Introducing .NET Standard - <AUTHOR> https://blogs.msdn.microsoft.com/dotnet/2016/09/26/introducing-net-standard/ <comment><USER2> I understand that Microsoft has to clean up a lot of legacy baggage around this ecosystem, and it does look like the way forward is much clearer and nicer, but man, was there any way this could've been done without _another_ ".NET <foo>"? I'm still figuring out .NET Core/4.5/Framework and all the ASP naming zaniness... and I'm a .NET developer! I do trust Microsoft that this is really, truly the last time this will have to be done, but god it's a headache.

<comment><USER3> I agree 100%.

So anyone care to take a stab at it? How does this differ from .Net Core?

<comment><USER4> .NET Core is a specific .NET platform while .NET Standard is a specification that many .NET platforms, including .NET Core, implement.

In other words, .NET Standard is POSIX for .NET.

<comment><USER5> Small correction: .NET Core _will_ implement it. It has to grow quite a bit to get there.

At least, that's my reading, but they manage to be fairly confusing by mixing present tense and future tense with two different names:

 _" \- .NET Standard is a set of APIs that all .NET platforms have to implement. This unifies the .NET platforms and prevents future fragmentation.

\- .NET Standard 2.0 will be implemented by .NET Framework, .NET Core, and Xamarin. For .NET Core, this will add many of the existing APIs that have been requested.

\- .NET Standard 2.0 includes a compatibility shim for .NET Framework binaries, significantly increasing the set of libraries that you can reference from your .NET Standard libraries.

\- .NET Standard will replace Portable Class Libraries (PCLs) as the tooling story for building multi-platform .NET libraries."_

So, do we have _".NET Standard"_ now and _".NET Standard 2.0"_ in the future? If so, why don't they say ".NET Standard 2.0 _will include_ a compatibility shim for .NET Framework binaries"?

On the other hand [https://github.com/dotnet/standard/blob/master/netstandard/p...](https://github.com/dotnet/standard/blob/master/netstandard/pkg/NETStandard.pkgproj) seems to indicate the two are synonyms, and version 2.0 is the first version of this framework.

<comment><USER6> > So, do we have ".NET Standard" now and ".NET Standard 2.0" in the future?

There are three key versions (and several others; they have 1.0 through 1.6 and 2.0) of .NET Standard referenced; the key versions are 1.5 (supported by .NET Framework 4.6.2 and later and .NET Core 1.0 and later), 1.6 (supported by .NET Framework vNext and later and .NET Core 1.0 and later), and 2.0 (supported by .NET Framework 4.6.1 and later and .NET Core vNext and later).

<comment><USER5> So, in a blog post titled "Introducing .NET Standard", it turns out .NET Standard already has 8 different versions?

Also, rereading the article, I notice _" When we shipped .NET Core 1.0, we also introduced .NET Standard."_

This text really could do with a good editor.

<comment><USER6> > it turns out .NET Standard already has 8 different versions?

I think the versions prior to v1.6 were retrospectively defined based on the common capabilities of pre-existing platforms; v1.6 was what .NET Core 1.0 supported and .NET Framework vNext will support (2.0 is what .NET Framework 4.6.1 supports and what .NET Core vNext -- and vNext of MS's other platforms -- will support, and beyond 2.0 there will be more synchronous development across different platforms.)

<comment><USER4> That's exactly what happened, yes.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> In the last 10 years I wouldn't have bet on C# to be the language to be the most excited about, and yet here we are. Kudos for dealing with fragmentation

<comment><USER8> I started using Xamarin to develop an Android app, expecting the Xamarin platform to be some gross in-between which only exists to squeeze just a few more developers onto C#.

But, no joke, it's a BETTER experience than Android Studio. I had a much better time using Xamarin Studio (on OS X) and Visual Studio with Xamarin (on Windows) than I ever did with Android Studio. And not just because of the tools: C# provides so many great features that make Android development awesome on it. And the API is essentially the same as the true Android Java API; I found myself googling "start an activity on Android" rather than "Xamarin start an activity on Android" because it's all done the same way.

I normally don't obsess about my code looking clean and beautiful, but when I wrote my simple app in C# it shorter and easier to read than when I did it in the Android Studio.

<comment><USER9> I still don't understand how Microsoft was able to provide a better debugging and tooling experience for Android, than Google itself for their own OS, although Android Studio 2.2 finally seems to be usable.

<comment><USER10> > I still don't understand how Microsoft was able to provide a better > debugging and tooling experience for Android, than Google itself for their > own OS, although Android Studio 2.2 finally seems to be usable.

Visual Studio was first released in 1997, the company has 20 years experience in designing and building tooling. I believe they also have a very firm dogfooding policy, and some very intelligent people work there.

Google changed the search engine landscape and created the only competitor to the iPhone, but building tools and tooling is definitely not a key strength.

<comment><USER9> Surely a few of those PhDs able to draw inverted tree algorithms on the whiteboard should be capable of producing a proper IDE that doesn't hang the computer all the time, an OS simulator and get their mind around how to have an actual working build system for NDK users.

</comment></comment></comment></comment></comment><comment><USER11> I can't really make heads or tails of this, it's still fairly complicated and I'm just not invested enough in it to read everything with a fine toothed comb.

What I want to know is, will the sync (not async/await) methods be available on Linux on .NET Core? We've been struggling with that, the move to async/await is a major rewrite of our legacy application codebase and for what we do Mono has been a constant thorn in our side.

In an ideal world the old sync APIs would just work and we'd be able to move forward with .NET Core as it stabilizes and get off Mono without a major rewrite.

<comment><USER12> > What I want to know is, will the sync (not async/await) methods be available > on Linux on .NET Core?

Yes, they most likely will be. If you search through the reference assembly interfaces listed here, you should be able to tell whether the functionality you want will be available.

[https://github.com/dotnet/standard/tree/master/netstandard/r...](https://github.com/dotnet/standard/tree/master/netstandard/ref)

For things like legacy synchronous or Begin/End async methods, we are more or less adding them wholesale to the standard. If something like that is still missing, then it's most likely an accidental omission rather than a conscious removal.

(I work on .NET at Microsoft).

<comment><USER11> I don't see anything for WebRequest in the referenced repository, but thanks for responding. I'm more hopeful than I've been since we found out .NET Core was async/await only.

