SVG 2 new features - <AUTHOR> https://github.com/w3c/svgwg/wiki/SVG-2-new-features <comment><USER2> I like this.

It looks like this isn't some new, complicated iteration on SVG, but rather a big cleanup effort to make this more similar to existing HTML+CSS techniques, removing cruft from the "XML everywhere" era of the web. DTDs and xml:base are gone. The ability to specify geometric properties (like circle radius) is a big step up, so we can these properties using CSS the same way we would do it if it were a div in HTML. Improvements in text handling are a long time coming and will be appreciated.

Overall, I wouldn't be surprised if this makes implementation _easier_ than SVG 1.1 rather than harder, improving the proliferation of vector graphics on the web.

Of course, you can still limit your images to SVG tiny if you want to.

<comment><USER3> I think it's ridiculous that SVG has a complexity comparable with HTML.

With SVG you first have to parse the file into a DOM, because otherwise you can't really apply CSS (for which you of course also need a parser). On this way you avoid all the common XML pitfalls like xml entities blowing up your memory. If you want to show animated SVGs you need a javascript implementation, because half the browsers don't understand the animate- elements. Being able to include javascript probably is the reason why most image hosters don't host SVGs. Javascript in SVG opens doors to all kind of evil things like cross site scripting. So you walk down your SVG DOM and begin to parse path data strings. The syntax seems understandable after a short while so you think you can easily write a parser. But the parser you'll write will be wrong because the details of the syntax are totally arcane, whitespace can sometimes be dropped (e.g. A.5.5.5 10.5.5 is the same as A 0.5 0.5 0.5 1 0 0.5 0.5), commas are allowed at some places but only one at most. Every program supporting SVG got this wrong at least once, and some like Inkscape still have a buggy parser. So you look up how to render this path and you see that you just have to render the border, but there are gazillions of options how to render borders you all have to support. So the next element you want to render is a text element, which is a huge joke because it doesn't even support multi-line text, but silly things like text whose baseline follows a path [1]. Because internationalisation is important SVG files of course can show different things depending on the locale [2]. So afterwards you just have to apply filters, which are basically half a pixel based image manipulation program [3].

I really don't see how adding new features makes any of this easier, when SVG 2.0 is basically a backwards-compatible superset.

To proliferate vector graphics on the web we actually need a way simpler flat format. The only thing you actually really need is bezier paths and a way to fill them.

[1] [http://www.w3.org/TR/SVG11/text.html#TextOnAPath](http://www.w3.org/TR/SVG11/text.html#TextOnAPath) [2] [http://www.w3.org/TR/SVG11/struct.html#ConditionalProcessing](http://www.w3.org/TR/SVG11/struct.html#ConditionalProcessing) [3] [http://www.w3.org/TR/SVG11/filters.html](http://www.w3.org/TR/SVG11/filters.html)

<comment><USER4> The way I see it is SVG is a format for humans (that's why it got all those shapes and tricky formats) and its main use-case is browser (so CSS and JS support is not a problem, because it's already there). There should be another simpler vector format for machines, IMO.

<comment><USER5> What would be the purpose of such a simpler vector format?

Several formats already exist for various use cases: PDF for printing, SVG for web graphics (simple content and icons), OpenType fonts for vector based text and SVG as an exchange format between vector graphics apps.

The only use case I can think of is for standalone vector graphics images, but PDF or SVG is often good enough for that.

<comment><USER3> The thing is, almost nobody is using SVGs on the Web. Usually wikipedia is cited as a website that uses them, when in reality they're rendering them to raster images. They actually have a nice site with the problems they're facing: [https://commons.wikimedia.org/wiki/Help:SVG#Creating_SVG_ima...](https://commons.wikimedia.org/wiki/Help:SVG#Creating_SVG_images_for_Wikimedia_Commons) Other issues are that files might be bigger than pngs and have bad performance.

PNG and JPEG files are also universally usable outside of browsers. Linux systems often use SVGs for icons, but that's basically where the support stops. If I want to include a SVG in a latex I have to convert it to postscript or pdf. If I want to include a SVG into a Word document I have to convert it into an emf (enhanced metafile). You can't use SVGs for cocoa, UIkit, WinForms or MFC applications out of the box. The reason probably is the complexity to support SVGs.

<comment><USER6> "The thing is, almost nobody is using SVGs on the Web."

I disagree.

I regularly visit codrops and they show a lot of cases how you can use them. A lot of the frontend web development is using them a lot.

[http://www.ns.nl/](http://www.ns.nl/) the dutch train company, for example uses a mix of inline svg, background image svg and scr tags with svgs.

[https://www.spotify.com/nl/](https://www.spotify.com/nl/) uses SVG in the logo, the account icon and the arrows.

[https://www.digitalocean.com/](https://www.digitalocean.com/) svg is best practise for having vector images on your site.

The nice thing of SVG is the compatibility with css, for the web it is a nice tool to use.

<comment><USER3> Of course there are counterexamples but most websites aren't using SVG. Out of the Alexa top 20 only live.com is using svgs everywhere where they make sense and only yahoo.com is using them in some parts of the website.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Meta: I don't get HN's new dedup algorithm. I submitted the exact same link 5 days ago:

[https://news.ycombinator.com/item?id=12254324](https://news.ycombinator.com/item?id=12254324)

<comment><USER8> I _think_ I remember hearing that the dedup would allow resubmission of things that didn't originally get much traction/upvotes/comments, so that might be at play here?

<comment><USER9> Correct, and sometimes that happens automatically.

</comment></comment></comment><comment><USER10> Maybe it was wishful thinking on my part, but there was a time when I hoped that svg would be to vector graphics what png is raster images. With svg continuing to gain complexity, all that hope is gone.

At this rate, it'll become another html spec.

<comment><USER5> You're right. SVG2 requires full CSS support. CSS brings lots of complexity, like calc(), CSS variables and so on. All that is needed, because web developers use SVG2 inline in HTML documents. It is also becoming more common to embed HTML in SVG. It's going to be one big tag soup. All that is better for the web, but worse as a stable image format.

There are also plans to create SVG-in-OpenType fonts, which would embed SVG inside web fonts. I have very mixed feelings about that. It is nice to have fonts with multiple colors, gradients and animations. On the other hand, do I want to have the same compatibility problems with fonts as I already have with HTML/SVG? I'm almost hoping that SVG-in-OT fails and Microsoft's simpler multi-color font format wins.

<comment><USER11> It saddens me a bit, actually. SVG had lots of features way before CSS and now they're forced to adopt them to not confuse people who use HTML/CSS. CSS to my knowledge never even tried adopting features in an SVG-compatible way.

</comment></comment></comment><comment><USER12> I tried to use SVG on a recent project and did not have a good experience. The project was converting PDF building plans to SVG and then I had to do some transformation UI to align them to a map.

It worked, but the performance was terrible for non-trivial documents. Anything over 10 MB started to get unstable and provide for a bad UX in the browser. There's no way to get any kind of incremental rendering, you have very little control over the rendering process in the browser once you've handed it off to SVG (terrible API), and there are all kinds of security restrictions that make lots of hacks necessary if you're loading SVG from some place like S3 (due to same origin policy, but there are some additional hoops to jump through unique to SVG as well). Especially bad was the inconsistency across browsers and different implementations. When something goes wrong in the SVG engine internals, you get cryptic error messages (no stack traces or indication of where to even begin -- most of the time the location of the error referenced in the SVG document is wrong as well, or just at the root element). Opaque "out of memory" errors, or the browser tab just crashes. It very much felt like dealing with a black box.

For non-trivial use cases, it makes it very hard to debug. The goal of using SVG was to standardize to a neutral vector format that we could use anywhere, client or server, and leverage a lot of the tools that can deal with SVG or can convert to/from SVG without having to write our own drawing "engine".

In the end it wasn't worth all the hassle and we ended up implementing our own drawing using canvas primitives. Too bad.

<comment><USER13> We ported our Console off Silverlight to HTML and use SVG to render a workflow designer which dynamically overlays HTML overlays for most editing.

Our experience with SVG has been fantastic and we've found it very performant even on large workflows that are 20x screen area.

I should note that we are using React too with shouldComponentUpdate implemented to optimize DOM mutation.

Example at [https://flowgear.me/s/hZfxYnf](https://flowgear.me/s/hZfxYnf)

<comment><USER11> We have a graph editing and display component, which is primarily built on SVG (canvas rendering available, too). Performance is rarely a problem. Admittedly, we do remove elements that are not visible from the DOM, for very large graphs those have to be tweaked a bit (same goes for WPF). Generally usability suffers before performance does, and most techniques of improving usability also improve performance.

</comment></comment></comment><comment><USER14> I am worried about the href changes: _' href' as a replacement for 'xlink:href'_ and xlink:href is in the Deprecated list.

I have been implementing links within svg using xlink:href:

<text xmlns:xlink="[http://www.w3.org/1999/xlink"](http://www.w3.org/1999/xlink") xlink:href="google.com">text</text>

Would this break the apps using xlink:href?

<comment><USER15> Afaik you specify svg version in the image, so support probably depends on that. In other words, you should be safe as long as you use older version.

