How the 1918 Flu Spread Across America (2017) - <AUTHOR> https://www.smithsonianmag.com/history/journal-plague-year-180965222/# <comment><USER2> While doing ancestry research years ago, I learned I had a 2nd great uncle who immigrated to America from Romania aboard the RMS Carpathia in 1904. (Eight years later in 1912, this would be the first ship to come to the Titanic's rescue, and six years after that would itself be sunk by a U-Boat.) He had left Romania likely to escape anti-semitism. He'd eventually find his way out to Denver. Sadly, he'd die in 1918 (the same year the Carpathia was sunk) at the age of 25, very probably from the flu.

This is a picture of him, along with his headstone and declaration of intent to become a citizen:

\- [https://ibb.co/xggjjnJ](https://ibb.co/xggjjnJ) (Photo)

\- [https://ibb.co/vvnSqMg](https://ibb.co/vvnSqMg) (Headstone)

\- [https://ibb.co/zmNzdC9](https://ibb.co/zmNzdC9) (Declaration)

Google Maps for his Denver, CO address:

\- [https://goo.gl/maps/CvmeCsUARnwXNnBu6](https://goo.gl/maps/CvmeCsUARnwXNnBu6)

<comment><USER3> It's worth noting that the 1918 flu was unique in that it killed many young, healthy people.

Corona virus is more typical in that it's primarily killing the very old or otherwise ill.

[https://www.worldometers.info/coronavirus/coronavirus-age- se...](https://www.worldometers.info/coronavirus/coronavirus-age-sex- demographics/)

<comment><USER4> How much of that was down to the disease, compared to the conditions that "young, healthy" people would have been subjected to during a world war?

<comment><USER5> From the article (as well as other places I've read similar things).

"Why did so many young adults die? As it happens, young adults have the strongest immune systems, which attacked the virus with every weapon possible—including chemicals called cytokines and other microbe-fighting toxins—and the battlefield was the lung. These "cytokine storms" further damaged the patient's own tissue."

The more robust immune response was a large cause of the increased mortality.

<comment><USER6> Iirc from my time as a biologist, we don't have any direct evidence that a cytokine storm happened and there seem to be other possible explanations for that distribution.

</comment></comment></comment></comment></comment><comment><USER7> A BBC documentary called "The Flu That Killed 50 Million" is informative. As of time 130 million were infected and 200 thousand dead, Sir Arthur Newsholme, senior medical officer at Whitehall, sent a message to his European counterparts proposing a cease fire because an existential threat to humanity transcends national rivalries. (Just kidding!) He actually decided against even warning the public to take any precautions because it would not be "expedient" for the munitions factories to slow down. My takeaway is never to put it past those in power to decimate of the population if it suits their ends.

<comment><USER8> To be fair, those in authority were doing a pretty good job decimating the male working age population before flu came along. They could probably model the daily death rate from flu in it's early days to be less than that on the Western front... especially if they weren't very good at modelling exponential growth.

<comment><USER9> The SIR model for infectious disease growth was proposed in 1927, [https://en.wikipedia.org/wiki/Mathematical_modelling_of_infe...](https://en.wikipedia.org/wiki/Mathematical_modelling_of_infectious_disease). We got taught this in our undergrad calculus class and wrote programs to play with the different parameters - it's kind of eye opening if one has never thought too much about it - pretty much everyone gets infected within some constraints.

</comment></comment></comment><comment><USER10> " Philadelphia had scheduled a big Liberty Loan parade for September 28. Doctors urged Krusen to cancel it, fearful that hundreds of thousands jamming the route, crushing against each other for a better view, would spread disease. They convinced reporters to write stories about the danger. But editors refused to run them, and refused to print letters from doctors. The largest parade in Philadelphia's history proceeded on schedule."

I see that Switzerland has imposed a ban on gathering of 1000 or more in response to COVID19 - maybe other countries should consider doing the same?

<comment><USER11> For the USA at least, wouldn't imposing a ban rather than a recommendation be a violation of the Constitutional right to freedom of assembly?

<comment><USER12> If the CDC merely urged that all large gatherings be cancelled, that would probably result in the cancellation of 95% of them, with no constitutional implications.

<comment><USER13> Can they at this point? It seems like their authority has been emasculated.

<comment><USER14> I don't understand what you mean by this.

<comment><USER13> VP Pence has been given veto authority over all messaging, and the CDC's funding in this area was gutted early in the administration.

<comment><USER15> The CDC's funding was not gutted in that area, that's a false propaganda point being shoveled by several prominent Democrats. Trump attempted to push cuts through and failed, fortunately.

> AP FACT CHECK: Democrats distort coronavirus readiness

> Democratic presidential contenders are describing the federal infectious- > disease bureaucracy as rudderless and ill-prepared for the coronavirus > threat because of budget cuts and ham-handed leadership by President Donald > Trump. That's a distorted picture. For starters, Trump hasn't succeeded in > cutting the budget.

> He's proposed cuts but Congress ignored him and increased financing instead. > The National Institutes of Health and the Centers for Disease Control and > Prevention aren't suffering from budget cuts that never took effect.

[https://apnews.com/d36d6c4de29f4d04beda3db00cb46104](https://apnews.com/d36d6c4de29f4d04beda3db00cb46104)

<comment><USER13> You're correct that funding wasn't impacted. I was wrong about that.

However he did indeed cut the people tasked to deal with pandemics.

[https://foreignpolicy.com/2020/01/31/coronavirus-china- trump...](https://foreignpolicy.com/2020/01/31/coronavirus-china-trump-united- states-public-health-emergency-response/)

> But other White House efforts included reducing $15 billion in national > health spending and cutting the global disease-fighting operational budgets > of the CDC, NSC, DHS, and HHS. And the government's $30 million Complex > Crises Fund was eliminated.

> In May 2018, Trump ordered the NSC's entire global health security unit shut > down, calling for reassignment of Rear Adm. Timothy Ziemer and dissolution > of his team inside the agency. The month before, then-White House National > Security Advisor John Bolton pressured Ziemer's DHS counterpart, Tom > Bossert, to resign along with his team. Neither the NSC nor DHS epidemic > teams have been replaced. The global health section of the CDC was so > drastically cut in 2018 that much of its staff was laid off and the number > of countries it was working in was reduced from 49 to merely 10.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I read this article a few weeks ago when I fell down the rabbit hole of trying to figure out why the Spanish Flu was called the "Spanish Flu". I knew it didn't originate from Spain, but hadn't heard that the _traditional_ consensus is that it likely started in Kansas, owing to the first detected case being in Kansas.

The CDC has a variety of history pages [0] about the Spanish Flu. The main one acknowledges that there isn't a "universal consensus" about the virus's origin, but doesn't assert any of the other alternative explanations.

The theories that the Spanish Flu might have actually come from China seem to be more recent. Such as this one in 2014 [1] that found reports from 1917 of Chinese suffering Spanish Flu like symptoms. But his explanation for how the first known case in the West was in Kansas – that thousands of Chinese workers were sent to labor around the world – seems really speculative.

Given that there isn't compelling evidence to think the Spanish Flu started elsewhere outside of Kansas, it is funny how not only did it get the name of "Spanish Flu", but also that Kansas managed to not have a long-lasting reputation for terrible disease, even though the Spanish Flu killed more people than (IIRC) all the other 20th century pandemics combined.

[0] [https://www.cdc.gov/flu/pandemic- resources/1918-commemoratio...](https://www.cdc.gov/flu/pandemic- resources/1918-commemoration/1918-pandemic-history.htm)

[1] [https://www.history.com/news/china-epicenter-of-1918-flu- pan...](https://www.history.com/news/china-epicenter-of-1918-flu-pandemic- historian-says)

[https://en.wikipedia.org/wiki/Spanish_flu](https://en.wikipedia.org/wiki/Spanish_flu)

<comment><USER17> I heard it was called it because the Spanish were the only ones reporting it during the war.

<comment><USER18> Yes, that was the explanation I got in history class as well. The flu emerged during World War I, and every combatant country had strict censorship of the press in place, which suppressed news of its spread in those countries. But Spain was neutral in that conflict and thus had an uncensored press, so reports of the flu's impact quickly made it to print there. And those reports got picked up worldwide as the first reporting on the influenza, leading people to think of it as a disease that began in Spain.

</comment></comment></comment><comment><USER18> It may be worth noting that while this piece presents it as settled that the Spanish flu originated in Kansas, that's not really the case. The author of this piece, John Barry, has long been an advocate for that position, but there are other theories of origination as well supported by at least as much evidence as the Kansas theory.

Wikipedia has a write-up on the various theories of origination here: [https://en.wikipedia.org/wiki/Spanish_flu#Hypotheses_about_t...](https://en.wikipedia.org/wiki/Spanish_flu#Hypotheses_about_the_source)

</comment><comment><USER19> > In 1918, medicine had barely become modern; some scientists still believed > "miasma" accounted for influenza's spread.

Does anyone know where I can learn more about the "miasma" model of disease? Whenever I'm looking up old plagues / diseases / etc. etc., they bring up the "miasma" model.

But what is the miasma theory (or pseudo-science?) that people used to believe in? And how does it differ from our modern germ theory?

Ex: I know plague doctors wore airtight masks and waxxed leather to suit-up and protect themselves from the "miasma" of the plague. As an early sanitization model, it probably worked (at least, "worked" as much as modern masks work on untrained laypeople). But where did the miasma model fall short compared to germs?

<comment><USER20> I dislike this idea of calling theories that ended up being wrong as "pseudo- science". Not all wrong ideas were just random ramblings. Miasma Theory came from imperfect knowledge and not understanding the mechanisms of some of their observations.

If you read the debates on how miasma works, you can totally see reasonable rational arguments if you strip away a few generations of scientific knowledge.

<comment><USER21> I agree. It becomes pseudoscience when it contradicts existing scientific knowledge without any rationale or explicitly comes from a a rejection of the scientific method. There's a difference between being pseudoscientific and being wrong. A lot of hypothesis about how the world works today, including some seemingly strong beliefs backed by pots of evidence, will be found to be wrong or incomplete as we move forward and develop better tools and science.