Migrating to async/await is very close to a complete rewrite for our codebase. We're not interested in it because it's such a big undertaking, and if we're forced to we might as well consider options other than .NET. My preference would of course be to leave things that work as-is and get on with the more important aspects of running our business.

<comment><USER13> I have been grafting asynchronous support into my codebase by a) writing new code with it and b) using AsyncContext [1] to run asynchronous stuff synchronously.

The performance:lines of code ratio you can get with async is quite high. Using ADO.NET you can run mutually exclusive queries in parallel for up-to a 2x speedup (depending on what the queries need to do):

        using (var connection1 = ...)
        using (var connection2 = ...)
        {
            var getSomething1Task = GetSomething1Async(connection1, ..., cancellationToken);
            var getSomething2Task = GetSomething2Async(connection2, ..., cancellationToken);

            await Task.WhenAll(getSomething1Task, getSomething2Task);

            // now aggregate results from 1 and 2
        }

And it's more or less the same lines of code you'd need for the synchronous version.

[1] [http://stackoverflow.com/a/9343733/242520](http://stackoverflow.com/a/9343733/242520)

<comment><USER14> Yes, multithreading is stupidly easy nowadays. I also use Parallel.ForEach and sometimes .AsParallel() - changing "header" of foreach/for cycle is easy peasy and performance gains are instant. :)

</comment></comment></comment></comment></comment><comment><USER15> As a library author having to target multiple platforms .NET Standard + project.json is much less painful to support than PCL's - looking forward to when we can drop PCL's and just ship .NET Standard builds.

<comment><USER16> Sounds to me like project.json going bye bye

"After looking at our choices, it was apparent that it would be easier to move .NET Core projects to .csproj/MSBuild so all .NET projects use the same tooling and build system."

<comment><USER15> yeah they're getting rid of project.json but they're merging the multi targetting benefits of project.json back into .csproj

</comment></comment></comment><comment><USER17> I lead a .NET development team, and I have no plans start using Core any time soon. That's based on my experience testing it out -- just too different, too based on a myriad of nuget packages (which is too much like NPM for me).

This confirms my decision. I'm sure it will be nice once it's all sorted out. The money quote for me is below:

 _Since our goal was to represent any .NET platform we had to break it up into smaller NuGet packages. This works reasonably well if all these components can be deployed with the application because you can update them independently. However, when you target an abstract specification, such as PCLs or the .NET Standard, this story doesn't work so well because there is a very specific combination of versions that will allow you to run on the right set of platforms. In order to avoid that issue, we've defined .NET Standard as a single NuGet package._

<comment><USER7> Here's the other side of the coin, as someone who's worked primarily with npm (JS), composer (PHP), had a taste of cargo (rust) and of course yum, apt-get, etc.: packages are awesome. npm is weird and hellish because people write single-function packages, but that isn't the case in other ecosystems. NuGet provides an easy and familiar way for me to get into it, as opposed to having to absorb the entire ecosystem at once.

I agree though, that the challenge is different in a compiled language (from JS/PHP), and when dependencies get specific you might be out of luck (when .NET Core was announced I had a hard time following Microsoft's own tutorial because minor revision was different between two key packages)

<comment><USER18> Nuget does get a little fun when you are dealing with a solution with multiple library projects that feed into a final executable. So far, I've either had to upgrade all versions of a Nuget package across projects, or spend a lot of time messing around with app/web.config assembly redirects.

At least the granularity of Nuget packages is not at npm-level fineness, although it does sort of feel like it is trending in that direction.

<comment><USER19> Try paket, will save you a lot of headaches with the redirect stuff

</comment></comment></comment></comment><comment><USER20> I am not a .NET developer. But, Core / Framework / Standard nomenclature is very confusing. Windows and Universal Windows Platform (UWP) also adds further confusion.

They should explicitly define namespaces :

1\. XAMARIN namespace as cross platform APIs for .NET ecosystem - iOS, macOS, Android, Linux, may be Web ?

2\. UWP/CASCADE ? namespace for Windows 10 systems.

3\. WINDOWS namespace for backward compatible .NET Framework systems.

<comment><USER4> I can see that being a problem. Let me try to explain:

* We've concrete .NET platforms, such as .NET Framework, .NET Core, and Xamarin. They are the moral equivalent of Linux distributions. * With .NET Standard we now have shared specification that dictates which APIs all these platforms have to implement. That's the moral equivalent of POSIX.

<comment><USER21> And where does fit UWP into this picture? Or what should I use if I want to develop apps for Window Store (or whatever the current name is for that).

<comment><USER22> UWP is a native framework based on COM. Windows 10 apps use .NET Core (compatible with .NET Standard 1.4) and can access UWP APIs through bindings

</comment></comment></comment></comment><comment><USER23> This type of standardization is what I like to call Lowest Common Denominatorism. And it's a leaky solution to a hard problem. The underlying problem isn't that different platforms have different APIs, it is that different platforms have different capabilities. Even if you unify the APIs that are semantically equivalent across platforms, there will always be some superset of that unified standard that you end up having to use because you are programming for a platform. At best, the unification makes programming for a different platform slightly easier and a little more tenable to share some code across platforms. But your code is still littered with `#if`s everywhere, and that wreaks havoc on your compiler's (and subsequently your IDE's) usefulness for catching bad bugs due to platform incompatibilities.

I believe the future of cross platform programming is by integrating Tomas Petricek's idea of Co-Effects[0] into type systems. While an effect system tracks what your program _does to the world_ in its type system, a co-effect system tracks what your code _requires from the world_ , aka the executable's environment and platform. There are a lot of benefits to this, but the primary benefit of a co-effect system is that you could safely write cross-platform cross-compiled code within a single compilation unit project by having different `main`s that specify and encodify different platform capabilities. If your `getSDCardFileSystem` function only works on Android because iOS doesn't have SD card capabilities, then it can't be used in a main function bound by the iOS context. And if different platforms have similar but slightly different capabilities, an interface can be defined that shares their commonalities and is usable across the differing platform executables, while still making platform-specific code accessible within it's platform specific executable.

There are other benefits too, but I'll leave that to the reader of [0] if they want to know more.