</comment></comment><comment><USER16> David Daley of Slippery Rock University is involved with SVG -- I know his work mostly through his Ello posting, but you'll also find a pretty significant CV here:

[http://srufaculty.sru.edu/david.dailey/](http://srufaculty.sru.edu/david.dailey/)

He tends to post various experiments which continuously blow my mind, though also mentioned he preferred the 1.2 spec to 2.0:

[https://ello.co/ddailey](https://ello.co/ddailey)

(The fact that Ello supports display of SVG images helps.)

</comment><comment><USER17> What's a reasonable timeframe one can expect to see browser support?

</comment><comment><USER18> I'd be happy with "ability to color arrow heads based on the arrow line color."

<comment><USER11> Like fill='context-stroke'? It's a fairly prominent example in the spec.

</comment></comment><comment><USER19> Finally SVG has an over-engineered, bloated, complex machinery capable of emulating a conical gradient (hi-fi metal knob effect.) We can now retire and give up this life of crime.

PS: CorelDRAW had it in 1992 and didn't need a CSS parser to do it.

</comment><comment><USER20> No more direct href links from SVG document? This is unwelcome change.

<comment><USER21> They're deprecating "a xlink:href" and adding "a href". Sounds good to me. I never had any idea why it had to be "a xlink:href" except that this was designed when someone thought XML namespaces were a good idea.

<comment><USER22> XML namespaces still are a good idea.

<comment><USER21> What problem do they solve? (Problems that were created by XML in the first place don't count.)

<comment><USER22> With XML namespaces independent development teams can freely design their own structures and interfaces and then mix them in a very granular manner without danger of name clash. This promotes design and reuse of specialized mini- language with exact precise semantic. xlink:href is better than plain href because plain href is an informal convention, while xlink:href is code reuse.

<comment><USER21> You're spinning an XML fantasy.

XML is not good at describing structures or interfaces. It does not have precise semantics. The semantics of XML are so vague that you can't even tell whether whitespace is significant when parsing it.

XML describes marked-up text. And yet it's awkward enough that it's not even used anymore for the most common case of marked-up text (HTML), which is why SVG is evolving to be more like HTML now.

<comment><USER22> The semantic of a computer language (and a markup language in particular) is what the code does with it. Sometimes the code uses whitespace and sometimes it doesn't; XML doesn't enforce either way and leaves this up to the app. When necessary you can explicitly mark your preference in different parts of the tree with the 'xml:space' attribute. This attribute has precise and unambiguous semantic. It is also another example of why namespaces are important: it's a universal attribute that can be used with any XML document, by the virtue of namespaces it will never conflict with anything, it has a clear and small area of responsibility so any software vendor can easily implement it, you don't need to invent your own conventions or whatever, just reuse it.

By comparison, HTML has almost no semantic. You have no idea what the code (which code, by the way?) is going to do with your 'article' tags or tell exactly how 'nav' is different from 'menu'; this spins endless debate about which tag to use. I remember how people argued that using 'dl' for figures with captions was, you know, "semantic markup" :) This is not semantic markup. Semantic markup would be things like <date:timestamp value="..." /> that a browser would _render in my timezone_ or <chess:position move="white">...</chess:position> to describe a position on a chessboard so that a search engine could find _similar positions_ or _chess parties where this position has occurred_. This is semantic markup and this could be semantic Web. And to make this happen we need to be able to develop small and clearly specified mini-languages with precise semantic (=computer instructions) and then mix them in a single document and this is what namespaces are for. This is the vision behind XML. It's very sad that few people grok it; most prefer to badmouth things they don't understand.

A proper markup language should either be low-level and describe, for example, physical layout and such, or should be extensible so I can describe the document in my own terms! I do not write a bunch of divs and h1s, I write, for example, docs for a function with <synopsis>, <parameters>, <examples>, maybe <notes> and so on. And then I mechanically convert it into a low-level language for rendering. HTML is neither: it's not low-level, it's very hard to control even the visual appearance, and it's not extensible either. It's bad in all aspects.

(Also, XML not only describes marked-up text, it's the only practical way to work with such text. All modern publishing uses XML.)

<comment><USER21> > All modern publishing uses XML.

Okay, just because you don't like HTML5 doesn't mean you get to deny that it _exists_.

<comment><USER22> Is that all you can say? It does exist, but it isn't much better than it was in v4. A few more canned tags; big deal. I wonder why the minor syntactic differences were so important though. Is it that hard to close a tag? And why no empty tags, they're certainly more concise? These are probably rhetorical questions. Sure HTML is superb; you still have to specify the time of your upcoming webinar as plain text so the users from other side of the world would have to look up what the WTF timezone is, but I'm sure there's a tiny half- megabyte JS library with a clever regex to fix this.

XML is the only sane format to deal with marked up texts written in natural languages, and this is precisely because it is extensible, so you can describe the structure in terms that make sense to the subject matter and still be able to process it with standard tools. It's also a perfect format for parsing results, because XML is essentially a frozen syntax tree. HTML is just a single fixed language; it's widespread and popular but not because it's technically superior (same as JS and CSS).

<comment><USER21> You really want me to say more?

You seem to have missed the point of my reply. You said "all modern publishing uses XML", and in doing so, you were overlooking the biggest counterexample to XML, and the biggest thing in modern publishing, which is HTML 5.

HTML is a huge, huge example of modern publishing. It _tried_ XML, when HTML 4 came along with XHTML. XML was basically designed around making XHTML work. And then HTML _stopped using XML_ in HTML5. It took a revolt of all the implementers of HTML, but people got behind it because everyone could tell that XML wasn't helping.

So now you've got a syntax that was designed for marked-up documents, that people don't really want to use for marking up documents, and it's also trying to convey data structures despite that this involves horrible patches like "xml:space" that no other format needs.

You were also hinting at APIs for communicating things like time zones and chess moves. Real APIs don't use marked-up natural language. I work in natural language processing, and to a first approximation, computers don't understand shit about natural language. When you need to communicate data, you use data structures.

If you want to communicate extensible data structures with hints about their semantics, you've got some choices, like protobufs and JSON-LD. Or you can keep patching XML and trying to make it convey data structures despite that data structures aren't made of marked-up strings, but then people won't use your API.

XML is also an unwieldy format for parse results. It's not a frozen syntax tree, it's a tree with tons of stuff bolted on to the side. The format that represents a syntax tree is S-expressions.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


IBM gives Slack developers access to its Watson Conversation API - <AUTHOR> http://venturebeat.com/2016/10/25/ibm-gives-slack-developers-access-to-its-watson-conversation-api/ <comment><USER3> This might be the fault of IBM's marketing, but it's completely unclear to me what the Watson API actually is.

From the documentation, it seems to be a suite of algorithms which do standard NLP tasks, such sentiment analysis, topic modeling, translation etc. That, with a sprinkling of some rather odd and dubious machine learning, like "personality insights".

Yet it is marketed as an expert-system of sorts, capable of mining large amounts of data and doing intelligent question answering, kinda like what we were promised with expert systems 15 years ago.

There's a big gap between what these two things are, and I've seen nothing which bridges this gap. Clearly they're doing something interesting - <USER2> Watson's Jeopardy AI is a pretty serious bit of work. But the APIs don't seem to expose anything remotely resembling the Watson which got all that publicity a few years ago.</comment>


Google is a strong contender in the cloud war, thanks to their roots - <AUTHOR> https://www.forbes.com/sites/forbestechcouncil/2018/05/09/google-is-winning-the-cloud-war/#64b40937c8bf <comment><USER2> It's always surprised me that Google took so much longer than Amazon to offer a cloud computing solution. I think one of the reasons is that Amazon's strategy is to sell the infrastructure it builds to offer its own products- whether that's AWS for its technical infrastructure, or its ecommerce platform.

While Google is certainly a strong contender, I wouldn't underestimate that importance of a strong high-level strategy. And Amazon knows this. Commodification of cloud resources is a risk to AWS and thus we see an increase of 'serverless' infrastructure from AWS that tries to differentiate from competitors.

</comment><comment><USER3> Anyone else think it's a bit bizarre that of all the stories in the "new" tab on HN, the only ones with any points upvoted are the two fawning over Google?

This is a pretty regular occurrence if you check the new tab.

<comment><USER4> I see three upvoted, only one of which had to do with Google, so, I think what you saw was just a momentary coincidences not some kind of fundamental reflection of HN attitudes.</comment></comment>


Angel investors put $20B a year into startups (infographic) - <AUTHOR> http://venturebeat.com/2013/08/02/angel-investors-put-20b-a-year-into-startups-infographic/

<comment><USER2> Very cool infographic... i couldn't find it, but does it say how much they profit on average from making these investments?</comment>


Cross-Platform Firechat: a possible explanation - <AUTHOR> http://blog.moritzhaarmann.de/blog/2014/06/25/firechat/

<comment><USER2> I've always wondered if something like this could make and join a mesh network, so communications could be over relatively longer distances.

<comment><AUTHOR> From what I recall, @derwildemomo (OP) has experimented with this, but the current smartphone stacks are a bit fragile for that kind of workload. I'm sure he can go a bit more into detail once it's not in the middle of the night in Germany :)

</comment></comment><comment><USER3> A question I have after reading this: does it work Android to Android with no iOS device around?

<comment><USER4> Hi, author here.

No. Not using Bluetooth LE, since there is no support for acting as a "server" device that can be discovered by other peers. It's sure to come someday, but right now it's only possible using a rooted phone.

It maybe possible that Firechat uses either Wifi Direct, which is supported on most modern Androids or classic Bluetooth, although the discovery/connection requires user interaction.

