Why I'm not a React Native developer - <AUTHOR> https://arielelkin.github.io/articles/why-im-not-a-react-native-developer.html <comment><USER2> This article raises so much unfounded FUD it's hard to believe the author is serious.

1\. Uncertain Roadmap - Does anyone seriously doubt FB's commitment to RN? When they themselves dogfood it? Or is it more likely they are just too busy making progress (since as the author points out they release every 1-2 weeks) to release a multiyear ROADMAP?

2\. Patents - Is anyone here planning on suing FACEBOOK? Who amongst us has the team of lawyers to undergo that? This is for 99.999% of people not a legitimate concern. This is an RMS concern.

3\. Javascript - New versions of Javascript address the vast majority of this. Type errors? Use well supported Typescript or Flow

4\. Dependencies - This is a result of the Javascript communities overly enthusiastic packaging efforts. This is not an apples to apples comparison, but of all the cons mentioned, sure this is legit.

5\. Alternatives - ...and Windows Phone? Seriously? I was rooting like hell for MSFT, but this is just not a thing. I'd rather cover 99.6% of users twice as fast than 99.999 of users painfully using Appcelerator

<comment><USER3> > Does anyone seriously doubt FB's commitment to RN? When they themselves > dogfood it?

After the shutdown of Parse, I don't see how anyone could avoid having doubt about Facebook's commitment to React Native, or to anything else outside of their core business.

<comment><USER4> Parse was never used internally at Facebook I don't think. React Native is used for major parts of the main app and in parts of Instagram. I don't think it's an apples to apples comparison.

<comment><USER5> Where's your proof?

The FB app uses RN for very esoteric and small portions of the flows. It has 230MB (at least) of compiled binary.

Instagram also uses it minimally, mainly to replace what used to be webviews.

Those are not "major parts".

<comment><USER6> It's used in Marketplace.

[https://facebook.github.io/react- native/blog/2017/08/07/reac...](https://facebook.github.io/react- native/blog/2017/08/07/react-native-performance-in-marketplace.html)

</comment></comment></comment></comment></comment><comment><USER7> OK, this isn't really important for the quintessence of the article. But I'm surprised again and again how many developers write code like

      if (weAreConnected === true) {
          this.setState({
            isConnected: true
          })
        }
        else {
          this.setState({
            isConnected: false
          })
        }
      }

instead of

      this.setState({
        isConnected: weAreConnected
      })

<comment><USER8> What if `weAreConnected` is `null` or `undefined`?

WalterSear's solution solves the issue since both `null` and `undefined` would become `false`:

        this.setState({
            isConnected: Boolean(weAreConnected)
        })

but in your case you could set `isConnected` to `null` or `undefined`

so if later in code someone makes the mistake of writing:

        if (this.state.isConnected === false) { /* do stuff */ }

they could have a bad surprise.

<comment><USER9> this.setState({ isConnected: !!weAreConnected })

<comment><USER10> Ding ding ding right answer. This is the way most senior javascript devs would right it.

<comment><USER11> They'd right it if they were fixing it or write it if they were writing it ;)

</comment></comment></comment></comment></comment><comment><USER12> I'm really glad to have read this article as it actually solidifies my comfort with using React Native since it seems like a well thought out list of reasons not to use React Native, and now I know that none of them really matter that much to me.

The three main disadvantages of React native brought up are:

\- lack of commitment from Facebook about maintaining it for a long time. This one is the most bothering to me but it's not a dealbreaker.

\- doesn't like Javascript and its related ecosystem. This doesn't bother me in the slightest, I love modern JS.

\- the whole all your patents are belong to us thing that comes up every so often. I'm not a startup founder or a lawyer so I will leave such concerns to them. If my employer wants to let me develop in React, all the better for me.

<comment><USER13> I'm curious, what do you love about JavaScript?

<comment><USER14> Probably that he knows it and doesn't know Swift.

<comment><USER5> What kind of a reason is this? "Ignorance is a bliss."

<comment><USER15> The point was probably that someone with a good knowledge of one language and little or know knowledge of another favors the one they already know.

There are plenty of people who are quite happy with what they have, and they see no reason to change. Then there are people (thankfully) who are never satisfied and who keep progress rolling.

<comment><USER5> > Then there are people (thankfully) who are never satisfied and who keep > progress rolling.

 _"Here 's to the crazy ones. The misfits. The rebels. The troublemakers."_

</comment></comment></comment></comment></comment></comment><comment><USER16> So, you'd rather use Xamarin than React Native, in short. Xamarin has excellent tooling and arguably works with saner languages (with better type systems), but _it doesn 't work on GNU/Linux_. We're using RN right now, since it allows us to use ClojureScript, which means we can share code between our Clojure sever and our client. This means we're limited to the JS environment though, which means no good access to multi-threading and a really wonky target language. Performance implications aside.

If Xamarin worked on GNU/Linux, we likely would've built our app using it and F#. Until it comes to the Linux world and stops doing things the MS way (open sourcing is a good start), Xamarin is going to be missing out on a number of developers.

<comment><USER5> There is Mono on Linux, and it works quite alright. Xamarin can be made to work with Linux, it's jut not officially exposed in the UI by default.

<comment><USER16> Xamarin and Mono are not the same thing. Also, Xamarin Studio may work through WINE or something similar, but it doesn't have any native GNU/Linux builds.

</comment></comment></comment><comment><USER17> I think people should be paying more attention to the core concept of React Native, which is having a view layer that is completely native and a bridge that connects to a javascript engine. People bitch about electron which is essentially a browser in an app window (React Native is NOT that), the concepts of React Native solves a lot of the performance problems of Electron, which I think the electron team should seriously consider implementing.

<comment><USER18> > I think people should be paying more attention to the core concept of React > Native, which is having a view layer that is completely native and a bridge > that connects to a javascript engine.

That is indeed pretty awesome, but wouldn't it be even better were it a better language than JavaScript being bridged to? I'm thinking Lisp, or Python, or TCL, or pretty much anything other than INTERCAL or JavaScript.

<comment><USER19> Out of the languages you mention, I'd still pick JavaScript + typescript

</comment></comment></comment><comment><USER20> TL;DR: "react native sucks because javascript". So much else I wanted to know from an experienced iOS dev, like:

\- How is perf in a large app with lots of network IO? \- How does animation/ transition fit with reacts render loop and how does it perform, especially during network IO? \- How much is lost from not being able to do multithreading? \- How hard is it to achieve the last 20% fine tuning of feel and perf? \- How much flux is the community driven deps typically causing? \- Is memory management an issue? GC stutters, leaks? \- Do some UI parts simply not scale well enough, requiring native code instead? e.g. infinite scrolling, charts, complex transitions? \- How mature is the tool chain? Build time? \- Frequency of breaking changes from core? from common deps? Cost of staying up to date?

Developing in JS, with all the pros/cons of the JS language, is the very premise of the react native deal. Most issues raised would apply just as well to any web app.

</comment><comment><USER21> The example with the Person class suggests that the author is unaware of JavaScript getters:

      class Person {

        get isImmortal() {
          return false; // noone is immortal
        }

      }

      p = new Person();

      p.isImmortal

      // >>> false

      p.isImmortal = true;

      p.isImmortal
      // >>> false

I mean, even plain untyped JavaScript can do _that_!

<comment><USER22> You're missing the point. The fact that the language still allows you to write `p.isImmortal = true;` is the issue.

<comment><USER19> And my linter, or flow, typescript will pick that up in the same way the compiler will. Just because tooling these days catches these things in 'type safe' languages doesn't mean it's not a pointer to a chunk of memory that's defined at runtime beneath it all.

</comment></comment></comment><comment><USER23> NaN !== NaN is not a JavaScript thing, it's a IEEE754 standard thing.

The bulk of the gripes about JavaScript are entirely fair, but I'd think that most people who use React Native would be aware of them already?

</comment><comment><USER24> This article is definitely FUD, there are a few irritating things about React Native, but I think it's still far preferable to native development for most apps.

I'll list the annoyances:

\- npm is a mess, and many libraries in the ecosystem handle sub-dependencies improperly. Facebook has contributed to yarn but has not established a very clear contract for what a properly organized package should be. Thus it is not possible to easily determine which package or sub-package, or sub-sub package (etc) is misbehaving. I estimate that this issue has eaten up easily 10% of the productivity gains that React Native has offered. Facebook generally ignores the github issues about this stuff, in spite of hundreds and hundreds of users having these issues.

\- Updating to a newer version of React Native is cumbersome. There is a utility called react-native-git-upgrade which often fails to reconcile changes in the ios-specific configuration files. Much of this is due to problems with XCode (not sure how anyone tolerates using that). Compared to simple makefiles XCode's system that react-native interacts with is horribly brittle.