[0] [http://tomasp.net/blog/2014/why-coeffects- matter/](http://tomasp.net/blog/2014/why-coeffects-matter/)

</comment><comment><USER24> This gist by @davidfowl might make the relationship between the .NET Standard and .NET platforms more clear; [https://gist.github.com/davidfowl/8939f305567e1755412d6dc0b8...](https://gist.github.com/davidfowl/8939f305567e1755412d6dc0b8baf1b7)

</comment><comment><USER25> So next year .NET Standard 2.0? Excuse me for being cynical but Microsoft's track record in regards to versioning isn't great.

<comment><USER14> And the next year it's .NET Standard One. After that - .NET Standard 10.

</comment></comment><comment><USER26> Hopefully that should help clean up the messy .NET naming. Currently there's way to many .NET <something> "packages". Microsoft seems to have run amok in splitting up .NET in minor components, and it has become to difficult to figure out how everything fits together. Unifying three big block in one common standard library is a great first move in cleaning up everything.

Now we just need to kill off one of the ASP.NETs.

</comment><comment><USER27> I'm still lost. What should I use and when "to go live"? We are small company with a lot of legacy code that wants to upgrade from 2.0 and 3.5. In 2016. Which .NET should we use ?

<comment><USER28> Legacy code would probably stick on the .NET Framework (with maybe Mono as an option to try for some cross-platform reach) for now.

New code is great in .NET Core when you have that option.

If you are building NuGet libraries (which seems doubtful given 2.0 and 3.5, but possible) you should try to target .NETStandard rather than .NET Framework or the previous best option PCL. But if you can't target .NETStandard for some reason, things will get better (soon).

</comment></comment><comment><USER29> @runesoerensen: any plans to offer linux /.net core instances in AppHarbor (my favourite way to host .net apps by far!)?

<comment><AUTHOR> Thanks for the kind words! You can actually run .NET Core apps already, but the tooling/CI story is still lagging (primarily because the .NET Core SDK is still in preview and needs to be updated to the revised .NET Core project/solution structure).

It's pretty straightforward to publish and deploy binaries from your own machine until the SDK graduates from preview and betas ("RTM" is expected later this year) -- take a look at this discussion for more details: [https://support.appharbor.com/discussions/problems/79972-asp...](https://support.appharbor.com/discussions/problems/79972-aspnet-5-support#comment_40545805)

There are no current plans to offer Linux-based instances, but Windows Server 2016 will be available soon and brings some _very_ exciting and long-awaited features to the table, that will be integrated in AppHarbor products as soon as possible. Stay tuned for more information on that :)

</comment></comment><comment><USER30> I don't understand this bit:

"In order to allow .NET Framework 4.6.1 to support .NET Standard 2.0, we had to remove all the APIs from .NET Standard that were introduced in .NET Standard 1.5 and 1.6."

Does this mean that STD 2.0 will support .NET 4.6.1 but not 4.6.2 ?

<comment><USER4> It means that .NET Framework 4.6.1 and all later versions will support .NET Standard 2.0. However, .NET Standard 1.5 & 1.6 will not work on .NET Framework 4.6.1. In other words, we removed the APIs from .NET Standard 2.0 that weren't implemented by .NET Framework 4.6.1.

<comment><USER31> And some people say this is confusing!

</comment></comment></comment><comment><USER32> Something about their own diagram bugs me: it's clear that Xamarin covers a wide variety of targets all by itself so (on the surface) it already seems to have an architecture that handles new APIs well. Shouldn't the logical course be to extend Xamarin and encourage developers to migrate to that?

Given Xamarin code that works on Macs, iOS and Android, _no one_ would call Microsoft's layer of peanut butter the API to "rule them all" except Microsoft.

</comment><comment><USER33> They left out what I think is the most important info - when will it ship? They listed a lot of libraries that aren't yet in .Net Core, but they say that those will be added to .Net Core to bring it into compliance with .Net Standard.

</comment><comment><USER34> It sounds like a good track to be on.

<comment><USER21> Which of those tracks do you mean?

</comment></comment><comment><USER35> Quite a useful reference article.

</comment><comment><USER36> Nothing about Linux, probably because there is no Linux Consumer Market. Looks like Microsoft's EEE strategy is alive and well.

This is nothing more than a clever ploy by Microsoft to regain control of C# from the community, becoming the gatekeeper of the new ".NET Standard" library... rather than opening up some of their coveted, proprietary codebase. (Winforms)

TL;DR Micro$oft being Micro$oft

<comment><USER37> > rather than open up some of their coveted, proprietary codebase. (Winforms)

What makes you think that open sourcing WinForms would be any good? It's probably tied to Windows to the gills.

If anything, they should be doing something else, they should create or even better, support an existing UI toolkit and promote that as their cross platform UI.

<comment><USER4> While we haven't open sourced WinForms, there is a Mono version of Windows Forms. We've talked with the Mono guys about it and the general consensus was that the WinForms API shape doesn't make it very easy for cross-platform.

<comment><USER37> Is there any plan, even a low priority one, for picking up maintenance for something like Gtk# or Xwt or Eto.Forms? Or for extending UWP or Xamarin.Forms to Linux?</comment></comment></comment></comment>


Blood transfusion startup Ambrosia is now up and running - <AUTHOR> https://www.businessinsider.com/young-blood-transfusions-open-accepting-paypal-payments-cities-ambrosia-2019-1 <comment><USER2> "A startup company, Ambrosia, has been selling "young blood transfusions" for $8,000 since 2017 under the guise of running a clinical trial ... The clinical trial has no control arm and so is neither randomized nor blind. The company was started by Jesse Karmazin, a medical school graduate without a license to practice medicine. David Wright is the licensed doctor overseeing the clinical trial; in his practice he administers intravenous treatments of vitamins and antibiotics for nontraditional purposes and was disciplined by the California Medical Board for the latter in 2015. Jonathan Kimmelman, a bioethicist from McGill University, suggests that Ambrosia is running this trial as they would be unable to get FDA approval to sell this treatment otherwise." [1]

[1] [https://en.wikipedia.org/wiki/Young_blood_transfusion#Ambros...](https://en.wikipedia.org/wiki/Young_blood_transfusion#Ambrosia)

</comment><comment><USER3> I don't know if Parabiosis will eventually prove to have any use in fighting any sort of disease ever, but what I can tell from this article is that I wouldn't trust that company as far as I can throw it.