</comment></comment><comment><USER5> thanks derwildemomo, what you're saying makes sense.</comment>


Silicon Nanopores Pack More Punch Into Batteries - <AUTHOR> http://www.wired.com/autopia/2010/10/rice-university-silicon-nanopores-lithium-batteries/

<comment><USER2> As always in these sorts of articles the bad news is fairly well hidden:

 _The other advantage is that we've seen fairly long lifetimes. Our current batteries have 200-250 cycles, much longer than nanowire batteries_

But much shorter than normal lithium batteries.</comment>


These are the 10 most famous and successful forex traders in the world - <AUTHOR> http://masentrepreneur.com/en/these-are-the-10-most-famous-and-successful-forex-traders-in-the-world/ <comment><USER2> Forex trading can be stressful. But if you work with a reliable forex broker like mine [http://www.portexmarkets.com/](http://www.portexmarkets.com/) , then there is nothing to worry about. They have provided me with a demo account to start with, quality advice when I moved to a live account and update me on trading news every morning.</comment>


Cop who famously murdered unarmed man in hotel has been awarded $2,500/mo - <AUTHOR> https://reason.com/2019/07/11/this-cop-is-getting-2500-a-month-because-killing-an-unarmed-man-in-a-hotel-hallway-gave-him-ptsd/ <comment><USER2> Who the hell are these juries that are allowing cops to get away with murder?

As much as people like to complain about how corrupt the police are in how they cover up for each other, cases like this are decided by juries.

EDIT: If you haven't seen the video [0], you really should before commenting. This cop had no interest in actually apprehending Daniel Shaver. If he did, he would've done a more standard procedure like telling him to lay on his stomach with his hands either forward or on his back. There was no reason to tell him to walk forward on his knees, legs cross behind him, and arms up. You try doing that. Maintaining balance is a bit difficult. Now imagine trying to do that with the police pointing a gun at you.

This cop wanted to kill someone and create a story where he was the hero. For fuck's sake, the cop had "YOU'RE FUCKED" etched into the side of his gun!

[0] [https://www.youtube.com/watch?v=VBUUx0jUKxc](https://www.youtube.com/watch?v=VBUUx0jUKxc)

<comment><USER3> The jury is only shown a tiny portion of the video where the suspect reaches to pull up his pants and they shoot. They do not get to see the entire thing. The courts have incentives to protect their servants.

Also the one barking commands is not phillip

<comment><USER4> According to the article the jury didn't see any of the body cam video. The police should be mandated to release it if there are any court actions involved.

You're being disingenuous accusing courts of protecting the police. It's the police department itself that is doing that.

Every police department should be required to have a civilian review board with the final authority to render judgement on the behavior of officers.

The major crime here was the police department allowing the guy to be rehired temporarily just so he could apply for medical disability. That's an outrage.</comment></comment></comment>


Controlling an Inverted Pendulum with a Microchip Microcontroller  - <AUTHOR> http://dev.emcelettronica.com/controlling-inverted-pendulum-with-microchip-microcontroller# <comment><USER2> The startup sequence is really interesting...

</comment><comment><AUTHOR> Controlling an inverted pendulum using a Microchip microcontroller was possible at a University in Switzerland. The FLEX Base Board (hosting a Microchip dsPIC - see the Datasheet) and the FLEX Multibus Board with a CAN module were used for swinging-up and maintaining the inverted equilibrium. The Source code was entirely generated using Scilab/Scicos , an automatic code generator for control systems.</comment>


Ask HN: What is my app missing? - <AUTHOR>

I have set up a simple and cheap bug tracker and work management app, and am hoping for some feedback. It's similar to a stripped down JIRA - just the main features, without the plugins - and at a reasonable price, I think.
I've been running a low-key free beta for a while, and have had a few signups (I've not charged anyone yet, so no paying customers), but most don't seem to use the tool. They sign up, then are never seen again.
I'm not sure if it's just that this type of tool ends up generating a lot of people who are just taking a look, and very few usually carry on to use it, or if there's some serious problems with the app.
I'm not anything much in the way of "not seen you for a week" or "how are you finding it" emails - working on those next.
I've emailed most of the signups over the last week to try and get some feedback (and get a few of the older signups to have another look), and have had a few responses, most of which were positive. Suggestions were, I think, relatively minor things like image and line break support directly in the WYSIWYG.
The app is at http://www.envoyapp.com and there's a demo at http://demo.envoyapp.com
I've most recently added the API and FAQ.
I would have thought most of the lovely folk here are the kinds of people who would use this sort of thing, so perhaps the best possible people to point out the flaws!
[P.S. The server is a small, beta-size setup so if lots of HNers turn up at once the site may vanish. I'll be keeping an eye on it as best I can today.] <comment><USER3> Selling tools to tool builders is a tricky proposition.

Apps like these sell to enterprises (large and small). You are almost certainly talking to the wrong people (although I am sure potential users looked like the right people to start with).

Tell the world just what problem your app uniquely solves and see what happens.

N.B. You will need to convince enterprises (start-ups etc.) that you are there for the long term and that your infrastructure is secure, robust and 99.99% available.

Good luck.

<comment><USER4> Uhm you made an interesting point, would you mind expanding it? Where should he look for customers? He is on Hacker News now, don't you thin it's a nice place to find the people he need?

<comment><USER3> Yes - the point I was trying to make was the "pitch" needs to be to the enterprise while the functionality needs to meet the needs of the developers/support people who would actually use it.

I think that this is a tough thing to get right.

Feedback from HN users is going to be difficult to "filter" as we are mostly developers yet some of us are also (of necessity) business types. [Edit] When I said "talking to the wrong people" I was not referring directly to this post on HN.

</comment></comment></comment><comment><USER5> It's attractive and clean, which is refreshing compared to JIRA. I like your Office Space demo.

Maybe your problem is your market. Established development firms use JIRA or something else. They may be hooked on some of the big features that are part of the tool's complexity.

There are still businesses out there that have never heard of things like agile, or source control, and who manage projects by sending emails back and forth. Identify them and go after them. This may be all the tool they need.

My not totally practical advice? Get a job at a temp agency. You'll find your customers.

I'm speaking from experience. I have temped a few times in between jobs. Stapling and filing papers and all that. For small and medium sized companies that we tech people just don't think about - chinese graphite importers, freight forwarders, etc.

After a few days I'd start noticing things that I couldn't believe they were doing or using. "Why do they do it like that? Haven't they ever heard of process X, tool Y, technology Z?" Once in awhile I would even suggest something and help them out. It even landed me a bit of contract work on the side once.

I think there's a world of customers we're just blind to that aren't prejudiced to the existing tools, who might be persuaded into trying your software.

<comment><AUTHOR> > There are still businesses out there that have never heard of things like > agile, or source control, and who manage projects by sending emails back and > forth.

That's pretty much my target. There are tonnes of small agencies and small ecommerce outfits (especially in the UK) that aren't using anything to manage bugs or work. The problem, of course, is finding them.

Interesting idea, the temping thing. I suspect some simple freelancing might have a similar effect.

I'm rather hoping, though, that my blog and cheat sheets (at addedbytes.com) gives me the exposure to the kinds of people who might be interested in this type of product. It's clocking up 200,000 page views a month or so, and that's almost exclusively developers and ecommerce types. I'm hoping a series of blog posts on the topic of bug tracking will help a few lost souls out of the email and spreadsheet bug-management quagmire!

Thanks for the compliments. Glad you like the look - I was going for simple and clean.

</comment></comment><comment><USER6> How do you compare to fogbugz and its philosophy?

I mean to invoke some reflection about this.

We hold fogbugz up as the sweet spot of get-things-done bug-tracking.

(As a JIRA user at work, I can say that the JIRA and bugzilla report-centric mandatory-required-fields-and-flow-centric approach is a horror to use, unless you're the manager)

<http://www.joelonsoftware.com/articles/fog0000000029.html> and think about how you can interact with fogbugz using email, how its free-form without required fields or custom flow and so on.

<comment><AUTHOR> I think it's fairly similar, at least in philosophy. I always liked some parts of FogBugz - minimum number of required fields, always one owner and making it as easy as possible to get bugs in to the system from multiple places - <USER2> those all things I continue to think are important, and have tried to get in to Envoy. Ease of bug addition is critical, as without it you can't get management to use the system and it fails, so all accounts automatically have an email address they can use to send in bugs. I'm looking at ways to use the API to tie into other systems too to make the addition of bugs as easy as possible from other places.

</comment></comment><comment><AUTHOR> Clickable links:

<http://www.envoyapp.com>

<http://demo.envoyapp.com>

~~ Also, some wavy line background ... ~~

The app started, as I suspect many do, with me wanting a simple bug tracker, timesheet and wiki app for managing bugs, time, etc. I'd used FogBugz, JIRA and a few others (and their influence is probably obvious) and wanted something similar, but that I could tinker with.

So, I built the thing I wanted to use, and have been using it myself for a few years. Over time I've added things as I found I needed them. Some of those things have stayed, some have been dropped after finding they didn't work the way I thought they would.

I was using it at work, and others were finding it useful and asking if they could use it too, so I decided to see if it would be useful to other people, and grew it into what it is now.

</comment><comment><USER7> Monetizing an issue tracker will likely be Enterprise Sales. Are you sure you want to compete in an Enterprise Sales market against established players and hundreds of free options? From personal experience: It's not going to be fun and you will very likely fail.