\- Important libraries are not embraced by Facebook. Things like camera support are not included in React Native's scope, so third party libraries exist, yet often lag because the developer can't make time to keep up with pull request. Facebook should hire the top 15% of community contributors to maintain those projects in-house. Right now probably 30-50% of community libraries are not compatible with the latest stable React-Native. Facebook should realize that library maintainers do not have enough time to properly maintain these libraries and should offer more support and guidance, not to help the maintainers as much as to help people trying to use open source libraries from the community.

\- Some of the React Native code is pretty ugly. A few times I've had to debug issues and some of it looks like it was written very rapidly and could use a refactor for clarity and ease of debugging. Not the core algorithms stuff, just the bundle management stuff.

But in spite of all this I'd still use React Native on a new project. Most apps that aren't strongly architecture-driven could be written in a day or two. It's pretty amazing.

</comment><comment><USER25> Our legal team at work (an e-commerce player with 9-figure revenues that's raised 8-figure rounds over the years), are currently looking at React's PATENT clause.

There is a dependency tree here around whether you currently (or plan to in the future) have any patents. If you don't and you never do, then how can Facebook infringe it in a way whereby you'd want to sue?

And then there is the cost of suing. We seem to be reckoning it would cost around $1m to start a serious action against FB, so what does the cost of replacing React look like in that sort of scale? We've costed that, in broad strokes.

So on paper, it all looks like we're fine, right?

But...

But...

Here's where they take pause:

      The license granted hereunder will terminate, automatically and without notice,
      if you (or any of your subsidiaries, corporate affiliates or agents) initiate
      directly or indirectly [...]

Subsidiaries? We don't have any of those.

"Corporate affiliates"? What does that mean? Oh, it's anybody who owns at least one share in us, or we own one share in them.

Wait. What? We have business angels, founders, multiple VC firms and other investors. Do any of _them_ have patents that Facebook might infringe on? What about future investors or people who we might want to be acquired by? Could we have an acquisition blocked because the potential buyer has a war chest of patents they value?

And "agent" means external law firms too, right? So if any of the companies we use for advice on an on-going basis get involved in any patent action, what does that mean for us?

Suddenly it becomes this huge sprawling mess. Risk aversion is important when you're dealing with a company that is already carrying a 9-figure valuation.

We're trying to find a way around it. As an engineer I brought it up with Legal because I want clarity for colleagues and myself: we want a green flag.

Unfortunately, in doing that, we may have brought enough scrutiny to it that they are going to tell us to stop using it.

If/when that happens we'll talk about it and share that information.

In the meantime, we continue to use it, but we're doing so with caution, and we accept there may be a re-tooling cost.

<comment><USER19> Microsoft uses React on office/outlook.com and they're much bigger than you

<comment><USER25> 1\. They have more money too, they can afford to take risks 2\. They probably already have a patent agreement in place with FB not to sue each other 3\. It's perfectly possible nobody in MS has had this actually cleared with their legal team. You can't assume they have.

</comment></comment></comment><comment><USER14> Is it not true that a cross platform system necessarily results in an application that is the lowest common denominator in terms of devices? How does React Native work with ARKit for example? How does React Native take full advantage of the hardware if it has to be cross-platform compatible?

The Facebook iOS app is slow, bloated and occasionally glitchy. A company like Facebook seriously doesn't have the resources to make Android or iOS native applications? Because React isn't "native."

<comment><USER26> > How does React Native take full advantage of the hardware if it has to be > cross-platform compatible?

It's easy enough to add a native module to address specific hardware -- so easy in fact that you can usually find one already done (ARKit for example: [https://www.npmjs.com/package/react-native- arkit](https://www.npmjs.com/package/react-native-arkit)). As with all 3rd party library use you have to do your due diligence of course.

The more of these you use, the less 'cross-platform' your code becomes. If there's enough similarity in hardware between platforms, you might write (or find) a react-native library offering a javascript/RN API that addresses native apis under the hood. This is done with animation, for example.

> A company like Facebook seriously doesn't have the resources to make Android > or iOS native applications?

I'm can't imaging they don't have the resources, and know nothing about FB or its motives. But if I was managing a large cross-platform app, I'd definitely want the largest number of developers I possibly could have communicating via a commonly understood codebase, rather than via meetings and specs.

</comment></comment><comment><USER27> A problem is the author doesn't seem to care that much about portability, how can you even say that Swift is an alternative to RN?

Was curious about counter arguments and came upon this : [https://medium.com/@reicheltp/dev-diary-4-why-i-left- xamarin...](https://medium.com/@reicheltp/dev-diary-4-why-i-left-xamarin- behind-35817ccd07b2)

A little old but I think I prefer RN's disadvantages over Xamarin's

<comment><USER28> [http://www.elementscompiler.com/elements/silver/](http://www.elementscompiler.com/elements/silver/)

</comment></comment><comment><USER29> >There is a const operator, which helps ensure primitives don't get mutated. But anything that's not a primitive is as malleable as jell-o

Making so many errors in a sentence about basic language features, when a big chunk of OP's article is argumenting that React Native is bad because JavaScript is bad... Maybe it would be less bad if OP actually learned the language?

<comment><USER12> >Mutating a primitive

Makes me picture some language where you write "1 = 2" and from then on in your code all 1's are 2's.

</comment></comment><comment><USER30> Could be a bit off-topic here and I hope that my tone is not extremely negative, but why is there a constant "Why we/i/should are/am/should _insert possible negation_ _insert a random action_ and why should you" trend in the professional blogs (not saying this author does the why should you part)? Titles are getting hideous and repetitive. I sincerely hope that this tone could be changed to something more meaningful/technical/constructive rather than listing things why you are or you are not doing something (while this author definitely goes into detail).

I definitely endorse freedom of speech and thought, but unless one is a vetted expert in the matter, one should avoid making these blog posts. I'm not the best chef in the world and I do things a certain way, but I do not go around the world telling people that they should do it my way.

<comment><USER31> Technical blog titles considered harmful? :)

</comment></comment><comment><USER32> I found funny to say Javascript moves slowly when a lot of people is using async/await, generators, destructuring, etc… _everywhere_ right now. And then it dismisses Flow and even Typescript right away, yeah sure…

And the conclusions seem to favor Phonegap, really? Xamarin might not be that bad but doing really nice UI on both platforms require two separate projects (or modules at least).

My bets are still on Javascript :)

<comment><USER5> Right, much better to have a terrible UI on both platforms using React Native. A great bet.

If you insist, you can use Xamarin Forms and have an equally terrible UI on both platform as RN.

<comment><USER33> idk, maybe try not building a terrible UI?

</comment></comment></comment><comment><USER34> Title should have been —Why I dislike JS as a Programming Language instead of swift—

<comment><USER15> Plus the patent worries - that to me was the other big takeaway.

</comment></comment><comment><USER35> Xamarin is given as an example of a better alternative why exactly? You develop a single layout in React Native, while in Xamarin you just share the C# code, so separate platforms need separate UI code (unless you want to rely on their weak Xamarin.Forms API), and at that point you can just write common code in C or C++ and not rely on any third party. It's hardly comparable.

<comment><USER5> You can use Xamarin forms if you insist on sharing the layout and have a terrible lowest common denominator fisher-price UI.

</comment></comment><comment><USER36> I come from a bit old school, C world, so excuse the naive question. Is it possible to build both a desktop (Linux/MacOS/Windows) and mobile (tablet and phone, android and IOS) application from same codebase (with slightly different codepaths for UI specifics) with React Native or something similar? I see Xamarin is almost there, but no Linux.

I have a need for an app that is mostly word-processing oriented in nature with some interactive graphing and drawing, some displaying, creating and drawing on top of PDFs too. I'm looking for easiest path to create something crossplatform AND performant (and possibly easy on the battery).

<comment><USER37> Why not just go with C++? You'd still need UI code specific to Android, iOS and Qt, but you could keep your logic layer shared between all of them.

<comment><USER26> As a freelance developer at the low end of the market (ie. where most apps and developers live), I can assure you that the logic layer is usually so small that the benefits of making only it cross-platform would be minimal. Most of the code in most of my apps is UI code. RN saves me roughly 80% compared to two entirely separate native codebases. A cross-platform business logic core saves me perhaps 20%.

<comment><USER37> Sure, I agree for a greenfield social/mobile/local mobile app, RN makes a lot of sense.

> both a desktop (Linux/MacOS/Windows) and mobile (tablet and phone, android > and IOS) application from same codebase... word-processing oriented in > nature with some interactive graphing and drawing, some displaying, creating > and drawing on top of PDFs

... definitely doesn't fit that description. At that point, your choices are JS with RN, React and Electron or C++. For custom graphics rendering and editing, JS would be a very odd choice.

<comment><USER36> C, that is more C++ kind of is my choice (QT namely). I was wondering if there is a faster approach with JS, since I don't care about what I work with in this case, as long as it doesn't take me much time to do it. Xamarin seemed like a good direction, but no linux yet. Electron, while heavy, seemed like almost a perfect choice - but no mobile.

