Ask HN: Game devs, what is the hardest part about designing an AI for your game? - <AUTHOR> I've been thinking a lot about different machine learning techniques applied to video game artificial intelligence. I'm wondering if any video game devs would like to share their experience about what parts of making a game AI are challenging, things that are difficult to get right, time consuming, or tedious.<p>Thanks! <comment><USER2> Game AI is mostly pathfinding (which basically falls down to creating navigation meshes for levels), and very basic decision making skills, which is usually a weighted decision tree (e.g. if they're getting shot at, cover might be weighted at 80%, shooting back at 20%). You don't want to actually create something _actually_ smart to fight, you want something with understandable, predictable logic for the player and something they feel clever outsmarting. Anything too complex and players will get discouraged by the difficulty.

Machine learning isn't really a great fit for this, as it is neither predictable nor understandable, and thus the player can't plan around it or try to outsmart it.

<comment><USER3> That reminds me of a lesson developer's learned when making a stealth game, Splinter Cell. Originally, when you were spotted the enemies would just try to shoot you, but tester feedback said that players didn't like getting shot out of nowhere. The devs added audible cues that you'd been found, like the guard yelling "Hey you!" before they started shooting. It turns out realistic AI behaviors aren't necessarily fun AI behaviors in a video game.

<comment><USER4> Splinter Cell also has cooldowns in some/most levels (like most stealth games), which is of course an absurd notion. A guard on a military base wouldn't back out of "DEFCON1" after two minutes just because the invader didn't show herself for that long.

<comment><USER5> There's a cool isometric stealth game called Robin of Sherwood, where you can follow what the guards are doing. A guard might accidentally stumble upon someone you killed, be alarmed, look around, run off to warn their commander, then the commander organises a search for the culprit, with lots of guards explicitly looking for you everywhere. Eventually if they can't find you, the whole thing dies down and everybody resumes their original duties, assuming the dead body was just a fluke or something.

Also, if they find someone you merely knocked unconscious, they assume they'd been sleeping on the job. If you tied them up, they free them, but I forgot if they search for you or if they just assume they got accidentally tied up somehow.

Also, you'd think they might raise the alarm if they find less and less guards present at their assigned post.

</comment></comment></comment></comment><comment><USER6> I've been designing/coding games since I was 11yo and have a degree in gamedesign & dev. The hardest part isn't the technical side of the game's AI. It's finding the balance of an AI that makes the gamer feel powerful enough to be fun- but not too powerful to become bored - and not find it too hard that he/she becomes demotivated. Obviously every player is different so finding a balance that can keep the gamer excited enough to continue is extremely hard. Getting the emotional-experience side of the player into the sweet zone is hard. One would say 'why not make the AI such that it adapts to the user'. Which is 50% of the answer. But the challenge then becomes that you don't want good players to be at the same level as bad players when the AI creates a similar experience for both. You want both players to enjoy the game, but not in the same way.

<comment><USER7> The Solution here would be rather than weighing the AI Difficulty for good players and bad players.You must have different sets of AI.

</comment></comment><comment><USER8> Making an AI that isn't "perfect", but rather it is fun and challenging to play against.

My friend was working on a chess variant for years, and it was very easy for him to make the AI be very, very difficult but that isn't fun at all! It would always win.

He then tried adding an element of randomness to it to dumb it down. But then the AI just looked perfect most of the time while occasionally making bizarrely dumb moves.

He later added "personalities" to the AI, where each one would try their own sets of strategies and attributes. He continued to make it better and better.

<comment><USER9> I'm curious if your friend's project is open-source at all, would love to see the implementation details of this?

<comment><USER8> It isn't open source, but you can still play it if you have Flash installed: [http://www.kongregate.com/games/thegrandestine/chess- evolved...](http://www.kongregate.com/games/thegrandestine/chess-evolved- online)

Imagine chess but with 100+ different pieces and an element of collecting/upgrading pieces.

<comment><USER9> Cool, thanks!

</comment></comment></comment></comment><comment><USER10> The risk of overcomplicating. You can put a lot of effort into detailed game AI which just makes for a hugely unfun experience. Something simple or predictable often leads to be better gameplay.

</comment><comment><USER11> I think any game with strategy is going to have to use reinforcement learning to have any hopes of being understood by its players. Concerns around cheesing strategies can be mitigated for real time games using constraints and cheesing in turn based strategy games is a symptom that maybe the game you're working on isn't that strategic.

Ultimately Chess, Go, Dota, Starcraft are compelling games to watch and play because the skill cap is so high. No hand coded AI for such a game could ever prepare you to enjoy playing any of those games professionally or get to a point where you can understand professional play. High level strategy in those games would never even be discovered had we not had a large population of players playing those games for long hours.

Odds are most strategy games won't be as successful as any of the above games but the newcomers could still have compelling strategic elements that gamers could explore had they been able to find other players that are slightly better than they are so they learn but at the same time aren't frustrated by too big a skill gap. A small multiplayer community is why the strategy game market is pretty bleak except for a few large players.

Reinforcement learning can provide a better experience to your players because you the game developer don't need be the world expert at the strategies of your game to create a top level AI. You just make sure the rules of the game are there and self play will take care of the rest. You can constrain the AI such that it's enjoyable by both your newest and most devoted players. You can discover OP strategies and better guide your design process. Excel is great for balancing but if you want to make a game complex enough then balancing will be a tremendous challenge without a larger team.

If you're interested in leveraging reinforcement learning for your game, I run yuri.ai which helps game developers do exactly that. So reach out to me at email@example.com if I can help!

<comment><AUTHOR> Thanks for your response, I had actually heard about Yuri before and was hoping you would respond to this post!