<comment><AUTHOR> Thanks for the honest feedback. I know it's a hugely competitive space, and I'm hoping that the bootstrapping and low-cost approach means I can turn this into an income-level project, rather than perhaps a full-on company.

</comment></comment><comment><AUTHOR> I cross-posted this to reddit, cos I like it there too:

[http://www.reddit.com/r/webdev/comments/vmo71/envoy_a_simple...](http://www.reddit.com/r/webdev/comments/vmo71/envoy_a_simple_bug_tracker_how_can_i_improve_it/)</comment>


How a gamer forum flame war turned into a group effort to create a new game - <AUTHOR> http://blog.emoderation.com/2010/03/gaming-communities-in-nuthsell.html

<comment><USER2> Not the thread that started this whole thing, but here's the NeoGAF thread about the game's development. It has far more pictures and concept art than the official website. <http://www.neogaf.com/forum/showthread.php?t=381946> (Warning: typical forum immaturity... but that does seem to be the focus of this article.)

<comment><USER3> __New_Game_Menu__

How many to tango? (1) brolo (2) bromance

</comment></comment><comment><USER4> This happens fairly often on gaming-related forums. It usually works like this: <http://www.eegra.com/show/sub/do/browse/cat/comics/id/82> (NSFW)

However, sometimes these games get completed, and I really do hope for the best.

</comment><comment><USER5> Dudebro wiki: <http://dudebro.wikia.com/wiki/Main_Page>

The acronym for the game is amusing: Dudebro: MSIFUSIGTS/SY II: ISUDT

</comment><comment><USER6> And here's the original thread on Babz fashion:

<http://www.neogaf.com/forum/showthread.php?t=381646>

</comment><comment><USER7> Heh. They might even finish sooner than 3DRealms' Forever Nukem

<comment><USER8> Just in case you aren't being facetious 3DRealms have packed it in on Duke Nukem Forever. Thats what happen when you have moving goal posts and millions of dollars to spend.</comment></comment>


The Google project to put an aquarium full of water bears inside a phone - <AUTHOR> http://venturebeat.com/2017/02/24/complicated-weird-beautiful-the-secret-google-project-to-put-an-aquarium-full-of-tiny-wiggly-water-bears-inside-your-phone/ <comment><USER3> The main thrust of the comments so far are negative, but in my opinion this was a great idea.

Phones are personal devices. Plenty of time is spent on smoothly machined surfaces, wood cases, etc. A little biosphere is a beautiful idea, and likely cost a fraction of the overall project.

</comment><comment><USER4> This is like the rumor of 1970's platform shoes filled with water and fish floating inside.

But to be serious here are some of the other modules they planned on:

[http://www.modularphonesforum.com/news/yezz- another-28-modul...](http://www.modularphonesforum.com/news/yezz- another-28-module-concepts-project-ara-1887/)

And yeah some look pretty cool, a scale, iris detector, a better microphone and speaker, laser range finder, smoke detector (but could imagine perhaps other hazardous materials). Might think of other specialty application, but the problem is in any of those fields, there are probably higher quality tools already available not tied to an experimental expensive phone. They'd have to first make the phone as ubiquitous as an iPhone then start selling add-ons. Not make add-ons as as a major feature of the phone.

But tardigrades just seems like a way to get someone in management to notice and say "Wait wut, we are spending the money on this? Somebody, please defund this project".

</comment><comment><USER5> I saw that in a list of Ara modules. They had real trouble coming up with useful modules to justify the thing.

<comment><USER6> I can think of plenty of use for modules. The problem is that none of them are general purpose. There are tons of niche applications though. They should have made an industrial phone for $1000. Lots of people would have bought them for interesting use cases that Google never would have thought of.

The challenge is that a hackable industrial strength phone is not a ten billion dollar business, which is what Google wants.

<comment><USER7> there are so many things that google markets poorly, or to the wrong audience.

glass would have been amazing for industrial or many professional jobs, wave was a collaboration tool released to individuals, and now this where people want "an input device" for a niche application and would currently pay tens of thousands of dollars for such a thing.

it's really quite upsetting that all these fantastic technologies are wasted because of this push for "social" and mass market.

<comment><USER8> Looking from the outside in, it seems the problem is with management. I have never worked at Google, but I know many people who have. None of them have said positive things about their managers. Obviously this is anecdotal, but I see little reason to believe otherwise.

<comment><USER9> One big thing here is that Ara was part of ATAP which was acquired from Motorola (back when Google owned Motorola). So the culture of this project is an unusual one, even for Google. The heavy dependence on outside contractors probably made for a complicated setup, but I don't think that was the problem. From the outside, it feels like ATAP/Project Ara just ran the clock out. If they'd have gotten the phone done and ready to ship faster, maybe things would be different today.

</comment></comment></comment></comment></comment><comment><USER10> The line between microdosing and tripping balls is thinner than many people realize.

<comment><USER11> I suppose you meant to comment on [https://news.ycombinator.com/item?id=13731931](https://news.ycombinator.com/item?id=13731931)

<comment><USER10> No.

</comment></comment></comment><comment><USER12> These sealed aquatic systems are really cool. How do you go about finding out how much of everything you need to put in them for long term survival?

Can the biological processes of these simple organisms be modeled as checmical equations and all you need to do is balance them out and solve for the mols of everything you need to pour in?

<comment><USER13> > These sealed aquatic systems are really cool.

I find them more cruel, as you knowingly doom your pet world to die a few years later.

<comment><USER14> It could be worse: [https://www.thedodo.com/live-animal-keychains- china-12256846...](https://www.thedodo.com/live-animal-keychains- china-1225684627.html)

[https://www.thedodo.com/watch-holds-captive- ants-1057364913....](https://www.thedodo.com/watch-holds-captive- ants-1057364913.html)

<comment><USER15> The keychain thing reminds me of this: [https://medium.com/the- mission/a-visit-to-the-dead-tiger-war...](https://medium.com/the- mission/a-visit-to-the-dead-tiger-warehouse-b375ee66bcd5#.wbiovzgq1)

"…humans are monsters."

"Yeah…" she replies. "We really are."

</comment></comment></comment></comment><comment><USER16> We might have hit peak phone. As much as I try I don't get the reasoning on this one. How is it that these top techs could not find a better idea?

Forget the aquarium, how about a really strong microscope. Or a portable testing lab or a television or some kind of art project.

<comment><USER17> I'd say that aquarium counts as some kind of art project (art product?). Which seems like the thing you'd hire such an agency for, after you've run out of more sensible ideas.

</comment></comment><comment><USER18> Sad to see Ara die. I don't understand why they took three years to realise the path they were pursuing didn't work. Why couldn't they figure out earlier so they still had time to do something that works?

Google should have pursued a less ambitious and more practical version of the idea. Instead of making everything replaceable, maybe just identify one component that would be. Like the camera. Why do I have to buy a new phone if all I want is a new camera? Would a phone with only one or two replaceable components be feasible to build, and not impose too many tradeoffs?

The Ara team pursued the "everything should be replaceable" dream for too long, and failed. I wonder if a limited version would have been feasible.

It doesn't make sense that you should buy a new smartphone, priced at as much as ₹80K ($1000) even if all you want is one new component. Imagine if you had to buy a new laptop for more storage for your movies, and external hard discs didn't exist. Or a bigger screen, when you could use an external monitor. And so on.

<comment><USER19> The problem with that is that it's not just one or two components that are new iterations when you upgrade your phone - CPU, GPU, display (or, more likely, generation of protective tech on display, at this point), camera, maybe speakers, the antenna(e) could be workable barring something like a 4G->5G iteration if they covered enough to start with...and that's all ignoring the custom-shaped battery, which would get smaller to fit the modular slot.

Plus the one upgradable component that stops having feature-parity often long before the rest - software stack. The number of problems with getting random bugs out would get worse by the number of modular parts, and few Android vendors that I've seen keep phones updated for even 3 years, let alone 6.

It's been the case for a long time that you lose customization when you shrink the form factor, as you start squeezing every component down to its minimal essentials, and because it lets you start making tradeoffs you can only make if you know intimate details of the entire platform.

I would, quite fervently, like for a modular smartphone to work, and to not have to do the equivalent of paying hundreds of dollars every few years when my phone gives up the ghost or is EOL (or both). I just don't see the technology advancing that way until we get way better at miniaturization, such that fitting functionality into the phone form factor is no longer a strong pressure constraint.

<comment><USER18> Any component could theoretically cause someone to want to upgrade their phone, but in practice, some would be more frequent driving factors than others. Have you done market research to identify these?

If you were to make only those replaceable, you'd derive much of the benefit, but only incur some of the cost. A phone with only some modular parts would hopefully be not as thick as one with all parts modular. You'd have fewer random bugs, since there are fewer combinations.

Regarding software updates, that would be taken care of by a phone made by Google, like Nexus.

Concretely, how much thicker would the Pixel be if the camera were replaceable? 1mm? I'd take that tradeoff, particularly since the additional mm of thickness would result in better battery life.

<comment><USER19> I do work for Google, but not on anything phone-related, and have no more information about what goes into phone design decisions than most others randomly sampled on HN.

Consequently, no, I have no market data on what drives phone replacement, though my own limited circle of personal experience suggests either catastrophic failure or a threshold of the device performing unusably poorly as the most common reasons, more than wanting a shiny upgrade.