</comment></comment></comment></comment></comment><comment><USER38> Honestly the only big plus for React Native is that it allows to make both iOS and Android apps at the same time. This is huge. I wrote one app and I'm writing second one and I can't say that it's something particularly better than Objective C, for example. May be for very big apps React would win, but for small and moderate apps I feel that React doesn't provide a lot of advantages, but, again, having to write 2x less code is just huge. I don't know Android at all and I released Android version.

</comment><comment><USER39> The patent stuff doesn't seem very important to me. You might not like it in principle, but I don't think it's going to affect you.

The author mentions Flow as a typing solution to solve some of the problems with Javascript development, but didn't like it because you can still write code that crashes if you ignore the warnings. They also complained about the lack of immutability, and mentioned Immutable.js, but weren't happy with that. They went on to say that most of these problems they mentioned are already solved with libraries, but ... libraries are bad? I didn't really pay attention to the huge Javascript rant in the middle, but I've heard it all before, and I totally disagree. I've started to realize that I prefer ES7 Javascript with Flow or Typescript, jest, babel, webpack, etc. I think I actually enjoy writing it more than Ruby or Swift.

I really like react-native-web [1]. I've used it to build an app that runs on all mobile devices (iOS, Android, Windows Phone), as well as on the web. There's a lot of quirks and workarounds, but it was actually a lot easier that I expected. Even if you just use plain react on the web, it's easy to write re-usable components and code.

They also mentioned hot reloading. If I wrote an article titled "Why I'm a React Native developer", the content would just be the words "Hot reloading." I spent a year developing a native iOS app with Swift, and I never want to go back to waiting for my code to compile.

[1] [https://github.com/necolas/react-native- web](https://github.com/necolas/react-native-web)

<comment><USER40> Unfortunately "I don't think it's going to affect you" is not a strong legal argument and it's hard to dismiss legal risks that so many other companies are taking seriously. I do like React, but the legal uncertainty is a significant downside.

</comment></comment><comment><USER41> Clearly, that guy despises javascript with a passion. He should get a job that doesn't require him to ever come in contact with javascript.

</comment><comment><USER42> Shorter than the React code, I'm not seeing a big win other than the need for an explicit render() in didSet, which also allows for more fine-grained control if needed.

      class ViewController: UIViewController {
        let indicatorView = ConnectivityIndicatorView()

        override func viewDidLoad() {
          super.viewDidLoad()

          indicatorView.frame = CGRect(origin: CGPoint.zero, size: CGSize(width: 20, height: 20))
          view.addSubview(indicatorView)
        }
      }

      class ConnectivityIndicatorView: UIView {
        var isConnected: Bool = false {
          didSet {
            render()
          }
        }

        override func didMoveToSuperview() {
          super.didMoveToSuperview()

          isConnected = arc4random()%10 > 4
        }

        func render() {
          backgroundColor = isConnected ? .green : .red
        }
      }

<comment><USER43> Here's a more canonical version of the exact same logic in react:

        const Root = ()=> <ConnectivityIndicatorView/>

        class ConnectivityIndicatorView extends Component {
          state = { isConnected: false }

          componentDidMount() {
            const isConnected = Math.random() > 0.5
            this.setState({ isConnected })
          }

          render() {
            const backgroundColor = this.state.isConnected ? 'green' : 'red'
            return <View style={{backgroundColor, width: 20, height: 20}}/>
          }
        }

And here's how I would actually write it in my own app:

        const Root = ()=> <ConnectivityIndicatorView isConnected={Math.random() > 0.5}/>

        const ConnectivityIndicatorView = ({isConnected})=> {
          const backgroundColor = isConnected ? 'green' : 'red'
          return <View style={{backgroundColor, width: 20, height: 20}}/>
        }

</comment></comment><comment><USER44> > In JavaScript, functions don't have a return type, you don't know what can > be returned by the function

Do engineers actually depend on the compiler to save their ass and don't bother looking up in the documentation or reading the source code to see what a function returns !? No I don't think so. There's a saying that every bug that ever existed in a static typed language actually _did_ pass the type checks. If the compiler finds a bug it's rather _luck_ that the two parameters passed in the wrong order was not both of the same type, and not because of better language design. If you don't know what a function returns, you can say "bad documentation", or "bad code", but don't blame it on the language.

</comment><comment><USER45> (Disclaimer: Using RN in production) The author listed some very legit points that RN is lacking and I share the same pain or complaints. You can beat up any tech with its shortcomings and that will be a good read. But arriving at a conclusion that something unjustified is better is logically flawed.

</comment><comment><USER44> > What's nothing?

I know the == operator drives people crazy sometimes, and you are told to use === but if you actually understands what == does it's a _convenience_ that null==undefined so you don't have to type if(foo == null || foo == undefined). You could argue that having two (or with false it's three) types of "nothing" is confusing, but for me they mean different things. undefined means it has not been defined, null means it explicitly "nothing" and false means it's "not true". And _for convenience_ you can write if(foo) to check for them all.

</comment><comment><USER46> Is it true that React Native cannot be integrated with an existing Swift/Obj-C codebase?

For example, say that you want to implement login/register on top of an existing Swift codebase. This is possible, right?

(May not have understood OP correctly.)

<comment><USER26> It depends what you mean 'on top of'. If you mean adding some RN to an existing app, that is conceptually easy but practically quite messy ([https://facebook.github.io/react-native/docs/integration- wit...](https://facebook.github.io/react-native/docs/integration-with- existing-apps.html)).

If you mean adding native modules into an essentially RN app, that's practically very simple ([https://facebook.github.io/react-native/docs/native- modules-...](https://facebook.github.io/react-native/docs/native-modules- ios.html)) but still requires some conceptual care (like any API design).

</comment></comment><comment><USER47> dude lost me after pointing about IDE. Wtf, this is not an advantage. This sounds like a "microsoft" arguments. You want to compare productivity? Have you seen how many ready-to-use components there are in RN community? This is the real productivy advantage, not an IDE.

But I aggree with all the problems of javascript, they were my excuses to not learn javascript, and here I am, writting RN apps. Things happens in RN world man, you gotta move to the winning side and leave your pride. Get over it.

</comment><comment><USER44> In JavaScript it's only the primitive objects (Number, String, Boolean, null, undefined) that are "by value". Everything else is "by reference". And when you write {foo:1} you create a _new_ object. So it's logical that array.includes({foo:1}) is false. You can however point {foo:1} to a variable, and then use that variable as a reference, eg. var foo = {foo: 1}; array.push(foo); array.includes(foo);

</comment><comment><USER48> Why is it that we have to bring web technologies to the native platforms rather than using native platforms on the web?

<comment><USER49> The web is open, standardised, has the mindshare and the runtime (browser) is everywhere. There have been initiatives to bring e.g. Qt or GTK to web, but no success AFAIK.

<comment><USER48> Yeah you're right. Open standards makes sense.

It's a shame that no one takes something like the old Android codebase and makes it for web in the canvas. Is that even possible?

</comment></comment></comment><comment><USER44> You can laugh at JavaScript because of all the fun and stupid things you can do with it like writing entire programs with just {[( but with meta programming and operator overloading that is common in many "serious" languages there are even more "WTF" possibilities.

</comment><comment><USER11> tl;dr: I really don't like RN and wasted a ton of time trying to talk people out of it for mostly unfounded reasons that won't affect 99% of users in any meaningful way.

</comment><comment><USER50> If you want immutable data structures with React/React Native learn Redux with Immutable.js, it has a learning curve but will solve some of your problems

</comment><comment><USER51> When i move to RN, Swift 3 is very slow on build time. Xamarin not support instant run. So i move to rn, although it feel not complete product</comment>


Amazon Said to Mull Whole Foods Bid Before Jana Stepped In - <AUTHOR> https://www.bloomberg.com/news/articles/2017-04-11/amazon-said-to-mull-bid-for-whole-foods-before-jana-stepped-in?em_pos=small&ref=headline&nl_art=0 <comment><USER2> I would like to see a UPS-Walmart or FedEx-Costco merger. And the reason I'd like to see that is to restore some competitive balance to the retail marketplace. I say this as a frequent Amazon customer, concerned about the long term.

<comment><USER3> I'll be worried about a potential Amazon monopoly if they keep increasing market share for the next 20 years. But I don't think that will happen -- the Internet seems to have a way of shaking even apparently unassailable monopolies on very short timelines.

As a personal example, I've already moved a lot of my purchasing from Amazon to AliExpress. For anything small, fairly cheap, and that I don't need this week, I search AliExpress first. Quality can be uneven and you sometimes have to read between the lines on the reviews, but you can often find items identical to those on Amazon at 1/5-1/10 the price (eg. I just bought 3 sleeved baby bibs on AliExpress for $1.80/ea -- the going price on Amazon seems to be $16).

<comment><USER4> With RadioShack going under, AliExpress is my goto for basic electronic components, but it can be painful when you need to wait 3 weeks for a new part to arrive.

But I don't like how Amazon because of how they treat their workers. Maybe the engineering positions are awesome, but warehouse workers and deliverers seem to be worse off than a Wal-Mart employee 10 years ago

<comment><USER5> 3 weeks for electronic components, you have extreme patience, I would have mostly given up on the project if that much time elapsed.