</comment></comment></comment><comment><USER22> I fear we are going to regret not taking draconian measures right now. Mandatory social distancing right now likely could buy additional time for the healthcare system to advance preparations for a wide scale outbreak, including stockpiling additional PPE and advancing triage procedures. It provides valuable time for drug & medical device manufacturers to ramp up production of needed supplies and drugs that should be proved effective in a few days or weeks. A 14 - 30 hold would do disproportionate good over potential damage.

<comment><USER14> Flip side of your argument, just for brevity's sake.

I fear many governments and leaders are going to use this as an excuse to take full control and become the tin-pot dictators they want to be through those same draconian measures.

So here we are.

</comment></comment><comment><USER23> The biggest thing I took away is that it wasn't the initial outbreak that was abnormally lethal. It was the only after it had been incubating and mutating in millions of human hosts that the second wave broke out.

</comment><comment><USER24> This article was from November 2017, can the mod put a year tag in the title?

<comment><USER25> I agree and think that in this case, the (2017) year is an important distinction. It helps to emphasize that this is not a story written with our current fears in mind. But rather, it is an unbiased look at what happened during the spread of the 1918 flu pandemic. And there are lessons to be learned.

</comment></comment><comment><USER26> For those of you reading this from the bay area, we already have suspected community transmission 50 miles away, in a town with a lot of people who commute to the Bay. If it's easy for you to work from home, consider doing so, giving explicit permission to your reports to do so, and asking your manager to give permission to their reports to do so.

We're fortunate to be in an industry where WFH has relatively little cost, and we can afford to get ahead of this in a way that other industries can't. We don't have to wait for the government to give us guidance. For people doing technical tasks, IMHO, the cost/benefit tipped in favor of WFH yesterday.

<comment><USER27> I'm not sure why officials haven't come out suggesting things like this. And to avoid non-mandatory travel.

It's probably a bit late for this stuff from a containment perspective. But it would help reduce the r0.

Speaking personally, I have to decide by mid March if we should take our trip to Legoland in San Diego. Right now I'm leaning towards "no". And I don't imagine the outlook will be much better in just 2 weeks.

<comment><USER3> Because they're balancing being extra-cautious with the serious risks of overreacting.

The worst case scenario right now is that some people might lose their grandparents a couple years early -- which is obviously incredibly sad, but also not something worth crashing the world economy over.

<comment><USER28> Ouch. I have this opinion of my dog. An extra year or two... not a big deal.

I do not have this opinion of my parents or any other immuno-compromised individual. Your worst-case-scenario is absolutely the worst-case scenario in many individual's minds.

If the greater good is not the extension of the life of those around us what exactly are we trying to do here?

There are many things worth crashing the world-economy over. Slavery was one. Climate change probably another.

Asking for a 90 day slow-down to prevent real-world deaths is probably one of the more concrete and predictable things we could do compared to most other altruistic choices facing us today.

<comment><USER3> Please don't put words in my mouth.

<comment><USER28> I apologize if I misunderstood your intent. I can see other ways of interpreting what you said.

I originally took your point to be that the current risks, although sad, are acceptable and we face greater peril from slowing down economic activity.

Although I see trade-offs to everything I see economic activity fundamentally as in service to the quality of life of a person and would rather take the sadness of losing greater economic gains to the sadness losing significantly more people.

There is always a balance to this and I could interpret what you said as having a different perspective on what the current risks are but without additional context, I took it as I did.

</comment></comment></comment></comment></comment></comment><comment><USER29> A thread from last year: [https://news.ycombinator.com/item?id=19237730](https://news.ycombinator.com/item?id=19237730)

</comment><comment><USER30> > history's worst epidemic

Come again?

<comment><USER31> I suppose it depends on whether you look at total killed or percent killed. The Black Death might have had a higher total body count, but smallpox hitting the Americas had a massive mortality rate, something like 50% or higher.

</comment></comment><comment><USER32> Was there ever a better example of why the government needs to be kept away from news outlets?

<comment><USER33> I don't know that it's a correct reply for this comment, but it sparked in my mind the memory of "All Quiet on the Western Front" [1]

The initial premise of which is that the townsfolk talk war up as a glamorous and noble thing, so all the boys enlist at the outbreak of WWI, only to find what absolute hell it is.

Actually makes me want to go back and read the book. Or maybe re-read? I don't remember if we read it before we watched the film.

[1] [https://www.goodreads.com/book/show/355697.All_Quiet_on_the_...](https://www.goodreads.com/book/show/355697.All_Quiet_on_the_Western_Front)

</comment></comment><comment><USER34> Here comes the fear mongering. We are far better equipped to handle epidemics and pandemics now than 100 years ago.

<comment><USER35> It's not even a matter of being equipped to handle it imo; all signs also point to COVID19 not being as serious as initially thought and far more mild than expected.

Administrating the test for it is both expensive, and time consuming, so the gross number of known infections is likely to be substantially underreported because of selection bias (why run expensive RNA analysis on a blood sample if the person is having mild cold symptoms?). There are probably a bunch of other confounding factors, such as most people getting it are probably asymptomatic or just think they have a typical cold/flu. It also appears to be non-lethal to children, as opposed to seasonal influenza.

In simple gross numbers, more people die in car accidents every day than the current worldwide totality for this virus. Comparing against US CDC stats, it isn't even remotely close to statistical estimates for flu deaths so far this year in the US alone(~16k).

My suspicion is if you concede that gross numbers of COVID19 infections are substantially underreported, the death rates fall into line with typical flu, maybe marginally worse.

The reasonable response to this is what people should already be doing for influenza: practice good hygiene, stay home if you're sick, take caution when interacting with at risk populations to minimize their exposure, etc.

<comment><USER36> What makes it different is that it is _new_. This could have made it avoidable in comparison to other diseases that are common. Surely it is worth trying to eradicate diseases before they get established? If we could irradicate flu we would.

<comment><USER35> I'm not sure what I've said that would contradict anything you've suggested. I agree with your question, obviously we should do everything reasonable to contain and curtail a lethal disease. The best way to do that is to address it in a sober, realistic manner and drive intervention and response on evidence - not the conjecture of journalists who demonstrate little to no understanding of the situation and disseminate unfounded paranoia.

<comment><USER36> I think your comment is doing the opposite. It is using conjecture and false comparisons to downplay the seriousness. And using those false comparisons as a heuristic for justifying a continuation of common practice. You may well be right. But you are not providing any evidence to justify that.

<comment><USER35> Could you detail what comparisons you think are unfair?

As for sources, if you look in the thread I respond citing WHO, NEJM, KCDC, etc as evidence for my assertions/assumptions.</comment></comment></comment></comment></comment></comment>


Pros & Cons of C++ - <AUTHOR> http://healthbase.netbase.com/#C++&Pros

<comment><USER2> The search bar stands out to much.

It's not immediately obvious that the results are such and not just random information.

<comment><AUTHOR> You missed the joke.</comment></comment>


The Case for Price Gouging - <AUTHOR> http://www.slate.com/articles/business/moneybox/2012/10/sandy_price_gouging_anti_gouging_laws_make_natural_disasters_worse.html

<comment><USER2> Supply shocks and demand shocks are somewhat different. Yglesias has plenty of money, so he doesn't want to have his time gouged. On the other hand, a well- supplied Yglesias (at a higher cost) is of no more benefit to the local economy than a less well-off person whose access to storm supplies is protected by laws against price gouging.

Yglesias' time is more valuable since he as a comparative advantage in a lucrative market (political punditry), and so it is more efficient for him to maximize his available time...in the long run. In the short run, he's not going to hire any more interns or increase his personal or local economic output, so there's no particular reason that he should be able to preferentially minimize his time cost. He's overstating his case and ignoring the fact that many retailers seek to extract economic profits while showing little inclination to temporarily exit the market.

tl;dr contrarian linkbait.

<comment><AUTHOR> If you fix prices, goods tend to be allocated to the people who value their time the least. If you let prices float, goods tend to be allocated to the people who value their time the most. Neither is an optimal allocation.

<comment><USER2> I agree, and over longer periods I'm also inclined to let prices float. In a short-term emergency, though, people have to make compromises, just they may have to tolerate things like mandatory evacuation orders.

<comment><AUTHOR> Which is worse: allowing prices on (say) bottled water to rise by 20%, or, by keeping prices artificially low, ensuring that people who arrive at the store a few hours late find no bottled water at all?

I don't think this is a linkbait question at all. Yglesias is pointing out that our mental model of "price gouging" during disasters is gigantic rent- seeking markups, but the reality is often a more modest increase in prices. Since the value of many of these goods spikes during disasters, artificially holding their prices down is like declaring a sale on them; in other words, it sends a very counterproductive message to the market ("buy everything you can get your hands on whether you really need it or not").

I'm just asking the question, by the way. I have no idea what the answer is. Off the top of my head, though, it seems like enforcing "limit N per customer" is a worse way of controlling this phenomenon than simply allowing prices to rise to meet demand.

</comment></comment></comment></comment><comment><USER3> Not everything in a crisis can be cast in rational, economic terms. There's also the intangible emotional and social-cohesion value that comes from the sense that "we're all in this together." Sudden price increases, no matter how rational they might be economically, can damage that sense of community.

<comment><AUTHOR> The problem that the article points out is, hoarding damages community cohesion too.

<comment><USER3> > _hoarding damages community cohesion too_

True, but not in a manner readily attributable to a particular party, as is the case with price increases.

If a gas station raises its prices, everyone knows who did it and can point the finger of blame.

On the other hand, if the gas station runs out of gasoline, no one knows who hoarded by buying more than they needed, except _possibly_ the hoarders themselves --- who might not know whether or not they actually needed the extra gasoline until after the crisis has passed.</comment></comment></comment>


Ask HN: Why there is no official mobile version of HN? - <AUTHOR>

All the versions I am able to find are hobby projects. <comment><USER2> Not completely sure. Reddit for example has a few really good ones. Alien Blue for iOS and Reddit Is Fun for Android are the ones that come to mind. Might be that the HN community is too small with a comparatively low opportunity for real growth. It's big, but not compared to something like Reddit. To put in the work building and maintaining a product good enough to actually use, you'd want the developer to be making enough money such that he/she would be able/willing to support it. And that may be difficult with a community like HN.