The phone would probably be more than 1mm thicker in order to accommodate a sturdy mount for the modular thing to slot into alone, let alone whatever additional wiring overhead might be involved for having enough bandwidth to speak arbitrary optical device protocols encapsulated in some standard - <USER2> then you might have a failure as version 1.x can only speak up to 2K resolution, 2.x 4K, and so on, so you might end up needing a phone upgrade _anyway_ to get that 4k camera.

Yes, paying upfront for a device like the Pixel buys you X years of device updates, but there are plenty of people who can't afford to buy a phone for the upfront price all at once, even if it might offer cost savings on modular upgrades later.

I might also take that tradeoff, but then, I prioritize durability in my phones over tiny size, since I have relatively large hands and a habit of breaking my phones.

</comment></comment></comment></comment><comment><USER20> Those poor tardigrades would be killed by all of the dangerous radiation coming from the phone.

Just kidding, they'd be killed by the dangerous _conduction_ from the phone. The little guys can't handle the rapid heat changes caused by the battery and CPU.

<comment><USER21> Really? I seem to recall these organisms being almost indestructible.

 _They can withstand temperature ranges from 1 K (−458 °F; −272 °C) (close to absolute zero) to about 420 K (300 °F; 150 °C)_

Battery and CPU heat output of a phone couldn't be more than 40 degrees C in variation, at a guess.

1\. [https://en.wikipedia.org/wiki/Tardigrade](https://en.wikipedia.org/wiki/Tardigrade)

<comment><USER22> No one ever reads the article.

> _It turns out the myths about tardigrades — how they're indestructible — are > true, under the right circumstances. "They go into cryptobiosis. They shed > up to 90 percent of their body water, turn into a little grain of rice, and > that is the thing that survives in space, and that's what survives in ice > cores for 300 years, and you add water and they revive. Cryptobiosis > requires very narrow environmental ranges in order to begin," said Feehan. > But a sudden change in temperature? Lab-bred tardigrades are no match for > that._

<comment><USER23> From the HN guidelines:

 _Please don 't insinuate that someone hasn't read an article._

<comment><USER24> How does that guideline apply if someone asks a question that is directly and clearly answered in the article? Is it OK to point out that the article covers that as long as one is polite about it? I'm not sure I understand if the rule is "you're allowed to correct people using information from the article as long as you don't tell them it was in the article" which is obviously silly - or "just don't be a dick about it" which seems covered by the general rule of "don't be a dick".

<comment><USER25> The guidelines include an example of how to do this:

"Did you even read the article? It mentions that" can be shortened to "The article mentions that."

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER24> Thanks. How ironic that my question about how to handle "not reading the article" comments could have been resolved if I'd read the article on how to handle mentioning reading the article.

I'm just off to dive into a singularity of self-reference. See you later.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> It would be cool if in the future a device can scan (real life scene, blood, piece of chalk) anything and tell you the composition and everything you ask. Think Pokedex and those fictional gadgets in sci-fi movies.

<comment><USER27> There is a company who is trying to do that with a spectrometer but they product is controversial:

[https://techcrunch.com/2016/09/16/scio-the-pocket-sized- mole...](https://techcrunch.com/2016/09/16/scio-the-pocket-sized-molecular- analyzer-is-making-everyone-angry/)

</comment></comment><comment><USER28> Would make an interesting random number generator (which are tough to find on some systems). Waterbears are rad hard as well :) Would be tough for Mallory to "reduce their entropy."

<comment><USER29> Actually true random number generators are cheap and to integrate into Silicon. The question is do you trust them? :-)

<comment><USER28> Can't trust them -- I've seen too much.

<comment><USER30> If you don't trust the hardware, adding tardigrades doesn't really help.

</comment></comment></comment></comment><comment><USER31> > One pitch outlined a module that transmits touch, like a high-tech version > of the heartbeat feature in the Apple Watch.

Seems unfair to group this with the far fetched ideas. I for one think this is a killer feature in a world that could use more opportunities for meaningful connections.

</comment><comment><USER32> Coming across the Lapka concept for Project Ara[0] made me realize that the problem was to market this as a "phone" in the first place.

Few people are willing to take the risk on a phone with an entirely new form factor, let alone an entirely novel premise, and no one would carry two phones around in their pocket.

It seems like they missed an opportunity to position this as a customizable mobile computing platform. Or perhaps they did and thought it was too niche.

[0] [https://medium.com/@my_lapka/lapka-x-project- ara-78fc5fe9f50...](https://medium.com/@my_lapka/lapka-x-project- ara-78fc5fe9f50a)

</comment><comment><USER33> Another crazy idea. Why not integrate a soldering iron?

Soldering irons that are powered via USB with 1500mA and 5V exist and are basically just a heating element plus a 555 timer chip.

[https://www.youtube.com/watch?v=o-8D5t6TJYU](https://www.youtube.com/watch?v=o-8D5t6TJYU)

</comment><comment><USER34> Seven engineers? Isn't that a million dollar a year project?

<comment><USER35> These are google engineers so wouldn't be surprised if the burdened annual cost per engineer is $300k so upwards of $2M+

</comment></comment><comment><USER36> Is this the innovation that's supposedly lacking at Apple under Tim Cook?

<comment><USER37> You mean innovation like the Touch Bar?

<comment><USER38> And "Dongle-Christmas"?

:P

</comment></comment></comment><comment><USER39> Sounds like they are doing great things with investors' money.

<comment><USER40> Yeah, but not just investors money. One of the sad things about Google is that it seems to soak up so many bright, highly paid minds - then puts them to work on relatively useless things.

It's inefficient allocation of humanity's intellectual resources.

<comment><USER41> I daydream sometimes that lightning strikes and both google and facebook suddenly go out of business.

So many of the world's best and brightest software engineers work at those companies. Suddenly out of work they'd be motivated to start those little business they've always wanted to have. I think we'd see an explosion of cool new ideas & businesses pop up in the tech community.

<comment><USER42> A bit like the ending of "God Emperor of Dune".

I have nothing but great things to say about the quality of the engineers at Google . . . but I do think our purposes are suboptimal.

</comment></comment></comment></comment><comment><USER43> "Hey, the Ara is going nowhere, but it would be a shame to not get any return from it... Lets see how many click bait blog articles we can generate from it!"

<comment><USER9> Ara's been gone since August. I sourced the story myself, not sure how it's click bait tbh! Did you read it?

<comment><USER43> To be clear, that line was something I imagined someone at Google saying prior to the developments mentioned in the article. But, "put an aquarium full of water bears in your phone"? That's a nonsense, fluff headline if I ever heard one. That they went so far as to _actually do it_ , I will admit, redeems it somewhat! But not so much that I'll believe that the project had any goal beyond generating press. :D

</comment></comment></comment><comment><USER44> Cruelty to animals. I eat meat but do not like seeing anything suffer for purposes of amusement. These are small, but mistreating even insects can be a crime in the US (specifically if you film it). Give them a digital version and leave the actual animals out of such displays.

<comment><USER9> The creators of this project told me they actually wondered if PETA would take offense. Ideally, though, the tardigrades would have had plenty of algae and room to swim around/reproduce.</comment></comment>


Feeling depressed after multiple failure, any examples of failure to cheer me up - <AUTHOR>

<comment><USER2> I just came across this yesterday - _" Stories of failure and redemption – 18 startup founders share their lowest moments before coming out on top"_:

[https://www.attendly.com/stories-of-failure-and- redemption-1...](https://www.attendly.com/stories-of-failure-and- redemption-18-startup-founders-share-their-lowest-moments-before-coming-out- on-top/)

</comment><comment><USER3> 6\. Predict Your Failures and You will Become a Highly Successful Prophet.

7\. The Pain of Unfulfilled Dreams can be worst ache you will ever experience.

10\. Ordinary People attain extraordinary success - you can too!

11\. Overnight success happens only in fairy tales, trashy novels, and bad movies.

13\. Always expect the unexpected because the only certainty is uncertainty.

18\. Self-pity costs nothing and it is worth just as much.

19\. You can be a victim or you can be successful - You can't be both, however.

53\. The most creative shortcut to success is to reevaluate what success means to you.

73\. You can't always get what you want, but you can get a lot more than you think you can.

 _Source: Ernie J. Zelinski, 101 Really Important Things You Already Know, But Keep Forgetting: How to Make Your Life More Enjoyable Day-by-Day, Year-by- Year[http://www.amazon.com/Really-Important-Things-Already- Forget...](http://www.amazon.com/Really-Important-Things-Already- Forgetting/dp/0969419481/*)

</comment><comment><USER4> I've felt this way too many times, until I realized that it's better to be relaxed, fail and correct your own mistakes, than never fail.

If you try to never fail, you're trying to never be wrong and that's impossible because of human nature. After trying to never be wrong (and failing) for a long time, the result is depression. And a very depressed person starts to fail at almost everything.

Ironically, trying to never fail leads to failing more frequently.

Some advice:

1\. Failing and correcting (iterate!) is better than never failing.

2\. Problems are targets for your skills, and they are not always your fault.

3\. Prioritize, always! Solving the most important problems first buys you time to solve the less important ones.

4\. Too much pressure is an enemy of success. When under pressure, the brain switches to life-or-death mode, so it mostly shuts down rational reasoning... the exact same brain functions you need for solving problems and be successful!