<comment><USER6> It's a temporary hit. I get around that problem by purchasing 10x what I need. Prices are so low that it's not an issue.

And realistically, I may not have gotten back to the project in 3 weeks even if the parts were already on hand.

</comment></comment></comment></comment></comment><comment><USER7> It would be interesting to understand how Whole Foods could not keep their customers for their premium products, yet Apple (for the most part) has continued to still keep their customers all the while charging above average cost.

Could possibly be an indicator that people are inherently willing to spend more on electronics than food?

<comment><USER8> Back 15 years or so ago, I went to whole foods and purchased outrageously expensive tomatoes and other products because they not only were in theory grown without a bunch of potentially harmful chemicals but they _TASTE_ better. Buying tomato's, even in season, at the local grocery store usually results in tasteless, pulpy (or rocky) products. Same for pretty much every other fruit/vegetable. They also carried "strange" things like rice milk, and premium cheeses, and a bunch of other things frequently not found in the normal supermarket chains.

So the prices were insane (resulting in stories about $35 bags of cherries and other nonsense) but the product quality generally matched.

Fast forward a few years, and as whole foods grew they stopped being able to get the small batch products picked at peak ripeness or produced at artisan quantities. Instead they contracted out to giant organic agribusiness and the quality fell, while at the same time the traditional supermarket started carrying some of these premium products. Today, probably 90% of the smaller whole foods products are available in similar forms at the local supermarket. Sure I guess whole food still has artisan quantity products, but finding them can be difficult in their supermarket sized stores.

So, whole foods is really just a victim of their own success. In my case, to many tasteless vegetables later, I simply stopped making the effort to drive to their stores.

<comment><USER9> The local coop has become the new Whole Foods in my town, as it provides quality produce (for when I'm in the mood) and niche items that Whole Foods was famous for popularizing at acceptable prices. It's also helpful to support a local member-managed organization, even if I am not a member. Between normal grocery stores, a small local store such as a coop, and stores with unique store brand items such as Trader Joe's my needs are generally covered.

</comment></comment></comment><comment><USER10> What does this mean for Instacart? It can't be good.

<comment><USER11> [https://www.recode.net/2016/2/23/11588138/whole-foods-to- inv...](https://www.recode.net/2016/2/23/11588138/whole-foods-to-invest-in- instacart-signs-new-multi-year-delivery-deal)

</comment></comment><comment><USER12> As a side note, [http://s21.q4cdn.com/118642233/files/doc_downloads/governanc...](http://s21.q4cdn.com/118642233/files/doc_downloads/governance_documents/2017/CodeofBusinessConduct- February-16-2017.pdf) still has the approval requirement for forum postings.</comment>


Jeopardy's controversial new champion is using game theory to win big - <AUTHOR> http://www.businessinsider.com/jeopardys-controversial-new-champion-is-using-game-theory-to-win-big-2014-2 <comment><USER2> Here is a better article with an interesting interview from Arthur Chu: [http://mentalfloss.com/article/54853/our-interview- jeopardy-...](http://mentalfloss.com/article/54853/our-interview-jeopardy- champion-arthur-chu)

<comment><USER3> Yes! This is exactly what I was hoping for in the comments. I found the article intriguing but could see that there was a lot more to say.

Having read the interview, what I really take away from this is a rationality success story. Chu kept a simple focus on what he was trying to achieve, and worked to maximise his chances.

</comment></comment><comment><USER4> Of course, the real game theoretic outcome has to include the incentives of the rule maker.

This strategy generates controversy, which generates viewers, which generates revenue. But once the novelty has worn off, there's nothing prevention g the rulemakers from instituting a formal rule to replace what was once a cultural norm.

<comment><AUTHOR> Well I would say that as far as Chu is concerned, any long term consequences his actions may have on the game are likely to be mere externalities to him since these will probably not happen until he's already extracted the value he wanted out of the game.

You could also argue that the additional publicity he's enjoying thanks to his unusual strategy (eg. this article) far outweigh the costs of any such potential negative externality.

</comment></comment><comment><USER5> Game theory? It's all a moot point unless you actually know most of the answers which it seems he does. Game theory is just a tactic to give him that extra edge.

<comment><USER6> It's not a moot point, assuming he knows as much as his opponent this technique is giving him an advantage. (Which is what makes him and his technique interesting.)

What surprises me is apparently he is the first person to play the game like this.

</comment></comment><comment><USER7> Forcing a tie is an interesting approach, but daily double hunting is not new to the game at all. If you observe the way the contestants play, it becomes obvious who is playing with a strategy and who is just running down the categories. As for the ties, there's nothing wrong with it (honestly it's a good play), I only feel bad for those contestants who end up waiting longer as the queue becomes staggered.

</comment><comment><USER8> There's a difference between maximizing entertainment (which is how Jeopardy! is designed) and maximizing victory (which is how Arthur Chu is playing). In well-balanced games designed for competition, this is a non-issue. This does not describe Jeopardy! (or virtually any other game show).

</comment><comment><USER9> I've always wondered why contestants don't go looking for the Daily Doubles first. It always seemed like a good strategy.

And now that his strategy has been publicized, it's only a matter of time for other contestants to try the same thing.

</comment><comment><USER10> Having all players move on when there is a tie has always baffled me. If any three contestants ever agreed to always lose down to the lowest score in final Jeopardy, they could all win forever until the rules changed.

<comment><USER11> I imagine the agreement between the studio and contestant includes big loopholes giving the studio discretion to do whatever they want.

</comment></comment><comment><USER12> Offering a tie in Final Jeopardy wagering is a good idea. If you beat the opponent already, why not play him again instead of a random new opponent who might be better?

</comment><comment><USER13> I don't know that much about Jeopardy strategy, but it sounds like he's following Ken Jennings' suggestions.

</comment><comment><USER14> But can he beat Watson?</comment>


Show HN: Indoor Location you can try yourself - <AUTHOR> https://play.google.com/store/apps/details?id=com.footprint.quickmap

<comment><USER2> Constructive criticism: After reading the description, I don't understand what this application does. I am not initmately familiar with indoor mapping/positioning or WiFiSLAM. The term "indoor mapping showcase" is vague to me.

I think it lets me build maps of indoor locations? Somehow? Based on the screenshots, maybe by walking around my room? It seems like it could be neat, but I don't want to go through the trouble of downloading an app if I don't know what it does.

<comment><USER3> Fair enough. We have a 90 second video on YouTube that should give you a sense of what you'll get: www.youtube.com/watch?v=B_GdXp_Swjs

But basically, yes. It lets you build indoor positioning by walking around my room.

<comment><USER4> Not everyone has time to watch videos, especially at work. A simple text description would work a lot better.

<comment><AUTHOR> you're right. we're working on a blog post describing the app, and should probably get a better description on google play

</comment></comment></comment></comment><comment><AUTHOR> We built this because we felt Indoor Location technology is too inaccessible. There's lots of buzz about indoor location, and many canned demos, but very few people seem to put it out there.

We've built some cool tech, and we want people to try it out first hand.

</comment><comment><USER5> I'd love to know a little more about what's going on here. Does it use accelerometers or just wifi signals? One key question: could I share these floorplans? That is to say, using the sensors on HTC Android device #1, could I sent a floorplan to my friend Samsung device #2 and have them be able to similarly track their location?

Does it only work indoors, or is that just for demonstration?

<comment><USER6> The floorplans are definitely transferable! Once you've mapped a location once, it works automatically on all devices.

In fact, if you walk into a location that someone else has already mapped, the "Where Am I" will automatically load that map up on your device and start showing your position.

If you'd like to do more advanced stuff with your floorplans, make a WiFiSLAM SDK account here (access.wifislam.com) and we can get you started.

<comment><USER7> What's in the SDK? I looked around and there was not even a mention of ios versus android. Is it a set of armv7 ndk android libraries? Or something else? Can I use it on simulators running on OS X?

<comment><AUTHOR> The current WiFiSLAM SDK is an Android java library, available as an Eclipse project with sample code snippets that allow you to add your location to any existing Android app.

We have an iOS SDK that works, unfortunately since Apple disabled WiFi scanning in iOS 5 we can no longer publish it. It still works on jailbroken devices, but not a big target audience. We have a workaround in the works that will incorporate iOS devices

</comment></comment></comment></comment><comment><USER8> The explanation on the Play Store didn't make sense to me, only by watching the video could I understand what it did.

Actually, a coworker thought it worked the other way round :) (build a map by walking around).

I don't have a floor plan of anywhere, they're not required here in Uruguay.

Btw, video: <http://www.youtube.com/watch?v=B_GdXp_Swjs>

<comment><AUTHOR> A lot of people just scribble down a drawing on paper, and then use the "I Want To Take A Picture With My Camera" option. The floorplan is just a reference point, so you can makeup whatever floorplan makes sense for you. For example: [https://lh4.ggpht.com/Y1z9Qt5EggwNdg0Caua9dJGWV8dZmnYhioten1...](https://lh4.ggpht.com/Y1z9Qt5EggwNdg0Caua9dJGWV8dZmnYhioten1FKnRIMrCSO3n9cFEgc0i8QVzscMQ)

<comment><USER8> Thanks :) , I can do that :) .