Just the thought that someone running a medical company thinks he can gather evidence worth talking about by just observing old people who got blood transfusions tells you all you need to know. He's willing to completely fabricate claims about the benefits of this treatment.

We now how much of a nightmare Theranos was -and that was a relatively passive procedure they were selling. What happens when this scrappy start up skimps on the screening tests for their donors and end up with venereal diseases in their blood supply? The old 'fake it till you make it' doesn't fly here.

<comment><USER4> You think that was an impressive red flag? Then check this out: dismissing objections about effectiveness and safety from the researcher whose experiment is held up on their landing page as a proof of the treatment benefits!

[https://nordic.businessinsider.com/researchers-say- ambrosia-...](https://nordic.businessinsider.com/researchers-say-ambrosia- young-blood-transfusion-startup-putting-lives-at-risk-2018-9?r=US&IR=T)

</comment></comment><comment><USER5> Enjoy your to-be-discovered deadly viruses you got from such a transfusion. (I'm not joking, there might be undetected viruses that promote development of cancer and other diseases.)

<comment> barry-cotter The history of blood transfusion is very much this story. I sincerely doubt there are any deadly viruses likely to be spread by transfusion that we don't know about already, for large values of deadly.

<comment><USER6> The hemophilia community was devastated by HIV and hepatitis C. Anyone considering transfusion therapy should be very cautious.

</comment></comment></comment><comment><USER7> The medical part of my brain cringed on the idea to transfuse blood to healthy recipients.

Blood is a tremendously tricky substance. I guess they have the necessary precautions in place. But still...

<comment><USER8> _I guess they have the necessary precautions in place_

Given the history of some SV startups and their move-fast-break-things and fake-it-'til-you-make-it philosophy and looking back at some of the more unsavoury examples I believe you're highly optimistic here.

<comment><USER7> There is a difference between faking some standard lab tests and infecting people with deadly viruses or giving them fatal immune reactions.

<comment><USER9> Do you think that difference represents a line a highly motivated sociopath would be unwilling to cross?

<comment><USER7> Even the highly motivated sociopath will probably understand that dead customers are really bad for business.

<comment><USER8> Theranos management didn't much give a shit about potentially dead customers based on test results, which they knew were fraudulent.

So I still think this is a bit optimistic.

<comment><USER7> Still, I don't think that this compares. Bad test results rarely ever cause death, especially when the really time critical tests are done in clinics. And it's really hard to prove a test is wrong, or even maliciously wrong.

So I do believe that someone with questionable ethics is much more likely to assume he can get away with mostly-fake lab tests than with killing patients outright with something obvious like a bad reaction to a blood transfusion. Even infections with a blood-borne Virus would probably be discovered within a year or two, because blood transfusions are sort of the first culprits you have in mind.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> To any British person they will assume Ambrosia are doing blood transfusions with custard

<comment><USER11> Given what happened in the 70s and 80s when the blood products were imported from the US to the UK [1] and this recently being in the news again because inquiries into it are again underway, I think many Brits may also shudder at the thought of blood transfusions being handled in such a blase way.

[https://en.wikipedia.org/wiki/Contaminated_blood_scandal_in_...](https://en.wikipedia.org/wiki/Contaminated_blood_scandal_in_the_United_Kingdom)

</comment></comment><comment><USER12> This is of course ridiculous, stupid, and immoral, but I don't think it's unprecedented.

I know that the _Vampire Facial_ [0] has been a popular supposed beauty treatment for at least a couple of years.

When I become king, all of this would be outlawed along with homeopathy.

[0]: [https://en.m.wikipedia.org/wiki/Platelet- rich_fibrin_matrix](https://en.m.wikipedia.org/wiki/Platelet- rich_fibrin_matrix)

<comment><USER13> If you remove the ability for people to spend money on worthless things, they will only have money to spend on useful things, and thus drive up inflation.

<comment><USER14> Wait, what? So waste is good for economy now?

<comment><USER15> Not good, but better for society than rich people siting in a pile of cash forever? It is like vegetables. They are not good, but they are better than eating more carbs.

<comment> barry-cotter Cash is paper. No one cares about paper. Numbers in a bank account are numbers in a database somewhere. No one particularly cares about numbers in databases. What we care about is either investment or consumption, the use of resources. If rich people are _not_ consuming their wealth then they are not using their resources. That means they're available for everyone else to use because there's only so much productive capacity in the economy and most of the time it's almost all being used.

Investment is good for creating future wealth. Not using money rounds to investment, not at a personal level, but at a macroeconomic one.

</comment></comment></comment></comment></comment><comment><USER16> Next SV startup: all the benefits of young blood transfusion, but requiring only a single drop of blood.

</comment><comment><USER17> Where are they getting the plasma from? Doesn't it basically cost about $75 for the donor plus the cost of collecting the plasma? Based on the ads that I have seen.

</comment><comment><USER18> Can you say the next Theranos?

<comment><USER19> No, they have an actual product. It's just pseudo-science. It's a different sort of fraud that would attract a different type of buy-in

</comment></comment><comment><USER4> So, what exactly is the theory here? They are transfusing plasma, which, as far as I understand, is blood without all the various cells in it. So basically water with some elements and whatever proteins are too small to separate in the centrifuge.

So either the specific mixture of stuff in "young blood" is better, or they mean the specific molecules are healthier because of their origin. The latter is homeopathy style chemistry, and the former seems mostly like a contrived way of taking hormonal supplements.

<comment><USER20> I think the premise is the mouse studies made on the subject, for example:

"Young Blood Rejuvenates the Aging Brain"

> Previous studies have demonstrated that instilling young blood into an old > rodent can rejuvenate peripheral tissues, such as liver and muscle, and can > stimulate the birth of new nerve cells in the brain. The authors show that > this method can also counteract age-related declines in learning and memory > by activating specific signaling pathways in the hippocampus, a region of > the brain involved in learning

[..]

> These experiments raise the fascinating possibility that transfusion of > blood or specific bloodborne factors from young humans might rejuvenate the > aged human brain.

[http://stm.sciencemag.org/content/6/238/238ec95](http://stm.sciencemag.org/content/6/238/238ec95)

<comment><USER21> In these studies they connected the circulatory systems of the two mice together for prolonged periods of time.

</comment></comment></comment><comment><USER22> From Gavin Belson we know that you can never ever trust your blood boy.