</comment><comment><USER5> I failed so many times that I lost the count (over 200+ times) with my experiments. But i gained so much info from them and I even started a company. Nothing big but I felt joy of one success over the burden of failures. What I learned is that I should create what I think it does amaze me and not really focus on the user side of things.

</comment><comment><USER6> I kind of view "failure" as just another folded hand in a game of Texas Hold'em. At some point, you might take down a pot to make up for past failures. You might not take down that pot and you might end up broke and penniless, but the outcomes don't really define whether or not you played the hand properly.

You always have to play your hand to the best of your abilities, even if you get dealt life's equivalent of 7-2 off-suit.

</comment><comment><USER7> The most damaging failures are those that lead to a loss of purpose and place you on the edge of the abyss. If you're there I would go see medical attention. Otherwise we have very few options. Give up, or charge on. With enough rounds at the table you are bound to get a good hand. But try to focus on the positives and donyour best not to dwell on the negatives. It's easy to get into a death spiral of depression and that helps no one.

</comment><comment><USER8> There is a very interesting story of a gold miner in San Francisco in eighteen-something who gave up on a gold mine a foot away from the ore.

When he found out, apparently his thoughts of "I might be a foot away from the ore" gave him huge amounts of grit and perseverance and he ended up getting quite rich doing chain stores.

</comment><comment><USER9> I try to learn from every failure and after some of the biggest fails of my life in '12 I came out a rather different but much better (for both my environment and myself) person. When you are in a dark place, everything looks like a failure even though it is not; once you notice that success is back.

</comment><comment><USER10> Started a side project at [http://www.fayl.io/](http://www.fayl.io/) to capture some stories of failure - but more importantly, the lessons learned.

Chin up, get back on the saddle - you're learning through your failures.

</comment><comment><USER11> Depression is a medical disorder, and if you're not just feeling down but you're actually depressed, please go to a doctor. I mean this in your best interests. Depression is a terrible thing and needs proper medical attention.

</comment><comment><USER12> Failure Before Success - [http://youtu.be/PJKz0JbEZcw](http://youtu.be/PJKz0JbEZcw)

I find this motivating, especially when I'm feeling down.

</comment><comment><USER13> I spent several weeks focusing on a single project, only to find out I was confused and wasted my time.

I'm not even sure how I managed to go so far without realizing it. It's never happened to me before. Brutal.

<comment><USER9> Weeks? That's early detection; that's success :) The longest example of that who I know of is a guy who hired me around 10 years ago; at that time his company was 15 years old and he had not made any money with it. I spoke to him 2 years ago, so his company 23 years or so old; he decided to close up shop as after 23 years he found that what he did was useless and a waste of time. 23 years. 23 years without earning any(! seriously) money and chasing a product no-one (in hindsight) will ever want. _That_ is brutal.</comment></comment>


Internet Census 2012: Port scanning /0 using insecure embedded devices - <AUTHOR> http://census2012.sourceforge.net/paper.html

<comment><USER2> This appears to be a white-hat effort using von Neumann replication and poorly secured telnet ports to build "a distributed port scanner to port scan the entire IPv4 Internet within one hour."

"We hope other researchers will find the data we have collected useful and that this publication will help raise some awareness that, while everybody is talking about high class exploits and cyberwar, four simple stupid default telnet passwords can give you access to hundreds of thousands of consumer as well as tens of thousands of industrial devices all over the world."

This is a well-written report, with great mapping and images, and the research is very likely reproducible. Pro-active ISPs and companies might do well to scan their own IP ranges, before some other entity does it for them.

Reading it reminds me of the way that diseases brought by explorers affected indigenous populations lacking antibodies.</comment>


The Case Against Education - <AUTHOR> https://jakeseliger.com/2018/03/12/the-case-against-education-bryan-caplan/ <comment><USER2> The system forcibly taxes the population, forces the children through a funnel, and then witnesses how all of that does not work particularly well.

The alternative would be to cancel Statist involvement and let the problem solve itself. We will undoubtedly see the worst emerge, as well as the best.

When the Statist economy will finally be bankrupt, the alternative is what is going to emerge anyway.

Therefore, I advocate helping the Statist national economy to go bankrupt. It will be the solution to a very long list of otherwise intractable problems.

</comment><comment><USER3> Has cynicism gone too far? In bureaucratic jobs maybe you can fake your way through, but in many other positions any charade eventually is exposed.</comment>


Cramer: Government was a bad actor allowing big retailers bigger in lockdowns - <AUTHOR> https://www.cnbc.com/2020/05/20/cramer-says-government-was-a-bad-actor-allowing-big-retailers-to-get-bigger-in-coronavirus-crisis.html <comment><USER2> '"If you were Walmart, the thing you would most want to do is have the government shut down your competition, and that happened," Cramer said on "Squawk Box."

'"Now those boutique stores have lost a base of customers and ... a base of workers who really were the people who might have known the customers. The big guys won," Cramer said.'</comment>


Open Source eBook: CI/CD with Docker and Kubernetes - <AUTHOR> https://github.com/semaphoreci/book-cicd-docker-kubernetes <comment><AUTHOR> Co-author here. Working on a CI/CD platform and seeing how real teams actually build their apps, I can tell you that the majority are still not using containers.

It ain't easy. It changes the entire build/test/deploy process. But it is the best way to build for the cloud.

So we wrote this book for developers who need to get things done. Hopefully it's a good mix of required fundamentals for a practical reader, and realistic examples.

I'd love to hear your feedback, and any particular questions or struggles you've had while transitioning to containers.</comment>


Indian court forces Facebook, Google to censor content - <AUTHOR> http://www.zdnet.com/blog/facebook/indian-court-forces-facebook-google-to-censor-content/8643?tag=mantle_skin;content <comment><USER2> How it is different from DMCA takedown requests? Under DMCA you request website to takedown content that violates copyright. Under Indian law, you takedown the content that is deemed religiously offensive or blasphemous.

Edit for downvotes: I'm against takedown requests. I'm extremely disappointed that Indian govt. is taking such a narrow view. I'm genuinely interested in knowing how these requests are different from DMCA takedown requests.

<comment><USER3> You are right. FTA: _Last year, India passed a law that makes companies responsible for user content posted on their websites, requiring them to take down anything deemed offensive ("ethnically objectionable," "blasphemous," or "grossly harmful.") within 36 hours in case of a complaint._

The only difference is that the exact definition of offensive content is not clear.

<comment><USER2> Interesting. Unfortunately, its even more harmful than DMCA. Resolving copyright violations is really easy. However, if I praise Richard Dawnkins in my blog and some religious retard finds that offensive then it should be taken down because it can be deemed as "blasphemous". Who will decide what is good and what is offensive? It will lead to extremely messy situation.

<comment><USER4> "Resolving copyright violations is really easy"

I think may be slightly off here. Some cases of copyright violation are quite blatent, but many others become tricky.

Music companies have been known to file DMCA complaints over content that their own PR-branches filed for publicity. Other times there is the question of derivative work and whether it is fair use, authorized, or in violation. For that matter, when talking about older works, something can be under copyright in one country but in the public domain in another, depending on their copyright term.

In contast, with the question of what is offensive, it matters greatly on who you ask. All but the most banal and obvious facts will likely offend someone.

<comment><USER2> I should have mentioned, compared to resolving whether content is religiously offensive or not copyright violations are easier to deal with. And with digital signatures it can be detected by algorithms too. But your point is valid too.

</comment></comment></comment></comment></comment><comment><USER5> We always complain about the Internet side of things, forgetting that in most cases these issues are caused by local laws, for whatever political, cultural, etc. reason, are lagging behind the currently accepted human rights (this is hard to define rigorously but I'm sure we would all agree on a common core). Many examples of this can be given: China (of, course), but also many Arab countries, as well as Turkey (who had blocked YouTube at one point and continues to block other sites). And evidently, now India.

It is interesting that the US is an outlier among these countries in that the motivations of censorship here is motivated more by big business profit than politics.

"Indian officials have seen illustrations showing Prime Minister Manmohan Singh and Congress president Sonia Gandhi in compromising positions, as well as pigs running through Islam's holy city of Mecca. The punishment for such offenses can be several years of jail time and financial penalties."

"Several years of jail time" for an offensive picture? There's something wrong about that.

<comment><USER2> US truly values the freedom of speech. In India there is freedom of speech too but it comes with certain conditions. People of key government positions, successful members of civil society etc. command certain respect. And you don't even call them by first name let alone vandalizing their pictures (unless they are cartoons in newspapers). Its still a traditional society. Flag burning is considered crime in India whereas in western countries it won't be problematic. You can also wear flag patterned clothes but in India you will be frowned upon by everyone including your friends and family.

<comment><USER6> What you're speaking of doesn't sound like a very useful form of "freedom of speech." It's the right to criticize key government officials and other powerful people which is MOST important, because they wield so much power -- it's much less important to be able to publicly criticize your crazy neighbor Bob.

<comment><USER2> You can criticize government officials. A form of protest can be anything from organized rally to famous Gandhian methodology of fasting. But society in general shuns anything that is below belt and dignity. Be it your neighbor or local political leader or your own uncle.

<comment><USER7> I don't understand how people still don't get this: you never have to protect the speech you _like._ No one needs freedom of speech to protect the speech everyone likes. As Noam Chomsky said,

 _If you believe in freedom of speech, you believe in freedom of speech for views you don't like. Stalin and Hitler, for example, were dictators in favor of freedom of speech for views they liked only. If you're in favor of freedom of speech, that means you're in favor of freedom of speech precisely for views you despise._

 _National Socialist Party of America v. Village of Skokie_ paints the picture clearly: almost no one liked the Nazis or wanted them in Skokie, but that's precisely why their speech needs to be protected.