Will try it out at home. Looks cool, and sounds like it could lead to interesting use cases.

</comment></comment></comment><comment><USER9> Sounds really great! I appreciate you put an App out there so we can try it out ourself and not just read a paper or watch a video. I tried it, but unfortunately my old HTC Wildfire is so slow that it becomes unusable. I was able to take a picture but I can't even place the cursor on the map. Of course I don't expect you to support such an old and crappy phone. I will try to get hold of a faster Android phone.

I also downloaded the SDK. Is it possible to use it on a Laptop, too? Maybe, by emulating Android? I have no clue but I would have a few ideas on how to use it with a Laptop.

As Gee has pointed out, there is also <http://www.indooratlas.com/> which uses the magnetic field for indoor SLAM. Do you have any info on how your system compares to theirs?

Anyway, thanks for sharing this!

</comment><comment><USER3> If you don't have time to try the app, watch this video instead. It's 90 seconds. www.youtube.com/watch?v=B_GdXp_Swjs

<comment><USER3> Oh also, if you're up for learning more about the technology/platform in general, take a look at blog.wifislam.com

</comment></comment><comment><USER10> IndoorAtlas is similar, but doesn't require WiFi in the building. It utilizes magnetic variations to detect the location. <http://www.indooratlas.com/>

</comment><comment><USER11>
        Error reading floorplan

        There was an error reading your floorplan from storage

Nexus 1, trying Windows7 Paint generated .png and .jpg

<comment><AUTHOR> Does it work if you try again? Looks like this is an issue with mod_python, which cannot accept chunked encoding (<https://issues.apache.org/jira/browse/MODPYTHON-222>)

We're not sure under what conditions the client decides to send chunked vs not, but in our testing if you retry it should get through.

</comment></comment><comment><USER12> I just want to point out that I first mis-parsed the name of the technology as "wif islam".

<comment><USER3> Heh. Not the first time it's happened :P

</comment></comment><comment><USER13> Aisle 411 is doing indoor location: <http://aisle411.com/>

<comment><AUTHOR> Yeah, Aisle411 is definitely doing some cool stuff with indoor location, and are the types of partners that make a lot of sense for us. Indoor location is made up of two key components: Real-time positioning (e.g. WiFiSLAM) and point-of-interest databases (e.g. Aisle411)

</comment></comment><comment><USER14> What happens if the WiFi base station has dynamic power levels - or are most bases left with fixed power?

<comment><USER3> In our experience, we've found that most access points do in fact have a fixed power. Either way, the system can accomodate some amount of dynamic changes.

</comment></comment><comment><USER15> doesn't work for my on campus wifi. any requirements on the wifi network? My phone is htc one x.

<comment><AUTHOR> No specific requirements for wifi at all. Which part didn't work exactly?

<comment><USER15> when I was walking the cursor does not move along. I think my campus wifis are using signal repeaters.

<comment><AUTHOR> it should still work with signal repeaters. Did you map the location first? If this is a new location (i.e. someone else hasn't mapped it yet), then what you want to do is select the floorplan in "Browse Floorplans". You should see a button to start mapping, hit it & follow the on-screen instructions (basically walk around and hit the "mark point" button or the volume up/down button after positioning yourself on the map). once you are done, hit stop mapping & hit yes to upload it to our servers for processing. after some time (maybe 2-5 minutes depending on load) you should be able to hit "Where Am I?" on the home screen to have it track your position.

Let us know if it's still not working for you.

</comment></comment></comment></comment><comment><USER16> Did you write image recognition from scratch yourselves, or is it based on a lib?

<comment><USER3> It's actually based on the ambient Wi-Fi signature of the airwaves around you. There is no image recognition involved!

<comment><USER16> Ah ok, so the *floorplan you supply just acts as a "background/walking-guide" for your mapping?

<comment><AUTHOR> yup, that's right

<comment><USER16> Ok, thanks. Was looking for a img rec lib for floorplan drawings when I fell upon your post - hence the question.

</comment></comment></comment></comment></comment><comment><USER17> Crashes on startup. HTC Evo V 4G, Android 4.0.3. Reported via Google Play.

<comment><USER6> Thanks for the report and sorry about the crash!

Any chance your sdcard/external storage is mounted or otherwise unavailable? We're supposed to have a popup to prompt you for that, but it looks like some code slipped in before the prompt :(.

<comment><USER17> Sorry, missed this for a couple of days. Hmm, I may have been charging via USB to the computer at the time. Will try again later.

</comment></comment></comment><comment><USER18> Does this adapt it's map on the fly like a true SLAM, or does it only work off the access points detected during the configuration phase?

<comment><AUTHOR> We've found good results using only the configuration phase; we have versions with full SLAM but it tends to work well without it. The QuickMap app uses only access points detected during the configuration phase.</comment></comment>


Wyoming rejects science education standards over climate change - <AUTHOR> http://arstechnica.com/science/2014/03/wyoming-rejects-science-education-standards-over-climate-change/

<comment><AUTHOR> It's the subheading that kills me: : Reality, legislator argues, needs to comport with the state's economic interests.

<comment><USER2> Seems we'll be learning evolution the hard way. Weeeeeeeeeeeee!

</comment></comment><comment><USER3> Yawn. Its one thing to say there is or was an ice age; its entirely something different to say humans caused it. Alot of global warming nuts like to confuse these arguments.

"I don't think humans are causing global warming." "So you don't believe in global warming? You're crazy!"</comment>


Functional programming: Monads made clear – in JavaScript - <AUTHOR> http://blog.klipse.tech//javascript/2016/08/31/monads-javascript.html <comment><AUTHOR> The original Haskell version is also worth a read [http://blog.sigfpe.com/2006/08/you-could-have-invented- monad...](http://blog.sigfpe.com/2006/08/you-could-have-invented-monads- and.html)</comment>


What's new in Firefox 3.5 - <AUTHOR> https://developer.mozilla.org/en/Firefox_3.5_for_developers

<comment><USER2> Awesome stuff.

\+ Mibbit as default IRC:// link handler

<comment><USER3> Congrats!

</comment></comment><comment><USER4> The audio and video element support is good for the open web but still needs work to be an alternative to Flash and Silverlight because currently it is too slow. It's not just because of Theora. Ogv videos play noticably better outside Firefox. Safari's video element support (using H.264) is much better.

<comment><USER5> I can't wait the day I won't have to load a Flash video.

It's such a painfull experience. It'll be the beginning of the end of Flash, which makes me happy.

</comment></comment><comment><USER6> I think the support for web worker threads (OS-level, presumably preemptive multithreading for JS) is potentially the most interesting part of this release, although I don't know how lock-free they are.

Moz: <https://developer.mozilla.org/En/Using_web_workers> WHATWG: <http://www.whatwg.org/specs/web-workers/current-work/>

<comment><USER2> I really dislike this to be honest. Not having threads ensures the language is nice and simple and pure. Threads in what is pretty much an event driven language, make very little sense. What operations 'block' in js? Threads encourage sloppy inefficient programming.

If you start 20 WebWorkers, and it's faster than having 10, you have to ask some serious questions of the interpreter/VM. Like whether it's insane.

It should really be up to the interpreter/VM to be able to spread the work over multiple cores, not the programmer of the js.

<comment><USER7> In terms of the programming model, web workers are processes, not threads. They have no shared state, and use asynchronous message passing as the only inter-process communication - very much like Erlang. This makes them very simple, and fits in perfectly with JavaScript's existing asynchronous event- based model.

"What operations 'block' in js?"

Web workers are important because _everything_ blocks in JavaScript. JS in the browser is single-threaded, which means that if you do anything computationally intensive (reading from a Gears database, sorting a huge array, image manipulation on a Canvas element) then your page can no longer respond to UI events until the processing is finished. Without worker processes, the only way to do long-running computation without blocking the UI was to implement your own cooperative multi-threading by "yielding" with setTimeout(fn, 0).

(Note: I'm talking about the model exposed to JS programmers, not the underlying implementation which might be based on native threads, native processes, or green threads.)

<comment><USER2> >> "the only way to do long-running computation without blocking the UI was to implement your own cooperative multi-threading by "yielding" with setTimeout(fn, 0)."

Yeah I much prefer that method personally.

</comment></comment></comment></comment><comment><USER8> Quite feature rich for devs. Geolocation, native video support, XmlHttpRequest across domains and offline/local storage are my favourites. And that is not even the end of the list. Btw, have you seen this -> [http://blog.mozbox.org/post/2009/04/12/Firefox-35:-a-new- exp...](http://blog.mozbox.org/post/2009/04/12/Firefox-35:-a-new-experiment- with-Canvas-Video)

</comment><comment><USER9> Really excited to try out things with TraceMonkey and the DOM workers. Also:

 _"The String object now has trim(), trimLeft(), and trimRight() methods."_

You know, it's a little thing, and easy to implement yourself, but I'm still glad this finally got added.