</comment><comment><USER3> If I had to guess, I would guess because PG and YC does not want to allocate too much resources to building it out as well as YC. They still add features, but I think I read somewhere before that every resource they spend on developing HN is resource and time that could be spent doing something else (opportunity cost). So they probably do the minimum needed and maybe a few features here and there from time to time and scaling fixes but overall probably not going to push huge changes. It's basically Craigslist.

<comment><USER4> It would be good to be able to search on mobile (with the search box on the bottom), but you can't hit Enter and have to go over to hnsearch. Unless there is another way?

</comment></comment><comment><USER5> Does anyone know if it's possible to pass a custom css to Hacker News?

</comment><comment><USER6> Is there a need for one? It works fine on my phone as-is.

<comment><AUTHOR> With lots of pinch-and-zoom.

</comment></comment><comment><USER7> at least they could do a responsive css...

</comment><comment><USER8> I dunno, but Mouin HN is great for iOS.

</comment><comment><USER9> is there an API to hackernews ?

<comment><USER10> there is one (unofficial) @ <http://api.ihackernews.com/> which is used by ihackernews ... my mobile frontend of choice as long as there's no official one.

<comment><AUTHOR> Thanks for pointing ihackernews out, I missed it on my searchs. Quite handy.</comment></comment></comment>


My KickStarter Project: A Low Cost AirPlay Receiver - <AUTHOR> http://www.kickstarter.com/projects/931927530/tunebridge-a-simple-affordable-airplay-enabled-rec Hey Hacker News!
I wanted to share with everyone my first KickStarter project: the TuneBridge. TuneBridge is a simple, easy and affordable audio streaming device. Using Apple's AirPlay, TuneBridge lets you stream your music or podcast from a wide variety of devices to just about any speaker or receiver out there. No need for special speakers or receivers, no more wires to contend with.
What I think is most exciting about the TuneBridge is the affordability. The target retail price is $59.99. This opens AirPlay up to just about anyone and any device.
This project is a huge leap for me to move out of a 9 to 5 engineering role and into the world of product startups. I'd love any feedback you guys may have.
Best, Brandon <comment><USER2> Eh, AppleTV is 100$, your device 60$. Not much savings if you consider that AppleTv got far more features and it is already available.

<comment><USER3> Factor in the time spent creating this Kickstarter project and he could have just bought the Airport Express and saved himself a lot of money and already been listening to streaming music!

</comment></comment><comment><USER4> At this price, I'd question whether this is using the hacked Airplay encryption key that was posted on the internet. I can't see Apple being to happy about losing sale on AppleTVs because of this device.

</comment><comment><USER5> So you have to connect to a wifi network that is created by the TuneBridge? Isn't this highly inefficient? When a user does this they will not have internet on their phone/ipod any more, it will make the device un-usable.

I got excited about this due to the cheeper price but lack of internet is a huge problem and it essentially "breaks" the device functionality. These devices were not meant to connect to wifi hotspots lacking internet conductivity. I have created wifi-hotspots with no internet conductivity in the past and it is hard to keep a device connected to it due to the device trying to find a real source of internet.

<comment><AUTHOR> Josh, Thanks for checking out the TuneBridge! You have two options to connect to the TuneBridge with your iOS device:

1\. Existing Network: You can configure the TuneBridge to connect to your existing home wifi network. This allows any iOS device, Mac, or PC connected to your home network to stream to the TuneBridge.

2\. Direct: You can also connect directly to the TuneBridge. The TuneBridge will create an ad-hoc network that your device can connect to. This network is configured in a way that allows iOS devices to continue using their 3G data for the internet connection.

If you have any other questions, just let me know!

</comment></comment><comment><USER6> Nice idea, but we had a similar need a year ago and we bought the Sony wireless transmitter. It works flawlessly with pairing. (without pairing interferes with wifi). The sony just doesn't work with Mac, but it works through a USB connection because we use it for non iTunes stuff. We play live feeds most of the day on it. Your device would only be for itunes because it connects directly to wifi.

</comment><comment><USER7> Can't the Raspberry Pi run an AirPlay receiver via XBMC? It costs less, and can stream 1080p video. The 3.5mm jack for audio output isn't ideal, but it can also run audio over HDMI if you're set up for that.

TuneBridge definitely looks like a more consumer focused option, but for the price you could put RPs in a nice case with custom software and still make a profit.

</comment><comment><USER8> A refurbished AirPort Express is $69 with free shipping and has an internal power supply. In what we do you feel your product improves on ab AirPort Express?

</comment><comment><USER9> Maybe I missed this... What is the target retail price? I see that a contribution of $60 will get you one; is that the target price too?

</comment><comment><USER10> You can buy an Airport Express for $99.

<comment><USER11> That's 67% more than tunebridge.

<comment><USER3> Without even having used the TuneBridge product, the price difference is worth it. The $99 airport express (less if you buy a used one) just works. Period. Same with Apple TV.

Why introduce a device from a different manufacturer ... in this case a Kickstarter project from someone with no track record of producing successful consumer electronics.

There are two products out there already that provide this exact functionality, from the same company that produces your devices you want to stream from, and everything works together seemlessly.</comment></comment></comment>


US Marines Ban Twitter, MySpace and Facebook - <AUTHOR> http://crenk.com/us-marines-ban-twitter-myspace-and-facebook/

<comment><USER2> When you are using a social network, you are talking about what you are doing. When you are in the military, that typically is not something you want on the internet.

Seems to make sense.

<comment><USER3> That's really not an argument. It's obvious that the marines are _trusted_ not to do that, because there are a million other methods of communicating on the net (it was made for that, right?) and if a marine wanted to, they could leak information quite easily. The only effective way to bar them would be to just not give internet access.

<comment><USER4> The main method seems to be email, and if they're similarly restricted to DoD mail servers, they can apply censorship on the server side.

Before the time of the internet, letters home were routinely censored and redacted before being sent.

</comment></comment></comment><comment><USER5> It says they placed a network wide ban on them, I wonder how tight their security is. Can it be bypassed with a proxy or VPN? It seems the real issue is "...links to malicious sites in the hope a marine on R&R ... might click on them", they would be better served by locking down the systems that are accessing the Web, having an IDS and educating the soldiers on cyber risks.</comment>


Ask HN: Experienced Programmers Interested in Trading Systems - <AUTHOR>

A trader here that has spent the past few years developing automated modeling solutions. I know how to code too.
I want to see if there any interest from 1-2 people that have an interest in building software for exploiting short-term (~1 trade per day per strategy, not HF) market movements over futures and stocks.
Design is done. I could use some help with implementation. Just wanted to see if there's any interest.
Serious inquiries only from highly experienced programmers who have some background knowledge in the markets.
email is anony304 at gmail.com <comment><USER2> Why an anonymous account? This looks shady.</comment>


Xkcd font (direct download link to OTF) - <AUTHOR> http://www.xkcd.com/fonts/xkcd-Regular.otf

<comment><USER2> Clicking on the link automatically downloads: [http://www.xkcd.com/fonts/xkcd- Regular.otf](http://www.xkcd.com/fonts/xkcd-Regular.otf)

License = _apparently_ Creative Commons [https://github.com/ipython/xkcd- font](https://github.com/ipython/xkcd-font)

</comment><comment><USER3> Okey that was scary, clicking a link and automatically downloading the file.

Is there any way you can change it to link to a website, where we can see a preview, for example, and download it from there? Automatic download without any explaination is a really bad user experience.

<comment><AUTHOR> You're right, sorry. I've changed to post title to make it clear it's a direct download link.

By the way, this seems to be a slightly different version of the font: [http://xkcd.com/1506/xkcd-Regular.otf](http://xkcd.com/1506/xkcd-Regular.otf)

</comment></comment><comment><USER4> What is the license on this?

It'd be great to know before people start using it.</comment>


Freedom Zero Considered Sometimes Harmful - <AUTHOR> For users, Free Software has the undeniable advantage of avoiding dependence on its suppliers. You can arrange and share your own improvements. For many, the fact that it also costs nothing is less important. While fully-free works for some projects like the diverse and foundational GNU and Linux, the gratis consequence of Free Software licences has forced many Free Software creators to impose worse restrictions on user freedoms: Big Software limits powerful features or responsive support to the "enterprise" 1%, or uses a licence that limits competition. Small packages push ads, act like charities, or are created as either a poorly-supported recreation or a résumé item for a job making something closed. There ain't no such thing as a free beer.<p>To instead let Independent Open Software Vendors (IOSVs) thrive, most users should pay to use their software. This violates the spirit of Free Software Freedom Zero, "the freedom to run", even though it emphasises not restricting the software's purpose. A new licence, The DevWheels Licence, allows software to be both fully-forkable and require some users to pay to use it. It does this by percolating user payments back through software derivation graphs so that each package creator gets paid according to the value their package has added over the packages from which it has drawn. <comment><USER2> Link to the DevWheels Licence [https://devwheels.com/](https://devwheels.com/)

[https://devwheels.com/motivation](https://devwheels.com/motivation)</comment>


Swap '_' with '-' to write code faster - <AUTHOR> https://plus.google.com/106464412226321248435/posts/VrYLFL2PNxD

<comment><USER3> Or use a language where '-' is allowed in identifiers. '-' looks better than '_' anyway.

Personally, I decided a while ago that I spend such a disproportionate amount of time writing code that its worth my while to customise my keyboard layout to make writing code quicker and easier. I now use colemak with caps lock mapped to control and left control mapped to backspace. I also mapped alt-gr to hard to reach symbols (everything except those that are already on the main keyboard), and since I can tap alt-gr with my right thumb real easy, I can now type symbols like - = ( ) ! + * _ & @ ! 0 and others with ease (the listed symbols are the easiest symbols for me because I have them mapped to my left hand while my right hand presses alt-gr).

I spent ages debating with myself if its worth using a non-standard layout that I won't have on other computers, but in the end I figured I do so much coding on my own computer that if I had done this years ago (I used to think its not worthwhile), I would have saved a lot of effort.