<comment><USER23> Seriously, it's not the first time that the real Silicon Valley turns out to be even stranger than the show. I guess the writers have it easy.

<comment><USER22> Right ;)</comment></comment></comment>


A graph showing shell startup scripts exuction order for zsh/bash/sh - <AUTHOR> https://i.stack.imgur.com/6zqse.png <comment><AUTHOR> The blog where this image was first published in 2013:

[https://blog.flowblok.id.au/2013-02/shell-startup- scripts.ht...](https://blog.flowblok.id.au/2013-02/shell-startup-scripts.html)

Note that there is recent edit to the blog post saying "it depends on your OS packaging".

The SO question where an answer refers to this image and has some relevant discussion: [https://unix.stackexchange.com/questions/493173/changing- his...](https://unix.stackexchange.com/questions/493173/changing-histsize-in- ubuntu-16-0-4lts/493201)</comment>


Looking for a co-founder for planergize.com - <AUTHOR> http://dshingarev.posterous.com/looking-for-a-co-founder-for-planergizecom

<comment><USER2> I think your site has great potential if it gets an API!

<comment><AUTHOR> It has a RESTful API. It's just not published anywhere yet :-)</comment></comment>


The New Tribalism and the Crisis of Democracy - <AUTHOR> https://www.foreignaffairs.com/articles/americas/2018-08-14/against-identity-politics <comment><AUTHOR> Apologies in advance for editing the title, but it's a substantive article but the original title is flamebait.</comment>


Yahoo to confirm a historic hack affecting 200M users - <AUTHOR> http://www.recode.net/2016/9/22/13012836/yahoo-is-expected-to-confirm-massive-data-breach-impacting-hundreds-of-millions-of-users <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=12559006](https://news.ycombinator.com/item?id=12559006).

</comment><comment><USER3> URL changed from [http://uk.businessinsider.com/yahoo-to- confirm-2012-hack-200...](http://uk.businessinsider.com/yahoo-to- confirm-2012-hack-200-million-users-report-peace-2016-9), which linked to this

</comment><comment><USER4> The article says the data includes "easily decrypted passwords". How is that even possible for a company with the engineering staff and history of Yahoo? Deliberate negligence?

<comment><USER4> Updating: the official Yahoo press release says "hashed passwords (the vast majority with bcrypt)", so perhaps the Recode article was not entirely correct.

</comment></comment><comment><USER5> I thought the speculation at the time that this was Tumblr rather than the main Yahoo accounts. I guess we will see.</comment>


15% of web certs are for ECC keys and 12% are 4k RSA - <AUTHOR> https://keychest.net/stories/https-certificates-keys-and-issuers <comment><USER2> The 0.8% of ECC 384bits is interesting, I thought 256 bit ECC was the only one with any real client support.</comment>


Show HN: Quaint Server – Serve webpages from the browser - <AUTHOR> https://github.com/onaclov2000/quaintServer

<comment><AUTHOR> I made a demo video (and updated the sw) now its pretty easy to do multiple end points!!

[http://t.co/UzdVt7uiWR](http://t.co/UzdVt7uiWR) (youtube vid of it in action)</comment>


Ask HN: How I could start my Startup from Iran - <AUTHOR>

I'm from iran and I have a new idea for web startup,
but I'm from IRAN.
Google have a problem with iranian, PayPal have a problem with iranian, I could not have a Bussiness Bank Account.<p>What I could run my startup with minimum problem? <comment><USER2> Roll out your MVP. If its something people want, trust me, you will surely find a way to solve your banking problem. Don't worry about your cash register before opening your shop.

<comment><AUTHOR> Thanks platokant :)

<comment><USER2> All the best ! Leave your dream :)</comment></comment></comment>


Is Tor Safe? Think Again. - <AUTHOR> http://cryptogon.com/?p=624 <comment><USER2> Some good points here. A couple thoughts:

\- If, for some reason that I can't really conceive of, you wanted to connect to a far-away access point, you'd need a highly directional antenna (due to RF physics). Doing this actually makes direction finding extremely challenging, for the same reason you can't see a laser from the side (unless it's super high power and has something to reflect off of, which is unlikely to be the case in the wifi scenario).

\- End-to-end encryption plus an anonymization mechanism like Tor seems to me to be pretty impervious to attackers, assuming the implementation of your encryption and anonymization are both correct (which, admittedly, is a big if, but is not a /fundamental/ issue; you could envision a system engineered to be correct). If you have a secure, trust-worthy, out-of-band mechanism for exchanging keys with whoever you want to talk to, even if someone owns the infrastructure you're using they won't be able to decrypt your communication, or know who the source and destination are if you're using an anonymization mechanism. This also assumes you trust the person you're communicating with, etc.

I'd love for someone to correct my understanding of this if I'm wrong.

<comment><USER3> I'm no security expert, but I don't think you even need an out-of-band key exchange mechanism. Just use public key cryptography [1], as used in SSH/TLS/PGP/GPG.

[1] <http://en.wikipedia.org/wiki/Public-key_cryptography>

<comment><USER4> I was about to write this response, but I see that it is more clearly written in the wikipedia article already:

 _Another potential security vulnerability in using asymmetric keys is the possibility of a man-in-the-middle attack, in which communication of public keys is intercepted by a third party and modified to provide different public keys instead. Encrypted messages and responses must also be intercepted, decrypted and re-encrypted by the attacker using the correct public keys for different communication segments in all instances to avoid suspicion. This attack may seem to be difficult to implement in practice, but it's not impossible when using insecure media (e.g. public networks such as the Internet or wireless communications). A malicious staff member at Alice or Bob's ISP might find it quite easy to carry out. In the earlier postal analogy, Alice would have to have a way to make sure that the lock on the returned packet really belongs to Bob before she removes her lock and sends the packet back. Otherwise the lock could have been put on the packet by a corrupt postal worker pretending to be Bob to Alice._

The workaround is to either exchange the public keys out of band, or distribute a certificate which can be used to verify public keys out of band.

</comment></comment></comment><comment><USER5> Security can succeed by making an attack economically or logistically impractical. You have to consider when using any such system:

1\. What would it cost the adversary to pull off a successful attack to reveal your identity? Would it be worth it to the attacker to do so?

2\. Are there easier, more obvious targets?