</comment><comment><USER10> Probably my favorite feature is the much-improved scrolling on OSX. It's just as smooth as Safari now.

</comment><comment><USER11> Although 3.5 has some interesting stuff, I'm really excited for the Taskfox/Ubiquity integration (<https://wiki.mozilla.org/Taskfox>). I think it could actually make the Awesome Bar much better. Not to mention, I'm sure we'll see a lot more work on it once it's integrated into Firefox. Hopefully users will still be able to submit commands.

</comment><comment><USER12> Biggest happiness for me: Improved Synchronous XMLHttpRequest support

</comment><comment><USER13> Download link to Firefox 3.5 beta 4 (in case you were like me and it wasn't blindingly obvious): <http://www.mozilla.com/en-US/firefox/all-beta.html>

</comment><comment><USER14> Did they allow users to disable the "awesome" (ie, "shitty") bar? Serious question, because at some point I'll have to switch to IE or something...

<comment><USER15> There are firefox extensions that turn it into a normal entry box, although personally I love the awesome bar. I can't switch to any other browser now because I hate having to type out the whole url all the time. I can just type "hac" in my toolbar to go to hacker news.

FYI, in IE8, typing "hac" in the url bar sends you to a google search on "hac". In Safari, you end up at <http://hac.com>.

<comment><USER16> Seconded. The awesomebar is one of _the_ best Firefox features.

<comment><USER17> How does anyone actually tolerate the awesome bar? When it debuted, I thought it was some kind of prank.

I still kinda do.

</comment></comment></comment></comment><comment><USER18> The new geolocation feature is creepily accurate. This page found my exact location.

<http://channy.creation.net/project/firefox/geolocation.html>

<comment><USER19> 45 minutes north, on the other side of the Bay. Phew. Thank goodness for proxies.

</comment></comment><comment><USER20> Does this mean it's out of beta?

<comment><USER21> Nope. Still at beta 4.</comment></comment>


Penetration Testers' Guide to Windows 10 Privacy and Security (Hardening Guide) - <AUTHOR> https://medium.com/@securitystreak/the-2017-pentester-guide-to-windows-10-privacy-security-cf734c510b8d <comment><USER2> I will implement this over my next week off.

Thanks for sharing!</comment>


Deis 0.5.1 – Docker Containers All the Way Down - <AUTHOR> http://deis.io/deis-0-5-1-docker-containers-all-the-way-down/

<comment><USER2> This is a big release for the project. Now that every Deis component is a Docker container we can start work on things like:

* Removing the hard dependency on Chef

* Integrating with an enterprise-grade scheduler (possibly Mesos)

If you have any questions, I'm happy to field them here.

</comment><comment><USER3> Kudos to Gabriel and the Deis team for being great Docker citizens. They take the time to make upstream contributions, are the first to try new features and APIs, and when something breaks they take the time to send thoughtful detailed reports. Gabriel is also a fixture of the #docker channel, always lending a helping hand.

Thanks guys for a great product, for being patient with us :) and for your help improving the Docker community!

<comment><AUTHOR> As noted in the release notes, I've recently transitioned from being a weekend contributor to a full time maintainer on Deis. It has been awesome working with Docker since v0.1.2 and with Deis since v0.1.0, and I am certainly looking forward to contributing more upstream improvements in the future.

Look out for more pull requests to the registry! :)

</comment></comment><comment><USER4> I am really excited about this!

Though, I kinda wonder. When scaling web instances, does it provision a new machine per instance?

Also, how do I do something like create backing services?

<comment><AUTHOR> > When scaling web instances, does it provision a new machine per instance?

We host application instances in Docker containers, so each instance is essentially a container on a VM. We have a very basic scheduler implementation (read: round-robin) that deploys the containers evenly across nodes under the Runtime Layer[1]. As gabrtv mentions in another comment, we are looking to replace this scheduler with something more sophisticated like Apache Mesos[2].

As for creating backing services, we are looking to implement a service registry[3] where it would communicate with third-party services much like how Heroku Addons work. For the moment, most users set an environment variable for their application as per the docs: [http://docs.deis.io/en/latest/developer/manage- application/#...](http://docs.deis.io/en/latest/developer/manage- application/#configure-the-application)

[1]: [http://docs.deis.io/en/latest/components/layer/#runtime- laye...](http://docs.deis.io/en/latest/components/layer/#runtime-layers)

[2]: [http://mesos.apache.org/](http://mesos.apache.org/)

[3]: [https://github.com/opdemand/deis/issues/231](https://github.com/opdemand/deis/issues/231)

</comment></comment><comment><USER5> I just wanted to say thanks to the developers for an awesome application. This perfectly fits the niche of "self-hosted Heroku" with very little friction.</comment>


The fiddling with temperature data is a big science scandal - <AUTHOR> http://www.telegraph.co.uk/news/earth/environment/globalwarming/11395516/The-fiddling-with-temperature-data-is-the-biggest-science-scandal-ever.html <comment><USER2> [https://en.wikipedia.org/wiki/Christopher_Booker](https://en.wikipedia.org/wiki/Christopher_Booker). His article is unworthy of your time. Likewise for Paul Homewood ([http://johncanning.net/wp/?p=1924](http://johncanning.net/wp/?p=1924), [https://denierlist.wordpress.com/2015/02/11/paul- homewood/](https://denierlist.wordpress.com/2015/02/11/paul-homewood/)).</comment>


Riffle: an efficient communication system with strong anonymity - <AUTHOR> http://dspace.mit.edu/handle/1721.1/99859 <comment><USER2> Kwon thesis: [https://dspace.mit.edu/bitstream/handle/1721.1/99859/9277182...](https://dspace.mit.edu/bitstream/handle/1721.1/99859/927718269-MIT.pdf)

Paper: [https://people.csail.mit.edu/devadas/pubs/riffle.pdf](https://people.csail.mit.edu/devadas/pubs/riffle.pdf)

</comment><comment><USER3> With no real reaction after the NSA leaks and with people in various governments trying somehow to criminalize encryption and anonymity, this is exactly what we need. We don't need another centralized Google/Facebook/etc. powered application.

<comment><USER4> > With no real reaction after the NSA leaks

I know where you're coming from but I don't think this is the case. There are too many examples to give but here are some nice ones:

In 2013, there were only a small number of E2E encrypted messenger users. Now there are over a _billion_ Signal Protocol users alone, not even including other systems. This isn't getting deployed because it's easier to develop, support, or use than plaintext.

In 2013, RC4 was widely used in TLS and random number generation (on BSD systems). It has been kicked out and now ChaCha is seeing wide deployment in the same places (although FreeBSD is lagging behind).

Let's Encrypt has substantially increased TLS availability and usage.

In 2013, the default crypto in OpenSSH was (IIRC) P-256 and AES-CTR, with ECDSA host keys. It's now X25519 and ChaCha20-Poly1305 with EdDSA host keys.

In 2013, TLS was mostly RC4 and CBC. Now (on my servers) it's mostly GCM and ChaCha. Even the IETF has said to stop using RC4.

The NaCl family, including in particular Libsodium, has a TON of users. Besides supporting only strong crypto, the high-level API has made it almost impossible to publish a successful new crypto library today that's in the style of OpenSSL where the only answer to "how to I accomplish X?" is "go fuck yourself." Good riddance to Russian roulette crypto libraries.

We're even seeing movement in pqcrypto. So while some people are being reactive and switching out bad crypto for good (as in above examples), some are being _proactive_. Google is experimenting with pq-safe key agreement, as just one example. Tor is working on it as well. So not only has there been a positive reaction since 2013, but people are beginning to be more proactive as well, trying to stay ahead of the curve.

The number of users of strong crypto has increased by several billion since 2013.

<comment><USER5> Paranoid response alert:

This doesn't mean much, in my opinion. It might stop several thousand teams of garage hacker heroes but it's hard to argue it would stop NSA / GCHQ / anybody else on their level.

With all of the leaks (good chunk of them are just theories, admittedly) that claim that agencies can utilize hardware backdoors remotely, it's hard for me to imagine I am safe from snooping, ever. What good would a stronger SSL/TLS key do if the agencies can directly connect to my CPU? What good would a strong VPN and a network like Tor do if my NIC reports my traffic via a backdoor in its driver without a chance of me ever noticing?

I definitely agree some progress has been made. No two opinions about it.

I do question if these countermeasures achieve anything at all against the biggest and most formidable snoopers however. I feel like they are letting us argue over things they've cracked long ago and are letting us think we're safe.

Usually when public statements are made by them which try to smear/outlaw a technology, it's then I'd think the agencies are having a hard time. If they don't say anything, I'm presuming they got things well under control and where they want them to be.