Some people say that thinking about code is the slow part, not typing, but the way I see it is that the faster I can type code the more down-time I have for the thinking, the faster I can experiment in a REPL and the faster I finish mundane typing tasks where I don't need time to think.

I am now also planning on relearning my vi/vim commands to speed up my editing even more as I have forgotten a lot of what I knew a few years ago when I used vim a lot.

<comment><AUTHOR> > Or use a language where '-' is allowed in identifiers.

I have been a little obsessed with this question for a long time, and my interest in the LISP family of languages was in part driven by the use of '-'. This should have been a trivial consideration though. A keymap fix seems rather more logical than a change of language.

I agree that being able to type code quickly and conveniently is important. We only have so much time, while we have so much code to write.

<comment><USER3> Well I didn't seriously mean that one should switch language to type faster, just that the "problem" does not exist in languages that allow '-' in identifiers and that I feel '-' also looks a lot more natural too. I personally write a lot of C++ and Python code, neither of which allow '-' in identifiers, but I often wish they did (and would happily give up the ability to omit whitespace around operators) and while we're at it, why not allow + ! * and ? too.

Having said that, I'm all for switching languages (if your work allows it - <USER2> totally understand that some people won't have that choice) if it speeds up your development in some way.

</comment></comment></comment><comment><USER4> If you think about it most languages have sacrificed a lot simply to give mathematical operators their "traditional" ASCII meanings. Had character assignments been based on frequency of need or just convenience, you'd surely have seen things like minus-signs in variable names more often.

I would love to see a UTF-8 or other Unicode keyboard so that it's very fast to enter "real" symbols (partially programmable too). Why for instance does my numeric keypad need _another_ "/" or an asterisk...it could now have "÷" and "×" instead.

In the next few years, given more common Unicode support in keyboards and companion programs (text editors and terminals already do a decent job), it would be interesting to see a language evolve to require actual symbols for known operators. Then you really would have to type "6 × 5 ÷ 3", not the ASCII hack "6 * 5 / 3". It would also allow very interesting hyper-operators (as seen in old environments such as the Mac's MPW Shell, and now Perl 6). Wait...don't let Larry Wall see this or we'll have a "$≠" variable or something in Perl 7. ;)

<comment><AUTHOR> Well, the problem is that I don't see how it would be possible to have a keyboard like this that would be really fast to type with.

Even a visual keyboard, as on a tablet, that could arguably display any set of symbols, would still not really be a solution. You can only show less than 100 keys at a time, and you would have to switch layouts all the time, e.g. to get to that special 'alpha' or '!=' key.

I find full UTF-8 support in identifiers a regrettable idea because these symbols are generally impossible to type quickly. This makes programming languages less universal.

And I'm not even talking about symbols that look nearly identical but are actually different Unicode characters.

The only solution that I would find acceptable, personally, is to display certain identifiers or ASCII strings as fancy symbols. 'alpha', 'beta', '!=', 'ab / c' would be displayed using symbols, but the raw text file would contain the ASCII name. When editing a symbol, the actual name would be typed in.

Or a syntax similar to Tex would be acceptable: '\alpha', '\dot', '\frac{10}{100}'.

The display can be fancy, but the source file shouldn't be, IMO.

<comment><USER4> If identifiers are displayed as symbols, that's really no different than having keyboard support; in both cases you're hoping you can hit (ideally) one key and have the keyboard do what you want. Keyboards already have modes like the Shift key, it's just a matter of kicking the programmability up a notch. And who knows, maybe keyboards grow slightly and gain a 2nd keypad (on the left) with some new "common" keys.

Note that UTF-8 is quickly becoming the _new_ "raw text file". The encoding of each symbol is very well defined and supported by programs already. It is actually better to have that exact definition than an ASCII word that may or may not be supported by all editors (and if it's not, as you said some symbols look similar; which one is intended?).

I don't think keyboards will change much until some related tech becomes cheaper, too. Two key ones I think are cheap mini-displays per key (so the whole keyboard can display new glyphs if need be), and a companion touch- screen for _drawing_ non-trivial glyphs that are needed only occasionally. Or maybe they just give up on the idea of physical keys entirely and attach large touch screens as "the whole keyboard" for a desktop machine.

<comment><AUTHOR> > Note that UTF-8 is quickly becoming the new "raw text file". The encoding of > each symbol is very well defined and supported by programs already. It is > actually better to have that exact definition than an ASCII word that may or > may not be supported by all editors (and if it's not, as you said some > symbols look similar; which one is intended?).

Not at all. You _see_ 'A' on your screen: is it uppercase Latin 'a' or is it uppercase Greek alpha? Good luck, these are two distinct Unicode characters (with different UTF-8 encoding, obviously), but most fonts will (rightly) represent them identically.

How is your keyboard going to handle that? Your tablet keyboard? How do you know which symbol to type in when editing code? It's completely unmaintainable and unreadable.

In the scheme I described, if the word 'alpha' is not supported by the editor, then it displays the string 'alpha'. That's of course not ambiguous. And a good editor, in my scheme, would not display 'Alpha' as 'A' if it's well thought of, it would just display 'Alpha', which is not ambiguous and clear.

If the source is UTF-8, on the other hand, should the editor display U+03B1 to avoid the visual ambiguity of 'A'? Can you remember what Greek (or otherwise) letter that is?

Finally, note that there are 12 Unicode characters for the Greek letter alpha... See <http://en.wikipedia.org/wiki/Alpha#Computer_encoding>

So it's completely misguided to accept arbitrary Unicode characters in identifiers. Because the only way to display such an identifier in an non- ambiguous way is to display the binary encoding...

So, arguably, one could use a set of characters larger than ASCII for programming. But the full Unicode range is not it, there is way too much crap in there.

</comment></comment></comment></comment><comment><USER5> how do you type minus then? Does this reverse the shift key?

<comment><AUTHOR> Yeah.

Press the key without modifier: get underscore '_'. Press the key with shift: get '-'.

Return to default with: xmodmap -e 'keycode 20 = minus underscore minus underscore'

(This is for a qwerty layout)</comment></comment>


Google announces Cloud Build, its new continuous integration platform - <AUTHOR> https://techcrunch.com/2018/07/24/google-announces-cloud-build-its-new-continuous-integration-continuous-delivery-platform/ <comment><USER2> Maybe I'm missing something, or maybe they haven't rolled out all the new features yet, but this product looks identical to the GCloud Container Builder that's been on GCP for at least a year. Its even got all the old container builds from that product, and the UI is identical.

Is there anything actually new here? I can't find any indication in their documentation that its different; seems like it's just a different name?

<comment><USER3> It's the same product -- it was just renamed.

<comment><USER4> "its new continuous integration platform." Pretty misleading title, if you ask me. I'd suggest it be titled, "Google renames its old build system."

</comment></comment></comment><comment><USER5> This may be a nice time and place to ask ... I have docker problems.

We have a monorepo in GitLab and that works nicely. Many Dockerfiles are present in this repo in various folders. They all build private docker images pushed to AWS ECR. They all depend on each other and some have multiple parents, so this sort of forms a family tree.

It is a major pain to know what docker images are stale and need to be rebuilt, and to ensure that it's parents are also up to date. We do all this manually and it sucks.

Some images take hours to build and we only want to rebuild them when necessary. It would be great if the build server cached build-steps so that the resulting images could share more layers with previously downloaded images, saving hugely on disk space, time and bandwidth for people and servers.

We make sure to have one Dockerfile per folder and a file called "destination.txt" indicating the final image name adjacent to it, this allows scripts to easily build the entire tree of images and parents by scanning our repo.

We want nice automation. I don't even know what the best practices are here.

What should I do?

<comment><USER6> Several hour builds? I have to ask what kind of app this is for, because I haven't ever had a build take more than 2 minutes. I've been using docker heavily in CI/dev for about 2ish years and the past couple months been getting some production stuff going.

My first thought since you say you're having issues with build caching, you might want to look into multi-stage builds[1], if you haven't already. I haven't gotten any "heavy" use from these since I mostly do web stuff in non compiled languages, so I can't benefit from this feature as much as a compiled language than can just copy binaries around. But, it has been useful for like compiling JS, since it's done in a separate stage, I a) don't ever have to contaminate my final image with a node_modules at any point and b) can rebuild the image and used the cached stage if there are no changes in the front end, and that's usually the longest parts of my builds anyway.

However, if you're in a compiled language (which from the sounds of it, I have a feeling you might be — long builds and multiple dependent components that have to be rebuilt), you can compile some core component in the first stage (A), then have multiple stages (B, C) that depend on that component's compiled files, and then maybe a final stage (D) that depends on B & C. So then, if you make changes to just C, you'll only have to rebuild the C & D stages, while the other two are cached. Each stage itself is just an intermediary image, so you can use them as you would the final, and you can even tell Docker to just build up to stage B, if you only need that image.

[1] [https://docs.docker.com/develop/develop-images/multistage- bu...](https://docs.docker.com/develop/develop-images/multistage-build/)

<comment><USER5> Ahh yes -- some of our dependencies are huge compiled C++ projects that need some customization.

We're starting to use multi stage builds here and there. Seems like an essential building block.

The main pain point seems to be knowing when an image needs to be rebuilt and to ensure any dependent images also get rebuilt.

</comment></comment></comment><comment><USER7> This Google Cloud Container Builder rebranded, which is a good thing. I've been abusing Container Builder as a general CI system for a while, I hope the rebranding indicates there will be more focus and feature development on general CI functionality.

</comment><comment><USER8> I have been using this for several years now. Great stuff! :) The only part that was missing from this was something that can update your deployments on image build. That's when I built Keel [https://github.com/keel- hq/keel](https://github.com/keel-hq/keel).

Basically, I have one trigger to always build from master but the rest are triggered by tag, for example, "1.2.5" and it builds the same image, then Keel updates affected workloads. So far I have never had to pay for it, apparently managing to stay in the free tier :)

Works way faster than automated Docker cloud builds either.

</comment><comment><USER9> I understand how great this is, but does anyone else get a little upset when GCP, AWS, and Azure are able to buy their way into a market and are pretty much guaranteed to hurt the small players in the infra tooling market?