I would say it's a possible useful tool of increasing that cost for a potential adversary above their threshold of resources and motivation.

If I'm wrong, tell me where I posted this from, and I'll go hide in the woods.

<comment><USER6> Naturally depends on who you're trying to hide from.

This article seems to have been written from the point of view of "the CIA are watching me", not "I don't want someone to hack my facebook profile".

And based on that logic, you have to assume that the CIA (or whatever agency) won't chose who to spy on based on who will cost them the least money.

<comment><USER7> The CIA won't choose to spend $1billion+ to spy on a single person unless they are _really_ important.

<comment><USER8> Most of the things he mentions are very cheap to pull off, though. Proxy honeypots, sniffing ISP internet connections, querying IPs, email surveillance -- the infrastructure is already in place they just have to type some commands. Cost: $0.

On the other hand, actions that require actually sending men in suits and vans filled surveillance equipment can be costly. If they're doing that, you know you're in big trouble.

<comment><USER9> _Most of the things he mentions are very cheap to pull off, though. Proxy honeypots, sniffing ISP internet connections, querying IPs, email surveillance -- the infrastructure is already in place they just have to type some commands. Cost: $0._

I'm sorry but I have to jump in here - you're writing off an awful lost of resources under the banner of "they just have to type some commands."

<comment><USER8> I'm sorry you had to take that literal, I was just figuratively speaking.

My point is that it is the human part of surveillance that is costly. For everything that can be collected automatically with systems already in place (even though placing those systems could have been very expensive), the threshold to use it is very low. When the information is collected and processed, what rests is only database queries. "automatic surveillance" is (comparatively) cheap.

In contrast, "expensive surveillance" is placing monitoring equipment in a house, parking some fan sneakily around the block to listen in, and such. It's labour and resource intensive.

</comment></comment></comment></comment></comment></comment><comment><USER10> I'll try to be careful with my words here (to avoid ambiguity more than anything else), but there are different programmes in different countries that provide different degrees of interception.

In the UK we have the Regulation of Investigatory Powers Act 2000, which amongst other things forces service providers to keep logs of Internet activity for the police. These logs are typically of the order of IP address and connection type, not the actual data itself. This applies to pretty much all Internet access coming out of the UK somewhere along the line.

Beyond the police there are means of intercepting specific Internet traffic. It's easier for me to talk about US interception capabilities at that level though (as it's more publicised). The FBI, NSA, CIA and (if IIRC but they might be colluding with another agency) the DHS all have their own independent capabilities for broad sweeps and targeted surveillance. These capabilities are exercised according to remit. The agencies have information sharing agreements with each other, and the relevant agencies have international sharing agreements with their counterparts e.g. UKUSA intelligence sharing agreements etc.

If you want anonymity, you have to understand what you're trying to protect yourself from and (if possible) your adversary's capabilities. Having worked in countries with significant local interception capabilities that I do want to protect against, usually a properly configured VPN or SSH tunnel to a safe country is about as good as you're going to get without getting into government crypto (and if you're using government crypto in a hostile environment like that you're probably breaching some rule somewhere anyway).

As to the question of whether or not Tor is safe, I assumed it was public knowledge that various countries' intelligence services ran monitored exit nodes for quite a while. I've seen malicious Tor exit nodes in investigations and have known people who've set them up for the express purpose of monitoring them.

</comment><comment><USER11> When four people sit down to talk conspiracy, three are government agents, and the fourth is a fool.

</comment><comment><USER12> Between the terrible grammar, grade school sentence structure, needless paranoia, senseless rambling and overall [citation needed]-ness of the article, I'm afraid I didn't really get the point. I thought it was going to explain why Tor is unsafe, yet it just made some broad speculative points and finished with a final jab in Tor's direction with no strength or conviction behind it.

</comment><comment><USER13> From 2006/2007.

<comment><USER14> Given the direction in which governments seem to be moving, it's probably more relevant now than it was then.

<comment><USER15> Too paranoid to upvote and comment from my normal account...

</comment></comment></comment><comment><USER16> Not that the post actually brought up the Tor concept, but... I hate it when people diss the Tor concept by making the assumption that all uses of Tor requires an exit point. It doesn't. See torchat as an example. <https://code.google.com/p/torchat/>

</comment><comment><USER17> So what about for hidden tor services?

<comment><USER13> I think one of the points of the rant is that you have no way to know whether Tor is safe or not; if Tor is compromised then you might as well assume that it's _completely_ compromised, including hidden services.</comment></comment>


500px to shut down API access - <AUTHOR> (Text below from email update)
Hi there,
In January, we removed public access to our API. 500px has always fostered creativity with technology, but due to shifting business priorities, we've now decided to shut down the API completely. This decision is part of a larger strategic shift—focusing our energy on continuing to build the world's best photography community at 500px.com, as well as strengthening our asset protection and improving our site's performance.
As of June 15, we'll be shutting down all access to the API, which means you will no longer be able to use it to pull images or data.
Questions? Feel free to email email@example.com.
Thanks,
The 500px Team <comment><USER2> Boo</comment>


Coding with Paint (FIXED) - <AUTHOR>

i noticed this topic (http://i.imgur.com/QlGpd.gif) shared here, so i made a code to generate Bitmaps using text :D
import java.io.File; import java.io.FileOutputStream; import java.io.IOException; import java.util.Arrays;
/
 *
 * @author MErsan
 / public class BitmapToText {

    static final int BITMAP_SMALLEST_SIZE = 56;//Calculated using 1*1 pixels image

    public static void main(String[] args) throws IOException {
        String text = "hello every one\n my name is Mosh Ersan";

        text = text.toUpperCase();
        byte[] textData = text.getBytes();
        int dataLen = textData.length;
        int pixels = dataLen / 3;
        pixels += (dataLen % 3);

        int bitmapWidth = (int) Math.sqrt(pixels);
        int bitmapHeight = bitmapWidth;

        int dataSize = (bitmapHeight * bitmapWidth);

        byte[] initialData = new byte[54];
        Arrays.fill(initialData, (byte) 0);

        byte[] endData = new byte[2];
        Arrays.fill(endData, (byte) 0);

        initialData[0] = (byte) 66;//Deafult Values
        initialData[1] = (byte) 77;//Deafult Values
        initialData[2] = (byte) (BITMAP_SMALLEST_SIZE + dataSize); //File Size in Bytes
        initialData[10] = (byte) 54;//Points to Pixels Array
        initialData[14] = (byte) 40;// I Don't
        initialData[18] = (byte) bitmapWidth;//Bitmap Width
        initialData[22] = (byte) bitmapHeight;//Bitmap Height
        initialData[26] = (byte) 1;// :S
        initialData[28] = (byte) 24;//Color Depth
        initialData[34] = (byte) 8; // And this :D

        File f = new File("D://test.bmp");
        if (!f.exists()) {
            f.createNewFile();
        }
        FileOutputStream fos = new FileOutputStream(f);

        fos.write(initialData);
        fos.write(textData);
        fos.write(endData);

        fos.close();

    } }
 <comment><USER2> I covered this .gif picture in-depth on my blog: <http://bit.ly/yPuel0>

This script of yours basically automates the steps needed to create a bitmap with text.

