why this migration and considered alternatives

[https://snarky.ca/the-history-behind-the-decision-to-move- py...](https://snarky.ca/the-history-behind-the-decision-to-move-python-to- github/)

</comment><comment><USER29> So python eventually moved to git from mercurial.

<comment><USER30> I'm not sure that's correct.

[https://hg.python.org/cpython/](https://hg.python.org/cpython/)

<comment><USER31> It is, though

<comment><USER30> Well that sure settles things. I'm totally sure now.

Guido's last commit, in both the github repo and the mercurial repo.

[https://github.com/python/cpython/commit/934aba66ef09e94422b...](https://github.com/python/cpython/commit/934aba66ef09e94422bcac86dd221011242e141d)

[https://hg.python.org/cpython/rev/3db1959c2c53](https://hg.python.org/cpython/rev/3db1959c2c53)

Someone sensible may be able to shed some light on it. Presumably there's a bridge between the two somewhere.

<comment><USER32> Per PEP 512 ([https://www.python.org/dev/peps/pep-0512/](https://www.python.org/dev/peps/pep-0512/)):

 _This PEP outlines the steps required to migrate Python 's development process from Mercurial [3] as hosted at hg.python.org [1] to Git [4] on GitHub [2]_

[...]

 _The fate of hg.python.org

With the code repositories moving over to Git [4] , there is no technical need to keep hg.python.org [1] running. Having said that, some in the community would like to have it stay functioning as a Mercurial [3] mirror of the Git repositories. Others have said that they still want a mirror, but one using Git.

As maintaining hg.python.org is not necessary, it will be up to the PSF infrastructure committee to decide if they want to spend the time and resources to keep it running. They may also choose whether they want to host a Git mirror on PSF infrastructure._

</comment></comment></comment></comment></comment><comment><USER33> Python 3.7 already in the works. The effort to push python 3.x is picking up steam it seems.

<comment><USER34> Nothing surprising there. The version bump for 3.7 would have been committed immediately after branching off the 3.6 release branch.

</comment></comment><comment><USER35> I can't help but think Gitlab would have been in contention for this move had they not had the recent outage. Can anyone from the Python org comment on what other choices were considered?

<comment><USER32> All this has been decided for months and the discussion about has been going on for more than a year, so no, no recent outage could have been a factor. PEP 512 mentions why GitHub was choosen over GitLab.

[https://www.python.org/dev/peps/pep-0512/](https://www.python.org/dev/peps/pep-0512/)

<comment><USER36> tl;dr -- Devs are more familiar with Github, and Python's creator also prefers it (he modestly agreed to go with whatever the team decided and it appears they very much wanted to grant him the courtesy).

</comment></comment></comment><comment><USER37> Where is the "issues" section? I wanna read about some gnarly low-level CPython bugs!

Other than that, this is a welcome change.

<comment><USER38> [http://bugs.python.org/](http://bugs.python.org/)

</comment></comment><comment><USER39> FYI, Python was on Github but it was the read-only version. You still had to go to mercurial to push the updates.

</comment><comment><USER40> I wish PR's on github could be checked off per commit like in bitbucket.

</comment><comment><USER41> Anbody know what happend to Guido's contributions between 2008-2012?

Maybe he had kids. :P

</comment><comment><USER42> Still waiting for WordPress to move. ;)

</comment><comment><USER43> and nearly 100k commits... time to start making some PRs!

</comment><comment><USER44> I'd question why it wasn't GitLab but after the recent outage it would somewhat be in bad taste. :P

what exactly was Python using before/where was it hosted? all I can find are the source archives on python.org. I'm assuming this wasn't a hard transition but I'm genuinely curious as to their development strategy regarding distribution of source.

<comment><USER45> There are at least two comments in this thread that address this issue:

\- [https://news.ycombinator.com/item?id=13633369](https://news.ycombinator.com/item?id=13633369)

\- [https://news.ycombinator.com/item?id=13633271](https://news.ycombinator.com/item?id=13633271)

</comment></comment><comment><USER46> This is FUD. There are sensible responses to this comment, so I won't write a new one, but say one thing: You don't know how to use conventional tools, and and go on to blindly rant about them.

> Basically, e-mail is the death of any sort of low-effort contribution. If > you're starting a new project, and chose a mailing list, you're probably > excluding a huge quantity of potential contributors.

If those contributors are as incompetent to not be able to mail a patch, I'd rather be happy to have excluded them.

<comment> fake-name I think the core issue with your response is, unless the project in question _is_ the "conventional tools", why do you seem to think knowing those tools is even germane to the quality of someone's contributions?

I write python and some C++ stuff for fun in my free time. If your project interests me, but I have to spend said free time to learn esoteric tools to interact with it _that aren 't needed elsewhere in my life_, how do you figure that's valid?

It's not that I couldn't _learn_ to deal with that kind of shit, it's that I don't see why I should bother. If everything else works without e-mailed diffs, all that does is make anyone with more then one hobby project do is look elsewhere.

<comment><USER46> One way or another, one has to learn the conventional communication tools if they want to contribute to any open-source project, be it GitHub or GitLab, or a mailing list and debbugs. The maintainers get to decide and it's their way or the highway. The project is theirs.

Some skills only serve one purpose. Like shaving. I learnt how to shave when I was a teen, and that skill has only been useful to me in shaving my face, since ten years. And being able to use email and diffs is a transferable skill.

I won't respond to you anymore, as I dislike your language and your contributions are trollish.

</comment></comment></comment><comment> hexa- I was recently hit by an IPv4 routing outtage and had only IPv6 available to connect to the internet.

I was therefore unable to connect to github.com, as there is no IPv6 support available:

% host github.com github.com has address 126.96.36.199 github.com has address 126.96.36.199</comment>