</comment></comment></comment></comment></comment><comment><USER8> This is another step down the path toward a partitioned internet. Separate national networks, walled off to the point that they may not be functionally interoperable.

The U.S. and China really got the censorship ball rolling, and there are countless others just itching to cleanse the internet of content they find disagreeable.

<comment><USER9> As a Canadian resident, I get a sampling of a partitioned internet when I try to use sites like Hulu or Pandora. The effort to bring national borders to the Internet is well underway, and unfortunately it isn't limited to the usual slate of repressive governments. I don't wish to compare my "plight" with that of someone in China or Iran, of course. I recognize the difference.

</comment></comment><comment><USER10> Well ... The real motive for this is to some way cut out sites like wiki leaks from revealing the names of corrupt Indian politicians who have siphoned of tax payer's money to their Swiss banks accounts.

<comment><USER11> > Google India meanwhile has removed web pages deemed offensive to Indian > political... leaders

That's the most dangerous part.

</comment></comment><comment><USER12> What are possible consequences if those organizations ignore or defy these "requests"?

(By and by, what would happen if said organizations defied a EU decree?)

<comment><USER13> I kind of made this point a week ago, so sorry for repeating myself. If the 'requests' are ignored, India passes a law. If Google and Facebook ignore the law, then India follows the USA's lead and arrests any Google and Facebook executives it can get its hands on, just as the USA arrests and prosecutes executives of online gaming organizations that are entirely operated outside of its physical borders but have US customers.

<comment><USER14> So, in other words, Google stops operating in India.

<comment><USER15> Don't know why this was downvoted; it seems probable that Google would leave before the issue was escalated to the point of their executives being arrested.

<comment><USER16> or they would simply comply like they did in china for many years. Before you mention that the pulled out for the censorship, that was almost certainly nothing but a cover story, the real reason was Chinese government supported hacking, and constant redirects to Baidu.

</comment></comment></comment></comment></comment><comment><USER17> The internet is like the audible spectrum in air, it doesn't need "cleaning up" through censorship. It's not about porn or saving the children or objectionable content at all. It's about saying: "This internet, and all the bits that flow on it are my responsibility", if you want to use it, you'll have to do what I tell you do to. And if you don't do what I want you to do on it, I won't let you on it. These Dr-Evils would censor people's vocal chords if they could.

The next internet better be wireless, encrypted, exclude ISP's all together. Preferably where two individuals from two different countries can exchange without any other human getting in the middle and stop the data flow. We need to give the Internet itself an ability to "cut off" nations that want to own the entire thing. The problem is we programmers, engineers and innovators are too damn reasonable and accommodating. It's time for us to fight back and say no. No we are not allowing you to have censorship. Needs to be a new law that no standing member of congress may be re-elected if any part of the internet is censored.</comment>


The Chrome Exploit of Suffering - <AUTHOR> https://googleprojectzero.blogspot.com/2020/02/several-months-in-life-of-part2.html <comment><USER2> Not following the usage of "suffering" here at all. Maybe it's an autocomplete error?</comment>


Netflix – Chasing 60fps [video] - <AUTHOR> https://www.youtube.com/watch?v=g01dGsKbXOk <comment><USER2> I hate to spoil the celebration, but I've wanted a basic text interface to Netflix for years. Can I just get a list of movies and shows available? Click a link, see a page with a description, use the back button and I'm back exactly where I was?

The technical implementation really doesn't need to be this complex. Also, the interface itself has gotten worse and worse too. As a customer, just offering HTML links, a search box and then using HTML5 to stream the video would be great.

<comment><USER3> I was honestly shocked to find out that there are almost 8000 movies available right now on netflix streaming.

Their "custom tailored" selection screen gives the impression that they have 300 films available at most.

<comment><USER4> This is one of the reasons I'm a massive fan of JustWatch[0]. The other reason is that it searches across everything that's available on other services in Australia; most of these tools ignore us Down Under!

[0] [https://www.justwatch.com](https://www.justwatch.com)

<comment><USER5> That's really nice. It would be amazing if you could add IMDb ratings though, and the ability to sort/filter by them (e.g. only show me films with a rating >7).

You can download the IMDb rating database, although I think it has a very restrictive licence. Alternatively there is this: [http://www.omdbapi.com/](http://www.omdbapi.com/) \- but I wouldn't count on it being around forever. It seems like they would be on shaky legal grounds (but at least it would be them getting sued rather than you).

<comment><USER3> I should have included this in my original post but InstantWatcher sounds like what you're looking for.

That website is how I discovered netflix has thousands of movies in the first place.

</comment></comment></comment></comment></comment><comment><USER6> I know Javascript/HTML/CSS makes it very easy to develop something, however it is really sad to see people are struggling to get 60fps to show 20 boxes with images scrolling, where games can show thousands of polygons smoothly.

<comment><USER7> Game engines and browsers have radically different architectures and performance/productivity requirements. Computing polygons is basically applying one function to an array of values and is delegated to the GPU, so its no wonder they easily reach 60 FPS with hundred of thousands of polygons per frame.

A better comparison would be against the performance of game logic, which in a game engine can easily become the bottleneck from all the conditionals, random memory accesses and sequential dependencies. And even there they don't sit on nearly as many layers of abstractions as a web page does.

This comes at the cost of productivity; building a web site is a few orders of magnitude more productive than using the latest game engines. Of course, sitting on the DOM and its many quirks as well as its reflow/redraw cycles can make it harder to reach 60FPS in the browser.

But at least you're saving yourself from a world of low-level pain.

<comment><USER8> So essentially you are sacrificing your end result for an easier time for yourself, the developer.

<comment><USER9> You are sacrificing your end result every time you don't spend a lifetime designing a custom processor for your application with an instruction set specific to your use case and instead have an easier time living like a normal human being.

<comment><USER8> You can go to extremes, as your preposterous mine-the-silicon-and-smelt-the- chip approach, or you can go to the sort of extremes that makes opening a news article grind my high-end phone to a halt for 20 seconds.

<comment><USER9> That news source is then bloated and unoptimized. There are also a lot of bloated and slow native apps. I don't see your point.

</comment></comment></comment></comment></comment></comment><comment><USER10> Funny how much things change in a couple years.. about 4-5 years ago, I built a gallery view, that had scrolling areas, that worked the same as the video mentions (only loading the next block)... what's funny is the css transitions were working poorly on some devices at that time, so it was disabled completely. :-(

</comment><comment><USER11> I wish they would fix Netflix on the Nexus Player and PS3. I only have 2 set to boxes and both of them have broken Netflix on them.

The PS3 doesn't output audio properly to my receiver. I need to use stereo to get any sound at all.

The Nexus Player logs you out if your program ends and tries to play the next episode. This happens all the time when my 2 year old watches Curious George.

These aren't obscure platforms and it seems I'm not the only one with these problems. No known solution either.

\</comment><comment>----

edit

\</comment><comment>----

I forgot... also when watching 4:3 content on my Nexus player it uses some stupid gray background which is distracting. What is so wrong with black?

On the other hand, the Nexus player can run Kodi which you can install a plugin called "Genesis" on and stream anything you can imagine without any of those issues.

<comment><USER12> I wish they would fix Netflix on (desktop) Linux. Most content is limited to ~2Mbps 720x480 resolution (approx DVD quality), for no apparent technical reason. A Roku streaming box gets the same content on the same internet connection at ~6Mbit 1080P. This is easily verified with the Netflix secret menus (Ctrl-Alt-Shift-S and Ctrl-Alt-Shift-D) -- quality above 1750kbps 480P just generally isn't available to Linux web browsers, except on Netflix originals and a small handful of other stuff.

Sadly, another area where paranoid content owners have made legally available, paid for content inferior to illegal pirate copies.

<comment><USER13> This has more to do with licensing restrictions than with technology.

<comment><USER12> That was my point -- there is zero technical reason HD cant be delivered to desktop linux. Netflix shows do it, and so do a small number of other TV shows and movies. The vast majority of content, however, is limited to 480P. Presumably for licensing reasons only.

The most irritating thing is that "HD" now costs extra, and there is zero indication linux clients cant get the paid for HD content. I watch Netflix via Roku maybe 5% of the time, so mostly Im getting less than I pay for.

</comment></comment></comment></comment><comment><USER10> Anyone else chuckle a little about seeing a Netflix technology video on youtube?

<comment><USER14> Right tool for the right job.

<comment><USER10> Agreed, I just thought it was a little funny. :-) I get the same chuckle when I see a "Mercedes SLK Black" that's painted white.

<comment><USER15> I don't chuckle when I see that. I just enjoy the exhaust notes.

</comment></comment></comment></comment><comment><USER16> Hmm, I heard him mention that SLA is "software license agreement".. is that right?

I've always interpreted it as Service Level Agreement, which typically has a minimum response time, etc.

[https://en.wikipedia.org/wiki/Service- level_agreement](https://en.wikipedia.org/wiki/Service-level_agreement)

</comment><comment><USER17> This made me try reactjs. Too bad i had to watch bottom right corner to see smooth animations :(

<comment><USER18> React is insanely fun. It's so stress free to code up the frontend of your web app with React because everything is viewed as a component. My friend and I have adopted React and we are still glossing over how great it is.