<comment><USER10> I take it as a sign that the value bar keeps getting raised for small players to exist. CI is becoming so commodity that it doesn't really matter if you get it from Google or Codeship. If a slow-moving corporate machine can replicate what you do...maybe you need to move faster.

<comment><USER9> Understandable. I suppose as time goes on any product is going to be centralized among a handful of major players.

</comment></comment></comment><comment><USER10> I was really excited at first, but it's worth noting this does nothing for App Engine users. If you want CI there you still need to go to a third party. Disappointing considering how they're pitching this.

<comment><USER11> I know next to nothing about this, but there seem to be instructions on how to deploy to App Engine. See the App Engine tab under "Deploying artifacts" [1]. Is there more that's needed?

[1] [https://cloud.google.com/cloud-build/docs/configuring- builds...](https://cloud.google.com/cloud-build/docs/configuring-builds/build- test-deploy-artifacts)

<comment><USER10> Ah you're right. It was buried and non-obvious (to me).

</comment></comment></comment><comment><USER12> Nice, all CI should be per minute.

<comment><USER13> Why? I'd have thought CI is a place where per-second billing would be an advantage? A CI job is likely to take somewhere between 1 and 15 minutes, per second billing could be a significant saving for many users.

<comment><USER14> Sure that would be great, but the state of the art is actually worse. Some providers charge by concurrency limit, which means you're always paying for peak capacity.

<comment><USER15> Oh really?

I never really considered that. Perhaps it'd be profitable to actually use that capacity for something when it's idle...

</comment></comment></comment></comment><comment><USER16> I can't see any reason to favour this over Concourse.

<comment><USER17> I've been introducing Jason and Christopher from the Cloud Builder team to Concourse over the past few months. Jason & Co also developed Knative Build which closely tracks the Cloud Builder design.

I am hoping to see Concourse come in through the Pipelines proposal on Knative, but it will be necessary to digest a Concourse-on-Kubernetes epic first.

(Please come and sing the Concourse-is-amazing hymn with me on Knative, we both know it's for the good)

Disclosure: for those who don't know, I work for Pivotal and I'm a bit of a Concourse fan.

</comment></comment><comment><USER18> This is their container builder project re-branded.

Pretty nice product, but missing some LAUGHABLE features.

Specifically:

\- Ability to start builds based on github pull requests

\- Ability to send messages to slack on successful / failed builds

\- Ability to update github PRs with build status

\- Conditional build steps AT ALL

\- Ability to start parameterized builds from GUI ( What if I want to deploy to a specific environment? )

\- Any outside integrations AT. ALL.

\- No story on how to store secrets

I've been running this product for about a year. I have a Jenkins job that detects github PRs, and then launches these builds. I would LOVE to delete that Jenkins VM, but for some reason a lot of basic functionality has been ignored.

edit:

People have informed me that Github PR building is in alpha! PRAISED BE THE GOOGLE!

[https://cloud.google.com/cloud-build/docs/run-builds-on- gith...](https://cloud.google.com/cloud-build/docs/run-builds-on-github)

<comment><USER19> Hi, member of the Google Cloud Build team here. Appreciate all the feedback on the launch! Yes it's both a rebrand as well as an update.

When we first launched Container Builder a year ago we always had a plan to support more CI use cases. With the launch today we've added a few new features such as:

\- Built-in support for pushing non-container artifacts to Google Cloud Storage

\- Filepath triggers for invoking builds only on changes to certain subdirectories or files

\- Updates to the Cloud Console UI and of the Cloud SDK (from `gcloud container builds...` to `gcloud builds...`)

We have more updates in alpha now including built-in support for GitHub pull requests, status/Checks API support, and programmatic triggers, which we agree is one of the biggest missing pieces for many people. That GitHub app is the first step with more granular control over PR triggers coming soon.

We try not to comment on roadmap items but looking ahead a little, this rebrand is also an indication of the product's focus on broader CI/CD use cases, which many of our users are already using Cloud Build for, and an evolution towards bringing DevOps and Continuous Integration best practices to Google Cloud users. Feature requests like built-in conditional steps and notifications are on our radar and we always appreciate hearing from users what they'd like to see us prioritize.

Release notes are published here for anyone interested in updates on new features. [https://cloud.google.com/cloud-build/release- notes](https://cloud.google.com/cloud-build/release-notes)

There's a public Slack channel as well where GCB users and the Cloud Build team discuss features an different use cases. Happy to see anyone on there. [https://googlecloud- community.slack.com/messages/C4KCRJL4D/c...](https://googlecloud- community.slack.com/messages/C4KCRJL4D/convo/C4KCRJL4D-1532080823.000419/)

We appreciate all the positive feedback on the thread as well. We're excited about what's ahead for Cloud Build and that it's helping people be more productive!

<comment><USER20> Awesome to see this product getting more love! I'm looking forward to the Github status updates.

A few suggestions from my experience using the product for the last few months:

\- Setting the machine type on a per-step basis instead of for the entire job. For example, I'd like to use a large box to compile my scala, but can use a smaller one to test each package.

\- Showing the status of each step before everything ends.

\- Showing the elapsed time for a job on the page for the job in addition to the start time.

\- Failing a single step without stopping the build (for example, a single project in a ci build fails.)

\- Speeding up the web view (it's very frustratingly laggy when you have a significant logs in your build.)

\- Using the dataflow visualization for cloud builder.

\- JUnit support

<comment><USER21> Please change your username, which is misleading (makes think you represent Google Cloud Build in some capacity). @dang

</comment></comment></comment></comment><comment><USER22> How does the free tier work? Can you sign up so that you only use the free tier, and builds beyond the limit are queued for the next day or don't occur at all?

Or do you need to have a "card on file" to run the free tier at all, with the chance that you'll have to pay if you somehow exceed the free tier (stuck build, etc)?

</comment><comment><USER23> How does this work for booting up a database or other systems to run integration tests and such? I don't see anything about that sort of thing. Is the idea to bake everything into a single docker image and run that? Also, what are the resource limits (really, just interested in ram) for that listed price?

</comment><comment><USER24> Tried a simple curl cloud builder with passed in variables and it works pretty nice.

The only feature request I have is a way to mark variables as sensitive/secure and not show them in the build history step in plain text (mask the value) and change the input type from text to password.

</comment><comment><USER25> That console, though. Most players in this space seem to invest heavily in a very feature complete configuration GUI but in this case, there's absolutely nothing. Just a build history page and a small wizard to set up triggers.

</comment><comment><USER26> Is there any plan to make this a partner product ?

It's limited to 10 Concurrent Build for obvious reason, making it impossible for startup who want to create CI services on top of this product due to limitation.

</comment><comment><USER27> Does this replace traditional providers such as CircleCI or TravisCI?

<comment><USER28> It did for us, its really easy to create a trigger on a Github branch, run tests, build the executable, and deploy (in out case to k8s). Super quick builds too.

<comment><USER29> How do you deploy to k8s? Do you run kubectl from within cloudbuild.yaml, as an additional step at the end?

<comment><USER30> Yeah, just run kubectl from within your cloudbuild.yaml

[https://cloud.google.com/cloud-build/docs/configuring- builds...](https://cloud.google.com/cloud-build/docs/configuring-builds/build- test-deploy-artifacts#deploying_artifacts)

</comment></comment></comment></comment><comment><USER31> How are you able to build windows or ARM builds with only docker?

</comment><comment><USER32> I suppose re-enlivening build-bot is out of the question now?

</comment><comment><USER33> Do they have mac images for building with XCode?

</comment><comment><USER34> I can't wait until they discontinue it!

<comment><USER35> You know this comment has become a cliche?

<comment><USER36> So have the actual discontinuations

</comment></comment></comment><comment><USER37> The three most expensive words in software development are "Generous free tier"</comment>


Insanely fast server side rendering middleware for Express - <AUTHOR> https://github.com/YoussefKababe/serender <comment><USER2> This module essentially proxies requests on the fly using a headless browser and returns the rendered HTML.

This is quite a sneaky solution to some types of problem (and the module weighs in at an enviable 18 lines of code).

That said, I have a hard time how "insanely fast" is a reasonable claim.

<comment><AUTHOR> "Insanely fast" was borrowed from the project that Serender is based on, which is Zombie (an insanely fast headless browser used for testing client side code). Now of course, the speed of rendering depends on how fast your client side code is. If it has some ajax calls that fetch some really heavy data, the rendering can take few more milliseconds, but it's still fast because there is a very low network latency and your database is surely on the same network as your application, if not on the same server! I'm claiming that it's "insanely fast" because creating a new headless browser instance takes nearly no time at all, so the speed totally depends on your client side code.

<comment><USER2> Sure, makes sense. I guess it's the difference between 'fast' relative to other rendering methods and 'fast' relative to the actual work that's being done.

</comment></comment></comment><comment><USER3> Well If I write my code in a decent way, I wouldn't need to use that middleware.

Another thing that pops up in my mind is scaling. What happens if I have 200 request to my front page for 1 second?

<comment><AUTHOR> Yes, no one's forcing you to use that middleware of course! But saying that you don't need to use it because you can write decent code is seriously not a relevant reason. The idea behind this middleware is to provide a solution that works regardless of what front-end framework you use. Sure you can do it with decent code and handle fetching data and passing it to your templates yourself, but your decent code will probably work for one single framework, and maybe for just that single application you're working on, and it can get messy! Can you imagine now how much work and time this middleware can save you? Regarding your question about scaling, if your application can handle 200 requests per second, I think it will work just fine even when using this middleware. Expect seeing some benchmarks soon! Also, next versions will provide an option that lets you choose to render your pages only when the request is coming from a search engine bot or a social network scrapper.

<comment><USER3> Hey. Great reply. Kudos for that passion on your framework.

<comment><AUTHOR> Thank you!</comment></comment></comment></comment>


Thoughts on Matasano Security's Critique of Javascript Cryptography - <AUTHOR> http://log.nadim.cc/?p=33

<comment><USER3> So, first it should be noted that this critique (and the original article) are from 2011. Not a lot has changed since then, but it's worth noting. Secondly, I'm an ex-Matasano employee and still friends with tptacek et al; just throwing my potential biases out on the table.