<comment><AUTHOR> Thats was very nice</comment></comment>


Show HN: Kiwii – Manage how partners and friends share your message - <AUTHOR> http://www.kiwii.co/ <comment><AUTHOR> Hi guys, quick intro - a good friend of mine came to me with a problem last year. He was running an incubator, a large tech conference and was involved in a lot of other local events. He was constantly crafting tweets for influencers and marketing partners to promote his events. He'd send people suggested messages, suggested schedules etc. just through email. It was time consuming and tough to manage, partners would often forget or accidentally schedule posts for the wrong time and botch announcements. Moreover, he had very little visibility on how much traffic and conversions each partner brought in.

So the 2 of us and a few more of our friends came together and made a side project out of this. Kiwii lets you create and edit a campaign of social messages and send a single link to all your partners. The partners can choose which tweets to opt in to and adjust the messages as necessary and schedule them directly from our tool. You also get a dashboard to see exactly how effective each of your partners are.

Our first 'big customer' was Traction conference in Vancouver, and the tool seemed to be helpful, raising their social traffic by 15x as compared to the year before: [https://medium.com/@getkiwii/case-study-how-traction- confere...](https://medium.com/@getkiwii/case-study-how-traction-conference- used-kiwii-to-increase-its-social-traffic-by-15x-d0a6d1bed0c5)

However, we're struggling to find product market fit. We thought we'd target conference and event organizers, but for them, usage is very seasonal, the market is fairly small and social media marketing is often not their top priority.

We actually shelved the project a while ago, but recently decided to give it one more shot. Try to get some visibility on what we're doing and try to get some feedback. We think there is some real value here and hope to find some feedback that tells us how to get to something viable. So, that's why I'm posting it here, love to hear your thoughts on the project. Thanks!</comment>


Show HN: Hnwatch – Linux x64 terminal-based real-time HN watcher/reader - <AUTHOR> https://2ton.com.au/hnwatch/ <comment><USER2> Hmmm! some nice stuff there besides the "hnwatch" itself:

\- it's apparently written in "FASM" assembler, which is BSD-licensed (according to Wikipedia), cross-platform, self-hosting (?), Intel-syntax (my preferred camp), and also has an experimental "g" version supporting output targetting JVM, AVR & other fancy stuff (customizable via "macroinstructions"): [http://www.flatassembler.net/download.php](http://www.flatassembler.net/download.php)

\- IIUC, this "hnwatch" page is at the same time kinda delicate & non-pushy advertisement for the author's (authors'?) multipurpose ASM library named "HeavyThing" (i.e. kinda custom "stdlib"): [https://2ton.com.au/HeavyThing/](https://2ton.com.au/HeavyThing/) (which seems to be required to build "hnwatch"? It wasn't clear to me initially) - worth some more highlight, I believe.

As a sideways wishful-thinking comment regarding the highlighter used for showcasing the hnwatch sources: I'd much prefer if syntax was not highlighted (i.e. the eye-piercing blue '[' & ']'), but instead the "call" instructions would, as well as "jmp" and variants (with a different colour), user symbols (different colour again) including especially labels (another colour please). Also, if there were somewhat more comments in the sources. Also, in [https://2ton.com.au/library_as_html/hnwatch/textify.inc.html](https://2ton.com.au/library_as_html/hnwatch/textify.inc.html), the highlighter seems to have gone awry.

 _update:_ edited heavily to hopefully better express my positive attitude; in the Interwebs, no one can see you smile

<comment><AUTHOR> Nice to meet you, too.

Curious as to what your intention is by pointing out my investment in years of profit-free GPLv3 development, and that somehow that is tied to the BSD license of the compiler's creator.

Care to elaborate on a better method? I miss Turbo Assembler, which is in part what brought fasm into existence.

"Advertisement" for GPLv3 sources?

I am not ashamed to openly admit my company would love more contract work, consider what I have contributed for free the "world's most expensive curriculum vitae". I'm interested to hear what other open source decision makers have to say about this, but 2 Ton Digital as a Software resource has made me bupkiss.

More the point, when someone wants something that requires a higher-than- average level of skill, we get business. The community as a whole gets to benefit because I keep turning it loose with no strings attached. Isn't that the way it is supposed to work?

<comment><USER2> Hmh; I think there might have been kinda misunderstanding (?) - I'll edit my comment to change "interesting" to "nice", hopefully this way it will better express my original intent.

In other words, big thanks for making me aware of the FASM! Not sure if I'll ever use it, but totally worth remembering for future, just in case. Or, who knows; maybe for some hobby AVRing I hope to do it'd be actually easier than the whole AVR-GCC stuff?

<comment><USER3> Your use of the word "apart" right at the beginning is likely to be a cause of confusion. Clearly, in this context, you mean it in the "as well as" sense, but I initially read it in the "instead of" sense, and I think most other English-as-1st-language speakers would do the same. Qualifying it e.g. "quite apart from..." can avoid the misunderstanding.

<comment><USER2> oh... ok; thanks! changed that too; hopefully better now? :/

</comment></comment></comment></comment></comment><comment><USER4> I made a docker image for this: [https://github.com/agonzalezro/docker- hnwatch](https://github.com/agonzalezro/docker-hnwatch)

If you want to run it: docker run -it agonzalezro/hnwatch

I don't know why but hnwatch doesn't look like working ATM. I've tried in a Linux box (without docker) and I have the same problem with the tty, it's just loading 4 news and no comments or similar.