Not the ideal theory but all of this reply was just my thoughts anyway. If I had any facts whatsoever, I'd most likely be in a prison, so there's that. We can mostly only theorize here.

<comment><USER6> Compromised endpoints is the elephant in the room in the crypto debate.

<comment><USER5> Indeed they are. And it's somewhat discouraging seeing people argue over the best encryption algorithm instead of trying to hunt down Intel's rootkits, for example. Again, I can't _claim_ anything; I am just reading and hearing things. They might be total crap and I might be an idiot for thinking they might be true. But they're still worth considering IMO.

<comment><USER7> It's not at all discouraging to argue over the best encryption, it's plenty healthy to keep the research going so weak/defeated methods get deprecated and only the strongest remain in use.

But you're right that endpoint security is the next monumental task and the challenges are not entirely unknown [1]. How do you suggest we proceed to achieve trustworthy hardware?

[1] [https://libreboot.org/faq/#intel](https://libreboot.org/faq/#intel)

<comment><USER5> That's a very good question and a very tough one to answer. In my opinion we the humanity gave up the easy way to a secure and publicly audited hardware when Intel started growing. We lost the battle right there and then. To try and do the same they achieved in 10-15 years but be entirely transparent and auditable... seems impossible right now. :(

However, projects like Raspberry Pi are admirable and are efforts in the right direction (even though recently it has been questioned if it can be hacked the same way that Qualcomm-based Androids can). I recently heard about that 1000-core CPU as well. I wonder if that's entirely public? If it is, it might render the x86 / AMD64 model irrelevant so we shouldn't spend gigantic efforts in trying to catch up with 10-15 years of hard work from Intel.

So probably the general direction would be to make old and good hardware protocols famous by trying to "libre"-ify them and bring them up to speed to today's computational requirements (mind you, I still want to play my games on Ultra settings). Even if we start replacing things one by one, every iteration could decrease the attack sufrace. That'll force the malicious actors to take counter-measures; for example, I'd think trying to outlaw ARM (or economically attack its usage, which is the much more used way of doing things IMO) and only license Intel/AMD for certain applications would be a telling sign that somebody doesn't like what's happening.

I am not a hardware person (wish I was; I am not even electrical / electronical engineer!) but I am a privacy-conscious person, and quite paranoid too. I am sure there's a way but alas, I can't answer you in as constructive manner as I'd want to. I can only do a "boss speak" and be oblivious to the details. And at 36 with a well-built career I am beginning to doubt I'll ever try and become a hardcore hardware engineer in addition to my programming/sysadmin experience.

My apologies if I wasted your time reading this.

EDIT: btw, the linked article is scary....

<comment><USER8> A little remark: Raspberry Pi is a nice market for Broadcom, Premier Farnell and other big players involved in making it. It also has proprietary chip that needs closed source software to work (while Intel provides a lot of open source code).

I guess their project has been really successful if "privacy-conscious" and "paranoid" persons consider it "admirable" based on nothing but the internet hype.

<comment><USER5> You got me. I am not an expert. Your information is highly appreciated. This is not a sarcasm.

What would you recommend in terms of a really "libre" hardware?

<comment><USER8> The answer is simple: there is no libre hardware if you want top performance, common architecture, don't have ability to order chips in hundreds of thousands or to make your own, etc.

The question is not whether some proprietary solution looks "free enough" if you squint your eyes more than the other proprietary solution. The question is whether people understand that chain of trust that ends in someone else's hands has its problems no matter how big that someone is, and bother to fix that vulnerability.

<comment><USER9> I've been waiting to run across someone who may be able to scratch an itch that's been in the back of my head for a few months now and you seem like you might be able to help me out...

Would the developing J-Cores[0] being worked on by 0pf[1] be able to catch up (I'm thinking more along the lines of performance of recent mobile processors, not desktop processors)? I am under the impression that, while a monumental task is ahead of them, they have the boon of hindsight. Of a dozen processor architectures competing back then only a handful survived the decade and only 2 or 3 are being fabbed now (i386/amd64, ARMvX, and IBM?) and they can base decisions on the successes and failures of other chipsets, speeding up the development process. Is that fallacious thinking?

I know most of their goals are along the lines of getting custom fabs down to $20k and making the term "penny processor" a household term, but is there potential (read:hope) for a secure, performant (whatever that means to you) processor that we can use for daily computing without fear of a hardware-based backdoor?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> If you're interested in the basic tools used in this system, this is another paper that uses some similar ones: [http://arxiv.org/abs/1503.06115](http://arxiv.org/abs/1503.06115)

Phil Rogaway called it 'elegant', fwiw.

</comment><comment><USER11> The name reminds me of the Solitaire cipher from Neal Stephenson's Cryptonomicon, which is calculated using a deck of playing cards: [https://en.wikipedia.org/wiki/Solitaire_(cipher)](https://en.wikipedia.org/wiki/Solitaire_\(cipher\))

<comment><USER12> Interestingly enough that is being discussed on the front page of HN right now! That is if you have not already seen this.

[1] [https://news.ycombinator.com/item?id=12076568](https://news.ycombinator.com/item?id=12076568)

<comment><USER11> Yeah, I saw that and wondered if my comment was the inspiration for that post :-)

</comment></comment></comment><comment><USER13> It's interesting, for certain, but still requires all clients to dedicate an identical amount of bandwidth (n.b.: this is very probably required for traffic-analysis-resistant anonymity): 'Moreover, each message needs to be padded to a fixed length to prevent privacy leakage through the size of the message,' (pg.23) and 'To be fully traffic analysis resistant, all users are required to upload a message, even if they do not wish to communicate that round' (pg. 25).

Granted, the second sentence leaves open the possibility that perhaps all users _aren 't_ required to upload a message, at the cost of increased susceptibility to analysis, but I don't think that's really intended: worst- case, there's one client message per round, which provides no real anonymity against the client's primary server.

I'm not putting it down, really: Riffle is a remarkable achievement. Sadly, it appears that anonymity is really, really hard to do truly efficiently.

<comment><USER13> Also, if I'm reading it correctly then each plaintext message from a particular client ends up at the same location within an epoch, due to the one-time shuffle at the beginning of each epoch. That might be able to reveal information about a client's activity within the epoch.

I also wonder if the presence of distinguishably-mandatory plaintext messages could be used within an epoch, particularly with respect to the previous point. E.g. maybe knowing the the same client was active in rounds 1 & 2, the inactive in round 3, then active in round 4, then inactive in rounds 5 & 6, then active in rounds 7 & 8 could be used to identify the client (imagine a low-latency system, and keystroke timings or voice packet lengths).

</comment></comment><comment><USER14> It would be nice to understand on a high level how it compares with other systems for the non-experts.

</comment><comment><USER15> link to a prototype implementation by the author: [https://github.com/kwonalbert/riffle](https://github.com/kwonalbert/riffle)

<comment><USER2> > NOTE: This prototype implements most of what's described in the paper, but > does NOT make any guarantees about security. This prototype is almost > certainly full of security bugs. Please do not adapt this code to use for > real anonymous communication.

So I wonder if this will be updated.

</comment></comment><comment><USER16> Somewhat reminiscent of agl's awesome-but-defunct pond, with turn-based rather than randomized sends.

<comment><USER2> Anyone know why it's defunct, if it's so awesome?

<comment><USER17> The author graduated and nobody stepped up to maintain the work. Happens to 99% of graduate student projects. The sad truth here is a lot of well maintained open source work is funded by companies who pay individuals to work and/or maintain the projects. Lots of cool ideas have no such luck.

<comment><USER2> OK, I get it. I didn't know that he did Pond as a grad student.

</comment></comment></comment></comment><comment><USER18> > For latency sensitive microblogging, we can support up to 10,000 users with > less than one second latency with 160 byte messages.

This is not a general-purpose mix network.

</comment><comment><USER19> > Anonymous communication is an important part of democratic societies and > freedom of speech.

Is it?

<comment><USER20> It's easy to take for granted in an advanced democratic state, because freedom of speech is protected in one way or another.

For a certain subset of societies that suppress information and views, anonymous communication becomes more important. Enabling more voices is in essence making the society more democratic (or leading towards).

In addition, if you look at what's going on in Poland[1] at the moment, then you could very well argue that a popular service that can't be censored would help present a more balanced view of what is going on.

From that perspective it becomes a safeguard to prevent slipping, even if things are sailing along fine at the moment.

[1]: [http://www.independent.co.uk/news/world/americas/barack- obam...](http://www.independent.co.uk/news/world/americas/barack-obama- attacks-polish-democracy-in-a-speech-polish-tv-changes-speech-a7129136.html)

<comment><USER21> Absolutely. Back when I first started doing FOIA requests, everything was anonymous. Not necessarily because of paranoia, but because it gave me a calm peace of mind after submitting requests.

After some bogus FOIA redactions and misinterpretations, I submitted a Request for Review (RFR) to the Illinois attorney general's office who refused to continue without a signature with a valid first and last name to associate the RFR to the original FOIA request.... even though my first and last name weren't actually on any previous requests (their argument made no sense, especially with ESIGN in mind). My lawyer even told me that it would be a waste of time to fight it and to just accept it - since a lawsuit would very likely require my name anyway. Or alternatively give up on the request.