Now, I don't agree with every single bit of the original article, but I disagree with just about every bit of this one. I'll go point by point.

>> "Any attacker who could swipe an unencrypted secret can, with almost total certainty, intercept and alter a web request."

> This problem is simply mitigated by deploying Javascript cryptography in > conjunction with HTTPS.

No, it's really not mitigated by doing so. Because the crypto code is coming from the server you're attempting to prevent cleartext access to, the trust model is fundamentally broken here. The server could easily throw down JS code that does not perform proper crypto operations, leaks keys, or any number of other things. And that's not even speaking of XSS and other attacks making it trivial for an attacker to compromise your data.

Edit (based on edited OP): > [...] it is possible to deliver web apps as signed, local browser plugins, applications and extensions. This greatly helps with solving the problem.

Correct, this does mitigate some of the issue. Namely, it allows the code to be reviewed as it is in use. However, the server can still push code arbitrarily and completely compromise the crypto, and XSS is still an issue.

>> "Secure delivery of Javascript to browsers is a chicken-egg problem."

> This problem, while serious, can be mitigated with the usage of browser > plugins that locally verify the integrity of the Javascript code, warning > the user should the code be faulty.

This is correct...ish. The problem is that it still gives too much trust to the server. The proper approach would be a browser plugin that exposes a Keyczar-style, high-level interface to JS crypto and allows secure operations on data without revealing access to the server.

However, this _still_ isn't enough. Take the case of Gmail adding GPG support for emails. Let's assume you have a perfectly secure plugin such as one I described above. Even in this case, the server-driven JS still could send unencrypted data from the DOM up to the server, before crypto operations have happened. The trust boundaries are _nonexistent_ here.

>> "Javascript lacks a secure random number generator."

> While Javascript does not ship with a secure random number generator, [...]

Let's just stop here. Doing a CSPRNG right is _hard_. Very, _very_ hard. Thankfully, browsers are starting to implement this as part of the browser directly, making it much less likely that JS code can skew results. This should be a solved problem soon, if it isn't already.

Edit (based on edited OP): They now mention the CSPRNG built into modern browsers. As mentioned, this is 99% a solved problem.

>> "Javascript cryptography hasn't implemented well-known standards such as PGP; such a high-level language can't be trusted with cryptography."

This is one point from the original article that I think is specious. If you have the proper lego blocks, you should be able to put together things like PGP securely. But those blocks don't exist.

> However, the ultimate problem with browser cryptography is that there is no > standard for innate, in-browser encryption. Very much like HTML5 and CSS, > there needs to be an international, vetted, audited, cross-browser standard > for browsers to be capable of securely encrypting and communicating > sensitive information. There's no denying the urgent need for such a > standard , considering the ridiculous rate in which the browser is becoming > pretty much the mainstream central command for personal information.

This I agree with. However, every approach so far has _really, really, really sucked_. See also: <https://news.ycombinator.com/item?id=4549504>

To do this properly, we need a standard for high-level crypto operations, which is incredibly hard to pull off, and we need sane trust boundaries to prevent the server from skewing operations and stealing data. I hope someone will get it right eventually.

Edit: Forgot to respond to one point.

>> "JavaScript's 'view-source transparency' is illusory."

> It is the case in every cryptography implementation that the implementation > will need to be reviewed by an expert before being declared secure. This is > no different in JavaScript, C, or Python.

There are a few issues here:

1) Generally speaking, the fact that JS source is pushed down on every access means that there's no way for you to actually review it.

2) Even if the crypto code is isolated and completely reviewed and found to be bulletproof, the trust boundaries are still screwed. C.f. the Gmail example above.

<comment><USER4> >The server could easily throw down JS code that does not perform proper crypto operations, leaks keys, or any number of other things.

(Not a legal advice, consult an attorney before following anything in this post).

There is important difference between "server _could_ send malicious javascript" and "server _does_ send malicious javascript". This difference becomes important when you consider the legal definition of the word "possession" - a service provider could be compelled (e.g. by a discovery request) to disclose information that he _has_ in his possession, but he cannot be compelled to disclose information that he _does not have_. Information encrypted in-browser before the data is sent to the server is legally never in possession of the service provider, whereas information that is sent to the server to be encrypted is legally in possession for that brief moment, and therefore is subject to being disclosed.

In an imaginary black-and-white world only the CIA-types with the torture tools and secret jails comes after the data, and they can compel the service provider to send malicious javascript to harvest the secret if they want to. In the real shades-of-gray world there are tons of people who want to get access to someone else's data and who have to abide by the law to do that.

<comment><USER5> I'm not so sure about that. See for example hushmail in 2007: <http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/>

While with this specific case here they intercepted the passphrase server- side, they specifically hinted that it wouldn't have made a difference with their java applet.

"The extra security given by the Java applet is not particularly relevant, in the practical sense, if an individual account is targeted"

<comment><USER4> Reading preceding paragraph to the phrase you quoted, the context implies to me they discuss whether architecture prevents hushmail from bugging java applet (it does not). They do not talk about whether they can be legally compelled to do so.

</comment></comment></comment></comment><comment><USER6> > "JavaScript lacks a secure random number generator."

> _This is in fact not the case. window.crypto.getRandomValues() is a secure > random number generator available in JavaScript, and supported by major web > browsers_

That url points to a page that has a big green warning.

"This is an experimental technology Because this technology's specification has not stabilized, check the compatibility table for the proper prefixes to use in various browsers. Also note that the syntax and behavior of an experimental technology is subject to change in future versions of browsers as the spec changes."

Note that having a PRNG available doesn't mean it's being used properly. (See Debian and OpenSSL)

<comment><USER7> In the footer it also says that neither IE nor Opera support the feature, and Firefox only added it in version 21, which was released less than two weeks ago.

</comment></comment><comment><USER6> Feynman's Cargo Cult Science talk is relevant here. (<http://www.lhup.edu/~DSIMANEK/cargocul.htm>)

> _But there is one feature I notice that is generally missing in cargo cult > science. That is the idea that we all hope you have learned in studying > science in school--we never explicitly say what this is, but just hope that > you catch on by all the examples of scientific investigation. It is > interesting, therefore, to bring it out now and speak of it explicitly. It's > a kind of scientific integrity, a principle of scientific thought that > corresponds to a kind of utter honesty--a kind of leaning over backwards. > For example, if you're doing an experiment, you should report everything > that you think might make it invalid--not only what you think is right about > it: other causes that could possibly explain your results; and things you > thought of that you've eliminated by some other experiment, and how they > worked--to make sure the other fellow can tell they have been eliminated._

> _Details that could throw doubt on your interpretation must be given, if you > know them. You must do the best you can--if you know anything at all wrong, > or possibly wrong--to explain it. If you make a theory, for example, and > advertise it, or put it out, then you must also put down all the facts that > disagree with it, as well as those that agree with it. There is also a more > subtle problem. When you have put a lot of ideas together to make an > elaborate theory, you want to make sure, when explaining what it fits, that > those things it fits are not just the things that gave you the idea for the > theory; but that the finished theory makes something else come out right, in > addition._

It's the same for crypto. This is where all the "don't roll your own" stuff comes from. Use stuff that other people have built, and other people have poked at.

Many people say that Javascript crypto is a bad idea. Considering the fact that people use cryptography to avoid being shot in the head by their oppressive government it seems irresponsible to dismiss any concerns about javascript crypto without doing rigorous testing.

</comment><comment><USER8> This post is technically correct in that Javascript could be used as the implementation language for a cryptography implementation distributed as a signed browser plugin[1]. However, that's really not the point - if you're going to have to distribute a browser extension/plugin anyway you could equally well use ActiveX (as is used for successful crypto implementations in East Asia) or the netscape plugin API and use whatever implementation language you like. The original critique was really talking about "Javascript cryptography" in the sense of "in-browser cryptography using javascript loaded the normal way browsers load it", which is and remains fundamentally broken.

[1] Although even then there are issues - e.g. with an interpreted/JITed language like javascript it becomes very hard to avoid timing attacks)

</comment><comment><USER9> Although we wrote this article informally in 2011, we stand behind it in 2013. I'd also add, in case Nadim was wondering who reads email@example.com, that I'm a Matasano founder and not an employee.

Don't build cryptographic features using browser Javascript.

</comment><comment><USER10> I can't wait until they get the flaws in JavaScript crypto ironed out so my "pure" Excel AES implementation can reign supreme as the worst implementation of a cryptographic primitive ever.

<comment><USER9> That's not going to happen: I endorse your Excel AES implementation immediately. If a pure spreadsheet AES works for your project, go ahead and use it!

</comment></comment><comment><USER11> _This is in fact not the case. window.crypto.getRandomValues() is a secure random number generator available in JavaScript, and supported by major web browsers._

Ironically, the page he's linking to mentions that the function is an experimental technology and the specification has yet to be stable.

</comment><comment><USER12> The worst problem nowadays is how to make sure that your HTTPS connection is not MITMed.

For most low to medium risk profiles HTTPS is safe enough. However in these cases in-browser encryption is rarely needed. For the threat model applications like Cryptocat faces, the danger for a targeted attack by someone with access to the CA infrastructure is not negligible.

So if can trust the server with your data, you don't need JS cryptology. If you can't trust the server, how can you trust the JS it sends?

<comment><AUTHOR> > So if can trust the server with your data, you don't need JS cryptology. If > you can't trust the server, how can you trust the JS it sends?

He address that with using chrome plugins and code verifiers. Not the ideal or most convenient solution obviously.

But you also can't assume the JS is hosted and delivered by the same server the data is being transmitted through. JS is extremely portable.

<comment><USER3> > He address that with using plugins and verifiers. Not the ideal solution > obviously.

As noted in the second point of my response in the root of the thread, this isn't just a non-ideal solution, it's a non-solution. It doesn't solve the trust boundary issues inherent here.

<comment><USER13> Aren't those trust boundary issues also present in every other piece of downloadable software, such as Tor for example? When you download a signed plugin, what's the difference from downloading Tor?