</comment></comment><comment><USER19> It's a little ironic that all the demos are lagging like hell on a talk titled "Chasing 60fps".</comment>


My .NET C# open source project "Warden" – a library for monitoring resources - <AUTHOR> Hi all, I've started working on the first open source project and it's been over a month now since its inception. There's a wiki docs, code examples and the prelease version of the NuGet packages. What do you think about such idea? Any opinions will be very appreciated.<p>URL: https://github.com/spetz/warden <comment><USER2> Clickable: [https://github.com/spetz/warden](https://github.com/spetz/warden)

</comment><comment><USER3> Looks interesting.

Does the Windows service need to run as Local System? Seems like Network Service may be safer and equally functional.</comment>


A Very Sleepy MySQL Attack - <AUTHOR> https://blog.cotten.io/a-very-sleepy-mysql-attack-bff80975fda7 <comment><USER2> The real problem here is SQL injection... Not sleep

<comment><USER3> Agree, if you are vulnerable to this attack, you are probably vulnerable to a good old ' or '1'; drop databases :D

<comment><USER4> Yes, but an attacker is more likely to try SLEEP(10) than DROP DATABASES, because the attacker usually wants your data (and your server, but the data is a bonus). So if disabling sleep makes a few bots miss an actual vulnerability, it's a good step for defense in depth.

<comment><AUTHOR> Correct. It's more valuable, especially when trying to exfiltrate data or when trying to inject XSS opportunities.

Plus, realistically, SLEEP allows you to scan for thousands of different test cases in a quick period and measure the hang time to figure out which vector worked.

</comment></comment></comment></comment><comment><USER5> _why do vanilla MySQL packages come with SLEEP() even enabled? Why not make it an option?_

Because it's a good "canary" for SQL injection: it doesn't do any real damage, but it's noticeable enough to tell you that you have a possibly vulnerable condition.

<comment><USER6> > it doesn't do any real damage

I'm not sure about that. You can perform blind exfiltration of row data by using SLEEP. Handy in situations where you can run a query but can't get it reflected in the server's output.

<comment><AUTHOR> This is a valuable point: you can absolutely exfiltrate data this way based on timing, and it's fairly automated with tools at this point.

</comment></comment></comment><comment><USER7> SQL injection is pretty non-existent these days as frameworks and WAF evolves (assuming a company doing at least minimum of security practices). It doesn't seem there's a point in blocking such attacks at the DBMS side.

Given the function has a valid use and there are other ways to do damage to the database system, I don't see it's something that stands out. There are numerous ways for doing database probe or even RCE, thus this is no more than one of them.

<comment><USER8> > _assuming a company doing at least minimum of security practices_

This is not a sound assumption. SQL injection is still pretty common in practice. Even frameworks that try to sanitize input may have a "roll your own" approach that has flaws in it.

<comment><USER9> At some point I realized sanitizing your input for SQL is one of the dumbest ideas I've ever heard: you can trivially avoid the issue by parameterizing the variable inputs, and explicitly telling the DB that this chunk ain't SQL. Sanitizing is an absurd hack in any situation, in the fashion that parsing html with regex is; But especially with generating SQL, any notion of "sanitizing your input" should be considered a bug (perhaps a wetware one)[1]

Afaict the only reason this idea ever became widespread was because PHP's native MySQL driver lacked support for it for ages (I guess till PHP5? Been years since I looked into this)

[1] Obviously I'm not talking about validation eg validating a phone number; anytime you're trying to embed strings within a program but have to be worry that your string doesn't get read as part of the program, something has gone horribly wrong

<comment><USER10> There's a whole class of actions and values that you can't parameterize, like anything resembling DDL queries. I have worked on several products where these types of queries (like creating tables dynamically) have been an absolute requirement. Sanitizing input is still very much a necessity there.

<comment><USER9> I'm not sure I see anything in DDLs that denies parameterization of user input, except that support might be currently non-existent; but if the support is missing, it doesn't make sanitization a correct solution... it makes it a necessary hack to work around a lacking communication protocol

Ofc if the user is putting in full custom queries, parameterization doesn't help anything, but I'm not sure what you're even sanitizing at that point (semantics? Afaik sanitization refers to syntax cleanup; It'd be even dumber to avoid people dropping your important tables by parsing a SQL string, instead of making use of the much more reliable DB permission systems...)

It's absurd: A constant source of vulnerability in websites across the world is a _syntax error_.

It's the definition of accidental complexity -- A program with a valid semantic understanding of what it has is somehow totally incapable of passing on that wisdom except by code generation; and this is when it is free of the burden of any real constraints beyond correctness -- its certainly not a fast method of serializing/deserializing, it certainly doesn't minimize network- size, it certainly isn't a safe or composable API... it's just a dumb, horrible thing and we pretend its all ok because you just need to _sanitize your input_.

I wouldn't really care if sanitization was just considered a necessary hack, especially in certain corner-cases; but its not. It's thought of as _a good thing to do_. In fact, _a best practice_.

</comment></comment></comment></comment></comment><comment><USER11> Btw, PostgreSQL has pg_sleep()

[https://www.postgresql.org/docs/current/functions- datetime.h...](https://www.postgresql.org/docs/current/functions- datetime.html)

        SELECT pg_sleep(1.5);
        SELECT pg_sleep_for('5 minutes');
        SELECT pg_sleep_until('tomorrow 03:00');

Maybe useful for debugging? [https://www.endpoint.com/blog/2012/11/05/how-to- make-postgre...](https://www.endpoint.com/blog/2012/11/05/how-to-make- postgresql-query-slow)

<comment><USER12> The article seems to be saying that MySQL's sleep function pauses the entire database for the duration, whereas PostgreSQL's will just sleep that connection for the specified duration and other connections can keep working.

</comment></comment><comment><USER13> If you take away SLEEP, the attacker will exploit something else during their test. Better SLEEP than really badly customized DROP or DELETE statements to see if their last created resource is affected.

Why not monitor for SLEEP execution instead?

<comment><AUTHOR> These are valid points, but don't necessarily reflect the reality of a production web environment whose user ONLY has SELECT access to read caches and view data from the database.

Being able to enumerate vulnerable spots or exfiltrate data can arguably be more devastating than performing a DROP that's noticed immediately and the LKG table from backup is imported to fix it.

<comment><USER14> You can perform timing attacks without SLEEP by just writing slow queries. I usually use the BECHMARK command to run a few million MD5 calculations:

      AND 1 IN (SELECT BENCHMARK(SOME_MULTIPLIER*15000000,MD5(CHAR(97))))--

<comment><AUTHOR> One suggestion is to allow further segregation of permissions for functions like SLEEP, BENCHMARK, etc. A front-end request has no need for it.

It's the exposition of things that "act" on lax query permission sets that "appear" read-only (but in fact have interrupt style executions) that leads to trivialization of abuse.

<comment><USER15> Even better is to whitelist all SQL than runs on the database using prepared statements. Anything else is a hack.

</comment></comment></comment></comment></comment><comment><USER16> I don't get it. "This makes discovery very slightly easier (only in the most awful sql-injection code you can imagine)". Why should we care about that?

</comment><comment><USER17> If you are vulnerable to `sleep()` you are vulnerable to `drop table...` and `select * from users...` . Sleep is not the issue at all.

<comment><USER18> A lot of other commands require parameters that the attacker may not know the values for. Those require more knowledge about the system that first needs to be exfiltrated. Not every (hacked) query has its output directly plastered back in the UI, webpage or API response. So that would need more hacking, even if the "sleep" tells the hacker they're on to something. Disabling "sleep" would take away the canary, would it not? Maybe the hacker isn't even interested in dropping tables.

<comment><USER19> Disabling sleep would not take away the canary, it would make it more inconvenient - every instance of sleep can be replaced with some convoluted query that does a very slow calculation.

</comment></comment></comment><comment><USER20> Isn't there a way to make the database very slow by a complicated but generic query. Thinking about e.g. oracle's connect by + dual

If this is the case, removing sleep doesnt help you. Just run a slow query

<comment><USER21> Yeah, MySQL has recursive queries.

[https://dev.mysql.com/doc/refman/8.0/en/with.html#common- tab...](https://dev.mysql.com/doc/refman/8.0/en/with.html#common-table- expressions-recursive)

Though one can set a limit on query run time via max_execution_time.

</comment></comment><comment><USER22> that is why you put your database behind a firewall and not expose its port to the public internet. There is really no need except for a handful of really edge cases where you have to expose the port to the internet even then you can limit the access to specific hosts only.

<comment><USER21> That won't help you, because the author assumes an SQL injection is at play. Which is quite a stretch. Who is dumping direct POST/GET data straight into SQL without sanitation these days? Maybe some noobs, but then you have a bigger problem.

<comment><USER23> I still see it today, in code being written in 2018. One call say "noob", but... every year there's new people coming in to the field. "Noobs" is an evergreen problem.</comment></comment></comment>


20 year anniversary for WWW today - <AUTHOR> http://info.cern.ch/

<comment></comment>


Bill Joy Finds the Jesus Battery - <AUTHOR> https://www.wired.com/story/bill-joy-finds-the-jesus-battery <comment><AUTHOR> It'll be interesting if he can keep to the two to three year timeline for commercial availability for a battery that promises to be better and cheaper than existing lithium batteries.</comment>