Since my writing style stand out like a sore thumb, staying "anonymous" seemed pretty silly going forward, so I stopped. These days, I feel naked when submitting a request and in a lot of ways, it definitely feels like it does limit certain types of requests. If anything, my requests are a little bit more agitated - I definitely no longer have the same peace of mind as before.</comment></comment></comment>


180,000 Child Programmers Versus 44 Ogres - <AUTHOR> http://blog.codecombat.com/180000-child-programmers-versus-44-ogres <comment><USER2> I am a big supporter of Code Combat. I am teaching a few kids to code in person (including my own kids). I discovered it through an HN post a few months back.

My first session of 4th graders used Code Combat on the first day, and they loved it.

I was thinking about using Code Combat through my whole session, as a way to introduce programming, because the kids loved the site so much.

But, there are issues.

* The browser loses focus. Kids don't touch type so they don't notice this until they have been typing for a few minutes sometimes(?!)

* Finding typos is incredibly frustrating for these kids. Javascript has a lot of "syntactical overhead" that gets in the way of learning core concepts.

* They just get stuck and need someone to help them. At the elementary school age level, they have about 5 minutes of total patience before they stop. They don't "rage quit" like middle school kids would, they just start goofing around.

I think these are resolvable issues, and I actually think the Olark idea is a fairly good one.

In the end, I ended up using MIT Scratch to teach most of the class. It got rid of the syntactical issues, and lets them express their creativity visually and with sounds as well.

It has its own set of issues too though since it's a visual language and some things are just hard.

That said, I'm still excited about Code Combat and watching developments closely. Keep it up guys! All the kids want to keep coding so maybe I'll try again in January!

FYI - Here's more info about that particular class: [http://douglastarr.com/coding-class-week-1/](http://douglastarr.com/coding- class-week-1/)

<comment><AUTHOR> Hi tarr11, thanks a lot for the in-depth feedback, this is hugely helpful for us. I had actually read your blog post when it was posted, and we got a lot of helpful information out of it.

Here are some responses to the problems:

* When you the browser loses focus, do you mean the code editor or the entire browser? Also, have you kids had any problems with backspace taking them to the previous page? We're trying to diagnose the latter problem and can't reliably reproduce it, but know that it's causing users a lot of frustration.

* Syntax is actually our hardest problem for new players, and we're considering ways to make it easier for people to get into the game. One idea is to shorten the method names (say to this.attack(); rather than this.attackNearbyEnemy();) enabling drag and drop or click and insert from the spell editor, etc. Do you have any specific recommendations for changes we might make?

* We're definitely shielded from the distraction-quits since our UX testing sessions tend to be either paid or semi-compulsory (classroom time), but I imagine this is a big problem. Do you find that there's a point of reliable minimum interest among players? Say during a particular level or challenge?

Again, thanks a lot for so deeply engaging and getting us some areas to work on. If you are interested, we'd love to have someone as communicative and engaged working on the open source when it gets released (hopefully in the next week or so)!

<comment><USER3> I think simplifying method names is a very good idea. However, please don't implement any sort of drag and drop interface. I've taught a few programmers using drag and drop tools and all of them have run into significant issues transitioning to "real" coding.

<comment><USER4> Better, probably, to learn programming through a drag-and-drop interface, then make a difficult transition to typing, than try to overcome both challenges at the same time and likely give up. Having done microcomputer BASIC programming as a primary-school child I can testify that syntax errors are just a horrible waste of time and enthusiasm at that level.

<comment><USER5> I think the problem is better solved by using a DSL rather than a general purpose programming language. You can make the syntax simple as pie and still keep the platform as expressive as you need it.

</comment></comment></comment></comment></comment><comment><USER6> >American Students Are the Best Trolls and the Worst Programmers

Do you think the trolling had any effect on Americans being the worst programmers. Or were the Americans who tried coding truly "the worst." How did you determine Americans were even the ones you were talking to (by time zone?). I would like to see some data for the total students who participated by each country.

<comment><USER7> I suspect that while American kids might have been dragged into it by schools and teachers whether interested or not, international kids were all interested in it or at least choosen by teachers as good students.

Also, I do not know how many languages do they support. However, if it is only english, almost all international participating kids are someone who learned foreign language. Which rules out worst cases.

As far as I know, there was huge campaign in usa involving president and "everybody has to code" slogans. As far as I know, there was no such thing elsewhere.

<comment><AUTHOR> I know for a fact that the hour of code was compulsory for American students, which is definitely a big contributor to trolling behavior. I know that most of my classes in HS would have reverted to juvenile behavior given an open- ended social situation like an Olark chat. That said, it was still startling!

</comment></comment></comment><comment><USER8> Every child should be shown how to program for a few days, but merely so that those few who are genuinely interested get to know that programming "exists".

<comment><USER9> And if they are genuinely interested, that they have access to the necessary resources to continue.

In middle school we had a two week section on computers and programming, which I absolutely devoured. But I didn't have access to the computer lab again in middle school, the two high schools I attended didn't even have computer labs, and my family wouldn't own a computer until more than a decade later. :-(

<comment><AUTHOR> My first computer was my father's Amstrad '86 with a whopping 1MHz processor and 512k of RAM. He bought it so he could work on his master's thesis in the late 80s. A friend of mine in high school (during the early 00's) got his first computer in the late nineties and he bought it with own cash because his parents didn't think computers were worth it. By that time I knew a lot more about computers just by having it around the house. Simply put, you're right: access is a huge issue.

</comment></comment></comment><comment><USER10> As an ogre, I have to say I'm offended.

But as a programmer, awesome job Code Combat! Your turnout was pretty inspiring. I'm a little sad at the observation that American kids were such trolls though. I mean, I don't know what I expected; I meet them all the time in online video games. I guess I just had hoped the ones that would come across a code competition and be interested enough to click would also be mature enough to show some restraint.

</comment><comment><USER11> Kudos to your team for rising to this challenge! I love the idea of using games to help kids learn, well, anything really.

But this part sort of took my breath away:

> COD is Call of Duty, the latest ultra-violent first person shooter which > kids are playing at a rate of more than a millennium per day.

Am I the only one who finds this number mind-boggling?

<comment><USER8> Playing two hours a day per person would make 4380000 players. Which seems pretty realistic considering there were 12 million active Wow players at one point.

<comment><USER7> Many COD and WOW players are adults. According to some stats I read, an average player of big single player games is more then 30 years old male. So I assume that many of them will play multiplayers too. Plus, I know many adults that play those games.

I'm not sure that COD is "ultra-violent". It is violent of course, but not much more then an average action movie.

<comment><USER12> I call it "ultra-violent" because the one time I played it myself, this was the first level: [http://en.wikipedia.org/wiki/File:NoRussian.jpg](http://en.wikipedia.org/wiki/File:NoRussian.jpg)

Basically you're pretending to be a terrorist, you have to shoot up an airport full of civilians (who die very realistically, beg for their lives, etc.), and then at the end of the level the main terrorist whose cell you're trying to infiltrate shoots you in the face and you die.

<comment><USER8> What happens if you don't shoot the civilians, does the game end?[/qurious]

<comment><USER12> It's slightly possible to do the level without shooting the civilians yourself (your terrorist buddies can kill them for you), but you do have to kill the Russian airport police who show up to stop you. If you refuse to shoot them, the battle just continues forever until you open fire.

</comment></comment></comment></comment></comment></comment><comment><USER13> I would totally like to support you guys, but you never replied to my technical issue inquiry on twitter, so I haven't been able to use your site.

<comment><USER14> Sorry for that, must have missed it! Send us an email at email@example.com for support; none of us are very good at Twitter.

</comment></comment><comment><USER15> Any suggestions on gift ideas related to this?</comment>


Productivity Bundle from Fusion and Carbon - <AUTHOR> http://fusionads.net/bundle?its=new

<comment><AUTHOR> Full disclosure: My boss's side-project is featured in this bundle. (That's how I knew it was going live today.) However, I just found out now that it includes all these other heavy hitting apps and services! I'm voting with my wallet as well as my HN link. ;)

<comment><USER2> I must admit, I like the idea of a themed bundle like this. Some of the other bundle deals can seem a bit ... random. It would be good to see software bundles that mirror (or support) particular workflows.</comment></comment>


The Problem with Focusing on Childhood Obesity - <AUTHOR> http://www.nytimes.com/2015/12/18/opinion/the-problem-with-focusing-on-childhood-obesity.html?ref=opinion <comment><USER2> There is a qualitative difference between childhood obesity and adult obesity. Once we reach adulthood, the number of fat cells in our body is basically fixed, they just increase or decrease in size. Obese children have grow more such cells. Together with the influence of fat cells on hormones and appetite that means that fat gained as a child is much harder to lose and to keep off than fat gained later in life.</comment>