<comment><USER3> In theory, yes. There's nothing inherently more secure about Tor than an app running in the browser. _However_ , XSS attacks are everywhere, it's trivial for servers to shoot code down to the client to evaluate, etc. In practice, an app doing crypto on your desktop is fundamentally very different from a web app doing it, even if that's signed and isolated.

<comment><USER13> Okay. But XSS is class of bugs that has nothing to do with code delivery, and that is quite possible to mitigate. So overall, the problem of code delivery is still addressed to a notable (if not complete) extent with the use of downloadable signed browser apps.

<comment><USER14> Huh? Maybe I misunderstand what you're going on about, but if you can XSS in javascript, you can certainly change the meaning of even signed code - <USER2> hijack Object.prototype.constructor or similar.

<comment><USER13> That may very well be the case, but isn't this a solvable problem? Just like apps made in C need to be protected against buffer overflows, apps made in JS need to be protected against XSS. Both are reasonable threats that can be mitigated.

<comment><USER15> Consider the fact that XSS is some other part of the application that the reviewed crypto plugin JS is part of has an XSS in it.

Yes, but just because it can be mitigated doesn't mean that it is mitigated.

<comment><USER13> > Yes, but just because it can be mitigated doesn't mean that it is mitigated.

Sure, but I just want to point to the fact that this is a _solvable problem_. A lot of people talk as if it is some sort of insurmountable obstacle, whereas I think responsible programmers can solve it and move on.

<comment><USER3> You're arguing for a theoretical world, we're arguing from a practical one. I've spent enough time down in the trenches finding attacks in _extremely_ well-reviewed code, that adding a massive new attack surface is not a thrilling proposition.

<comment><USER13> Well, I guess you're just slightly more pessimistic and I'm slightly more optimistic. I respect your viewpoint, though. :-)

<comment><USER12> I'm a really optimistic type, really. Optimistic to the annoyance of some people. But in the case of security and cryptology there does not exist a choice between optimism and pessimism, but a choice between sharp eyed paranoia and wilful ignorance.

A defence is always only as strong as the weakest link, and an attacker usually has all the time in the world to find and exploit it.

Optimism has no place here.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> i could bother to read what nadim has written, but then i would fall in the "successfully trolled" bucket. i consider daeken very kind for reading and systematically disassembling nadim's post. instead, i will make a few rude blanket statements.

\- having a misleading wired article (or several) written about you in no way qualifies you as an expert on cryptography. anyone who has any level of knowledge in the subject knows this guy is a total hack.

\- everything that is somewhat correct about his products is due to people who _actually_ know stuff about cryptography telling him "no, no, no, you need to do X". the entirety of the architecture is effectively crowd-sourced. people telling you how to be a good carpenter is no substitute for being a skilled woodworker.

\- nadim should stop making crypto products because bad crypto _puts people at risk_. if you make one bad product, i can see chalking it up to "well, at least he's trying". instead, nadim has routinely and repeatedly demonstrated his lack of real domain knowledge.

i suggest nadim make some turd-like web 2.0/3.0 driven product where security doesn't matter. he clearly has the tenacity to code but lacks the intelligence and domain knowledge to make security-related software.

<comment><USER17> It seems to me that a fundamental problem in all software security systems is that you cannot necessarily trust the location where the software is deployed. Javascript has issues here, but I think it's a mistake to claim that anything but the instances of those issues is unique to javascript.

If you do not know if your system is already compromised, you cannot guarantee that using your system is without risk. And that's even before we get to people willing to break down doors and other such nastiness.

That said, these are not "crypto flaws" - these are flaws that exist in systems even if the math of the cryptography is perfect.

That said, there's something to be said for interacting with other people. And focusing on security risks while ignoring denial of access risks seems silly.

Anyways, my reading of the people writing here suggests to me that almost no one here is really serious about security. There's too much focus on trash talk and struggles with properly characterizing a now-non-existant version of a blog page not enough focus on useful security mechanisms for me to have learned anything useful.

One thing to keep in mind, though: everything that happens on the internet has visibility. So if some code is advertised as stable and it changes from day to day? Something is wrong. Similarly if I download the same code from two different machines and I get something different for supposedly stable code, something is wrong...

And, one of the nice things about open source browsers is that - hypothetically at least - anyone can take the browser and build it for themselves, with their own monitoring and tracking code. This can take time, and modern browsers seem to be updated almost as fast as they can be built, but they do seem to have internal APIs which are rather stable. (Other approaches are also possible - what I am describing here is an off-the-cuff variant tailored at some of the risk suggestion raised in other posts on the page where I am responding...)

Grey boxes and human readable documentation for the win...

</comment></comment><comment><USER18> Seems pretty straightforward: If you trust the server, then HTTPS is sufficient. If you don't trust the server, then you shouldn't be doing anything sensitive in the browser. If you ever _see_ the decrypted data, then obviously it's there in plain text on the page, and the server can just snap it out with one line of jQuery.

</comment><comment><USER19> Without going into the technical details described by other commenters here, this is my understanding of the problem (please correct me if I'm wrong): You receive the code that is run, from the same entity you should be protecting yourself from -- that being the Cryptocat server. This is a big contradiction.

One really should assume that if a service can be compelled to act against the interests of its users, that will eventually happen.

</comment><comment><USER20> Some people are happy letting their ego be in the driver's seat, and they do pay a price for it.</comment>


Having a big competitor doesn't have to be a disadvantage - <AUTHOR> https://medium.com/@CapitalOnStage/startupdate-2-having-a-big-competitor-doesnt-have-to-be-a-disadvantage-971d6bc4e16c <comment><USER2> Nice, let's see if they'll make it :)</comment>


Steve's Bio: Jean-Louis Gassées perspective - <AUTHOR> http://www.mondaynote.com/2011/10/30/steve%E2%80%99s-bio-a-personal-perspective/

<comment><USER2> Apparently Jean-Louis was one of the few people that stood up to Steve in Europe when he visited back in the 80s, and this earned him Steve's respect. Back then, Jean-Louis was in charge of Apple France and didn't cave to setting Steve's unrealistic sales forecasts for the Macintosh.

Later on, Sculley (then CEO of Apple) chose Jean-Louis to replace Steve as head of the Macintosh division (which the Lisa team was folded into). Steve would later reflect on Jean-Louis as a "terrible" bozo--probably because he thought he was betrayed by him.

One thing I did notice about Steve from reading Isaacson's book is that he categorized people into two camps. They were either bozos or heroes, and nothing in between. Either an idea was the most amazing thing ever, or it was utterly shit.</comment>


Scenes from Google Street View (2010) - <AUTHOR> http://9-eyes.com/ <comment><AUTHOR> Previous discussions:

[https://news.ycombinator.com/item?id=2270681](https://news.ycombinator.com/item?id=2270681)

[https://news.ycombinator.com/item?id=8445724](https://news.ycombinator.com/item?id=8445724)

[https://news.ycombinator.com/item?id=1904957](https://news.ycombinator.com/item?id=1904957)</comment>


Show HN: Premium Nature & Meditation Music Web App (my first solo project) - <AUTHOR>

>>>>> TimeForZen.com <<<<<
This took months to put together. Learning javascript, using the sound manager 2 api. Finding the perfect creative commons photos on flickr. It's such a ridiculously simple site (just a curated list of music) but I went through hell debugging and getting it to work. I learned an extreme amount.
My advice to designers who can't code, keep it simple, just get it done don't worry about optimization, don't worry about a backend. Code everything manually if you have to.
I've kept it simple out of necessity. I'm a designer, not a coder. I do front end html and css at most, so learning JavaScript was a big deal for me. Yes there's a million little things that can be added (like playlists, forums+comments, time tracker, accounts, etc... But I kept it simple so I could actually finish it.
The javascript is probably 4x the size it should be because I (lol) did things the long & sure way rather than the optimized way, but hey. It's works.
- I threw up a logo and the icons used in the session window. I'm not too crazy with the logo but it's alright. The icons bother me a LOT. They look unprofessional and need more work.
- There's a glitch I'm still working on. The sound LOOPS over and over for tracks that are NOT suppose to have looped sound.
- Works on Android and iPhones (glitch with absolute positioning and dom windows but sound will play).
- Can anyone test this on an iPad? I tried to do it at BestBuy but they never have wireless internet set up. <comment><USER2> Clickable: <http://timeforzen.com>

<comment><USER3> I tried on my iPad, but don't hear anything.</comment></comment>


Chromium on Linux replacing GTK+ - <AUTHOR> https://groups.google.com/a/chromium.org/forum/m/#!topic/chromium-dev/Zpu9801pPRc <comment><USER2> I recently bought a chromebook, and was surprised at how nice the user experience was. Tasks like opening tabs and loading pages seemed subjectively faster than doing the same on my 4GHz desktop. I also like how my attention was never consumed by irrelevant details like it always is in a desktop os.

In places where GNOME treats the user like an idiot by needlessly hiding useful functionality, Chrome makes specific tasks quick and painless. Surely, the fact that Chrome tries to do less, and benefits from a clean slate helps this, but there is still a very clear winner in this comparison.

I'd use it (chrome os) a lot if it had decent native text editing, and wasn't a botnet.

Hopefully a WM comparable in performance and UI design to Chrome's will be supported in GNU/Linux distros soon.

<comment><USER3> _" I'd use it (chrome os) a lot if it had decent native text editing"_

 _I 'd_ buy one or two for relatives if it had skype. Seems chrome is one feature/app away for a lot of people. Reminds me of this. [http://www.joelonsoftware.com/articles/fog0000000020.html](http://www.joelonsoftware.com/articles/fog0000000020.html)

<comment><USER4> I think as long as google voice / hangouts is competing for that position, it's unlikely. Skype for linux has historically been kind of a disaster, so I don't expect a chrome app effort from them either.

<comment><USER5> Skype works perfectly fine on linux natively and has for a while.

<comment><USER6> Only if you are just interested in texting. The sound support is outdated, unmaintained (and therefore, buggy) and has been for a while now.

<comment><USER7> I've found that even text chat is so buggy in Skype for Linux as to be almost unusable.