<comment><USER5> Dude, use alpine (~5MB) rather than ubuntu (~190MB) for the base image!

<comment><USER4> Done. Awesome image! Thanks for sharing :)

</comment></comment></comment><comment><AUTHOR> outside curios request related to this submission, I have always configured webservers to return "400 Bad Requests" on HTTP/1.1 requests that lack a Host: header.

Still, every interaction I have had with HN this year always results in lots of hosts getting said results, and while this one is going, the most offensive host: 126.96.36.199 (dns: 207-226-141-203.static.pccwglobal.net) .. 1800 requests and counting from that host... ??

</comment><comment><USER6> Hmmm. I wonder if someone can write a hacker news comment that'll cause remote code execution on those running this...[1] I would have no idea how easy protecting buffer overflows is in assembly but I'm guessing it's harder than C.

[1] consider this a challenge...

<comment><AUTHOR> You obviously didn't scrutinize my code :-)

<comment><USER6> Ah yes! After reading through the code it's become _crystal_ clear to me that your code is bullet proof :-)

</comment></comment></comment><comment><USER7> Why choose assembly for this?

<comment><AUTHOR> Ha! Great question, one that I get asked semi-frequently. 1) Because unlike many, I can, 2) Because contrary to popular belief, it is not difficult. :)

<comment><AUTHOR> my main desktop is also Mac OS X, I run vmware fusion + linux hosts when necessary, but all of my server infrastructure is linux anyway :-) linux kernel makes assembler so much easier than OS X and of course all of my library is catered for server-side infrastructure.

<comment><USER3> Yeah, my only easy option is to run this on our live web server. Hmmm, conflicted ...

<comment><AUTHOR> again FWIW, I am the co-founder of a proper Australian registered business, I appreciate your concern. In an isolated environment, run it with strace -o nasties.txt or something similar. I assure you personally that the only outbound connects this thing does is to your locally defined DNS and firebaseio per the HN API, and is not terribly unpleasant to any host CPU (near as I can tell anyway, and that was before I enabled the 150 item limit on the main page indices).

</comment></comment></comment></comment></comment><comment><USER8> This is awesome, the sshtalk mentioned above looks great too, although trying to brute force a room name isn't working out for me.

I found a few of the key bindings by accident, trying to scroll with j. I considered making something like this a long while ago, but definitely not in asm, this is impressive.

I may have to poke at the code a bit and see if I can add/change a couple things :)

<comment><AUTHOR> FWIW, I intentionally didn't implement a "/list" feature for it, as it was originally designed to be an in-house sorta ephemeral chat thing... not many requests for a public "IRC-style" ssh chat server, if there is by all means adding the feature for a "/list" wouldn't take long

<comment><USER8> I was just poking around to see how it works. I love the idea, but I doubt I could convince enough people to join that wouldn't already have the room name to justify the effort of adding a /list.

</comment></comment></comment><comment><USER9> I really don't get this to work as I feel it should. Initially I get like 4 articles showing up, sometimes two articles have the same pos-value.

The list of articles then continues to be populated very slowly (I'm up to 12 now after a minute or so maybe?).

I've tried it on two different networks, one of them being 100/100mbit/s fiberoptics.

Am I missing something?

<comment><AUTHOR> WYSIWYG sadly, hnwatch grabs the ID list to fetch from the SSE direct from firebaseio (and thus the public API). It was working a treat (and accurately reproducing everything from HN web-proper) prior to my releasing this... IDK what the proper course of action is from here... :-/

</comment></comment><comment><USER10> The HTML rendering of the source code at [https://2ton.com.au/library_as_html/hnwatch/textify.inc.html](https://2ton.com.au/library_as_html/hnwatch/textify.inc.html) is broken due to the inclusion of markup delimiter type characters in the source.

</comment><comment><USER7> I love your ssh "site" \- ssh 2ton.com.au I like the idea of using the talk command

<comment><AUTHOR> Yeah I spent a very interesting day chatting to heaps of people, haha, wasn't even logged in until just then :) glad it is appreciated. I can't handle too many chats all-at-once, but am logged into it now :) Edit: meant to include the origin of my day's sshtalk fun: [https://news.ycombinator.com/item?id=9716459](https://news.ycombinator.com/item?id=9716459)

<comment><USER11> Is there a list of active rooms somewhere?

<comment><AUTHOR> See prior comment about the intentional omission of "/list" functionality

<comment><USER11> Well I'd also take just _one_ active room ;)

<comment><USER12> I'm gonna idle in 'chat' and see what happens.

</comment></comment></comment></comment></comment></comment><comment><USER13> Pretty cool.

I do however get a coredump resizing the terminal window: Ubuntu 14.04LTS, tmux, hnwatch

</comment><comment><USER14> Awesome work! Unfortunately I too am only seeing the first 4 lines of HN. Also, when I press Enter on a selection, it doesn't show comments. I love the idea of this and I hope to see its development continue!

</comment><comment><USER15> I'm getting this on scrolling:

[http://i.imgur.com/UnTepmd.png](http://i.imgur.com/UnTepmd.png)

</comment><comment><USER16> If you listen closely, you can hear me clapping. Well done.

</comment><comment><USER17> is anybody using their rwasa webserver in production?

<comment><USER5> I've just migrated a set of Docker containers on one host from jessie+nginx to alpine+rwasa.

Looking good so far.

</comment></comment><comment><USER5> Feature request: page up and down keys.

:)

</comment><comment><USER18> lynx

<comment><USER19> You could /almost/ have this with newsbeauter and lynx, except that the RSS feed doesn't include points or comment number and lynx doesn't indent comments, so all comments appear at the same thread level which is somewhat confusing.

<comment><USER20> I use this in my elinks hooks.pl to indent hn comments.

        use strict;
        use warnings;

        use Encode;
        use Mojo::DOM;

        sub pre_format_html_hook {
            my $url = shift;
            my $html = Mojo::DOM->new(decode_utf8(shift));

            if ($url =~ 'news\.ycombinator\.com') {
                $html->find('img[src="s.gif"]')->each(sub { my $e = shift;
                                                            my $w = $e->attr('width');
                                                            my $ns = ' ' x ( $w / 10 );
                                                            $e->replace($ns); });
        }

        return $html;
    }</comment></comment></comment>