</comment></comment></comment></comment></comment></comment><comment><USER8> So they're replacing GTK+ with something called Aura. What is Aura? " _The goal is to produce a new desktop window manager and shell environment_ "¹. So they're doing another Unity?

1) [http://www.chromium.org/developers/design-documents/aura- des...](http://www.chromium.org/developers/design-documents/aura-desktop- window-manager)

<comment><USER9> I still don't get what Aura is, but thought 'Oh, are they creating XUL now?' instead. So far these design documents aren't enough for me to understand what this is _actually_ for.

<comment><USER10> They have their own compositor and uses a model based around Views (yes, similar to NSView / UIView).

<comment><USER11> So I don't have to work with HTML/CSS then? I seem to have a disorder which makes me dislike a separate language for layout/design than the one I'm writing the other code in. And although I do a lot of it and am good at it, I don't like HTML/CSS at all; I have not seen a real world case outside documents and informative sites (which are documents anyway) where I could not build a more robust (and a _lot_ faster) interface in less time in Cocoa with Objective C / C# / C++. No clue what is wrong with people trying to do everything in HTML/CSS. </rant>

Anyway; being lazy; so this is kind of a GUI layer on top of HTML/CSS?

<comment><USER12> This is nothing like XUL. It's just some abstraction layers written in C++. The hygiene from the Chromium side is that it allows us to share some code with abstractions we already have for the web platform.

Chrome UI on Windows, ChromeOS and soon Linux are comprised of a few layers:

Views (widget toolkit abstraction) - tabs, buttons, textfields, etc. Aura (window/"native widget" abstraction, event dispatching, what most code at layers above would consider to be the XWindow, except the XWindow is abstracted (and there is only one XWindow per top level browser window)) CC - (Chrome Compositor, also used for web content.)

They're all in native code since being able to drop down to the metal (& grab the app's toplevel XWindow) is often useful when building a desktop UI. HTML/JS/CSS binding to CC is limited to Blink.

<comment><USER13> Hi Ben, why is Aura not coming to OSX?

<comment><USER10> OSX users are perceptive enough about the nuances of cocoa that recreating all the UI quirks and what not is a huge undertaking. If I had my sanity intact, I would just stick to cocoa.

<comment><USER13> Aura doesn't attempt to recreate the UI quirks of the host platform.

<comment><USER10> Exactly my point. To not do so is a crime on osx.

<comment><USER13> How is it a crime on OSX and not on Windows or Linux. I'm not understanding your point.

<comment><USER12> I used to be more religious about this sort of thing... but the religion falls apart even on OS X when you realize that even WebKit implements its own copy of the native controls that can appear in web content - so that they can be transformed and animated using CSS.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Why don't they fix the issues with the current UI that _aren 't_ GTK+s fault before they go and ditch it and introduce a whole new world of pain?

As far as I can tell, Chromium on Linux has been useless on high DPI screens since its inception. On my 15" laptop at 1920x1080 (just 140dpi) the fonts on browser tabs, and the tabs themselves, are too small and cannot be changed. I simply can't use the browser because of this.

Firefox, which has its own abstraction layer but uses janky old GTK+2 under the hood, does just fine.

I really don't care about extreme OpenGL rendering (laughable, aren't most accelerations disabled already due to driver whitelisting?) or the tiny fraction of the UI that is noticeably GTK+

<comment><USER15> High-DPI support is coming with Aura (or, more accurately, being built _on_ Aura; it looks like the high-DPI stuff will come slightly later):

[https://code.google.com/p/chromium/issues/detail?id=143619](https://code.google.com/p/chromium/issues/detail?id=143619)

<comment><USER16> Great, but let's hope it doesn't start looking crap on regular DPI displays. You know, like those hipster websites that make your eyes bleed if you try to read them on anything other than a Retina display. "Most people I know use MacBooks anyway"

</comment></comment></comment><comment><USER17> It feels like a premature launch. When I got this from chrome-unstable a couple of weeks ago, it was a shock. Many styling problems, and widgets not working as expected. Some of the stuff that didn't work was pretty niche (e.g. horizontal scroll-wheels), so it's understandable nobody noticed it. But there's even stuff like central UI elements (tabs, the URL box) being rendered in some big, ugly and badly hinted font instead of the system font. Menu items having just insane amounts of whitespace, etc.

There might be good technical reasons for the change, but on a UX level it feels unfortunate :-( I still remember how nice it felt to switch from Firefox to the initial Chrome Linux alphas. It might have been missing major functionality, but at least it looked and worked the way I expected a Linux desktop app to work instead of having the UI be just a little bit off in a dozen places. I'm sure they'll get it to a 99% state soon enough, but getting that last 1% looks like it could be a challenge.

<comment><USER18> "premature launch"..."chrome-unstable".

This is not a launch. You are running the UNSTABLE build. What do you expect?

Stop treating unstable and testing software like it's stable. The clue is in the name.

<comment><USER17> I'm not treating it as it's stable, but it's what's going to be released as stable in a fairly short while given the Chrome release cadence. I was hoping that they were going to let this bake for a bit more before making it the default. This post makes it clear that they aren't going to do that.

<comment><USER18> Generally, unstable things that appear in unstable channel will only appear in stable 6 months later. That's plenty of time to iron out bugs.

Perhaps you should consider the beta channel?

<comment><USER17> I'm totally fine using unstable, thanks. The point is that this particular feature is going to be enabled by default in Chrome 35 on Linux, as per the submitted article. That's not going to be 6 months from now. What happens with unstable features in the general case isn't particularly relevant when we know what the plan is with this specific case.

</comment></comment></comment></comment></comment><comment><USER19> I found the last 2 comments in that thread ironic. One guy's asking why Aura is a window manager, and 'mike' says Aura is not a window manager, Ash is the window manager, but then proceeds to supply a link which has 'aura-window- manager' in the url! His link doesn't even mention the word 'Ash'.

</comment><comment><USER20> So they're making their own thing rather than using something widely tested and used like Qt?

<comment><USER21> They already made their own thing for Chrome OS rather than use GTK/Gnome or Qt/KDE there.

I find it sad that they felt the need to make their own UI engine vs being able to contribute the changes they feel they need to an existing project. I'm sure Google engineers will tell you that they need to move faster than they could working within the community of GTK or Qt. Plus they don't want Chrome OS to suck because they can't get features merged by the community. They are valid points. The resulting fragmentation just sucks.

I assume Aura is open source. Given GTK's dropping adoption rate and a lot of people unhappy with the recent direction (design or lack of listening to current user base) of Gnome how long until someone writes a general purpose (not specific to Chrome OS) window manager/desktop environment on top of it?

<comment><USER13> I don't see that ever happening. Google does a lot of reinventing the wheel with their projects and most of it is not built in a way that is easily useable in downstream projects, and they probably won't accept patches anyways. Chromium OS, for example, could have been forked and used in a lot of cool ways but that hasn't happened yet and I doubt it will.

<comment><USER22> > Chromium OS, for example, could have been forked and used in a lot of cool > ways but that hasn't happened yet and I doubt it will.

Well, there's CoreOS, though the end result is rather different.

</comment></comment></comment></comment><comment><USER23> Google knows that the Open Source development process while nice and warm and fuzzy, can get in your way when you don't own the entire development of the project - especially if this is a product that can impact your revenue. Others can arbitrarily (sometimes with good reason) block your feature pushes and slow down your product releases. They did the right thing forking webkit, keeping Android/Chromium in-house, and are doing the right thing here. - IMHO.

</comment><comment><USER24> All seem to leaving GTK+ behind.

<comment><USER25> GTK+ looked old in 2003. Hasn't gotten better (Stares at XFCE).

<comment><USER26> What? I think it looks better than ever [http://i.imgur.com/PJdqYfT.png](http://i.imgur.com/PJdqYfT.png)

<comment><USER27> duude - what theme is that ? and what CSS skin for HN are you using ?

<comment><USER28> I don't know about the gtk theme. Possibly part of the ElementaryOS project?

The HN skin is actually a Chrome extension called Hacker News Extension Suite.

[https://chrome.google.com/webstore/detail/hacker-news- enhanc...](https://chrome.google.com/webstore/detail/hacker-news- enhancement-s/bappiabcodbpphnojdiaddhnilfnjmpm?hl=en)

</comment></comment></comment></comment></comment><comment><USER29> debs/rpms: [http://www.chromium.org/getting-involved/dev- channel](http://www.chromium.org/getting-involved/dev-channel)

</comment><comment><USER30> Hopefully this finally means retina display (HiDPI) support for Windows builds - currently Chrome is almost unusable on all high-res displays on Windows.

</comment><comment><USER31> It would be interesting to hear why they didn't pick something like Qt.

<comment><USER32> Perhaps to control their own destiny? They don't need that many controls. Only buttons, tabs and text boxes.

<comment><USER13> How does using an open-source UI framework surrender control? Seems far more likely NIH is the answer.

<comment><USER32> Qt is not truly open source for other platforms though is it?

<comment><USER13> What do you mean "other platforms"? Qt is GPL, or am I wrong?

<comment><AUTHOR> Although you are technically wrong, it is LGPL, you are right. It is dually- licensed, but it doesn't vary according to the target platform.

</comment></comment></comment></comment></comment></comment><comment><USER33> Some bugs for several years finally fixed. Still no HiDPI support.

</comment><comment><USER34> I wonder if this will include the GDK+ used for the webrtc demo app. Probably not, but one can hope, that sample app is super buggy.

</comment><comment><USER35> Is aura another competitor for mir and wayland ?

</comment><comment><USER36> Thank god it is not Qt (following Ubuntu insanity) but something sane, small and good enough.</comment>


World Wide Web (1992) - <AUTHOR> http://info.cern.ch/hypertext/WWW/TheProject.html <comment><AUTHOR> There's a 26+ year old bug in the markup at the end of the source code (The extra ):

 Getting the code by
      anonymous FTP , etc.</comment>


Apple and SAP Team Up for Blockbuster Partnership - <AUTHOR> http://fortune.com/2016/05/05/apple-sap-partnership/ <comment><USER2> A match truly made in Hell.</comment>