I have a lot of questions for you if you don't mind, maybe you don't want to answer any/all of them that's fine.

1\. How do you handle constraining the AI such that it's enjoyable? If you read through the comments here you'll notice just about everyone is saying the hard part is not making a good AI but in making a fun AI. Do you know of any research in this area? most examples I see are all about making the best AI possible. It seems like it's really hard to find a good reward signal to use for "fun". Have you seen this [0,1] paper on learning from human preferences? does Yuri attempt to do something similar? It seems like it would be labor intensive for the play testers.

2\. Does Yuri make use of imitation learning at all? I.E learning from lots of human data when it's available to bootstrap the learning process?

3\. Do you let the game designers impose any structure on the AI? I.E. "I want three phases for the boss where he progressively gets more aggressive" or use RL just for certain small parts of the behavior? A well defined path finding algorithm with the RL deciding where the agent tries to go? stuff like that?

I have a ton of questions about the technical details side of Yuri too, what frameworks are you using, which RL algorithms etc etc, not sure if you are willing to share those or not.

[0] [https://arxiv.org/abs/1706.03741](https://arxiv.org/abs/1706.03741) [1] [https://blog.openai.com/deep-reinforcement-learning-from- hum...](https://blog.openai.com/deep-reinforcement-learning-from-human- preferences/)

<comment><USER11> 1\. We use a couple of tricks for this, there's ideas from human preferences. There's modeling a reward function to maximize fun instead of pure performance, there's handicaps and a host of other tricks. Different tricks work better for different games but game developers can easily configure them

2\. It can, imitation learning turns RL into a supervised learning problem though from my experience it's not really needed. It's more of a if you already have it then you can make the training a bit faster

3\. Yes all the RL part becomes tuning a config file where the game developer needs to describe the task it wants to be accomplished

Regarding technical details, the infra is agnostic to the specific deep learning library you'd like to use and the algorithms are chosen based on the types of inputs (continuous vs discrete), size of the space (the end all of strategy games or a casual puzzle game) and type of game (full information vs partial information).

</comment></comment></comment><comment><USER12> GDC (Game Developers Conference) publishes a lot of great talks on YouTube about game design. Here are some of their popular AI talks:

[https://www.youtube.com/results?search_query=GDC+AI](https://www.youtube.com/results?search_query=GDC+AI)

</comment><comment><USER13> I programmed some new API functions for the AI scripting language in a popular RTS game once. I think the most tedious part is exposing the game data in an intuitive/helpful way for someone in a design role. It's a bit of an odd mix of optimization, computational geometry, and finding the right level of expressiveness.

For instance, a designer might say "It'd be great if I could put a tower between myself and the enemy town, but kind of at the border of mine, but only if I don't have enough money for a cool castle and I'm not overwhelmed." There's a lot of fuzzy logic in statements like those. The API between the game and the "AI" usually has to be general enough not to need spatial information, but also specific enough not to do things that feel unintuitive or silly to the player.

It's worth noting that machine learning helps avoid a lot of these issues, but I find AI tends to be designed for an feeling or experience, so I'm not sure if things like the Starcraft AI competition bots tend to make better products. Perhaps if ML could make the building blocks for designers to design AI?

</comment><comment><USER14> F.E.A.R. remains at the top of its class for the feel of the NPC behaviour, and it's worth understanding why.

[https://aiandgames.com/facing-your-fear/](https://aiandgames.com/facing-your- fear/)

</comment><comment><USER15> I'd love to do this as a career or sell Premade AI modules for games. Any ideas?

Would game developers consider contracting out the AI to a freelancer?

</comment><comment><USER16> No matter how dumb you make the A.I., you will have players complaining that it's too hard or unfair. I literally had the computer make a list of all possible moves and pick one out of the list at random for the default A.I. of one of my games and I got accusations that the computer was cheating on that difficulty level on a fairly regular basis.

</comment><comment><USER17> Watch the talk about Civilization's AI. Seriously, game AI does not need to use advanced ML techniques, and probably shouldn't if you want players to have fun. The trick is coming up with fast algorithms, with a semblance of personality to make it interesting. Difficulty is _not_ required for the AI to be fun in most cases.

<comment><USER18> What talk is that? Last time I tried a Civ game, I was underwhelmed. That AI just isn't fun to play against, to me. And the games run too long to play against humans in a reasonable timeframe on normal settings. I'd love to play Civ with competitive AIs.

<comment><USER17> "Playing to Lose" : [https://www.youtube.com/watch?v=IJcuQQ1eWWI](https://www.youtube.com/watch?v=IJcuQQ1eWWI)

Personal preferences aside, they specifically talk about how to make the game "fun". For example, they try to account for things like real-world leader's personalities. "Gandhi" shouldn't just attack his neighbors unprovoked, but maybe "Caesar" should.

And why do the AIs even bother to ally/trade/help the player at all, since the player is the only enemy that really matters anyway? Because the player is also the only person that matters in terms of having fun, and making the game too hard isn't any fun.

<comment><USER18> Interesting talk, but it really pretty much confirmed a lot of my assumptions about Civ AI. He pretty much admits that they are constrained on developer resources and AI code only makes of a small percentage of the game. Because of that, they have to make do with very naive assumptions about strategy. And because of that, they have to cheat to get the AI up to a level that's even considered fun.

At first I thought he seemed to be making a lot of false dichotomies, but really, he was saying, these are my only choices, given the overarching constraint on how much effort we can put into our AI. Basically, all of the AI decisions he talked about were small scale heuristics, with no ability to really look at the bigger picture, which is what the player is always doing when making small decisions.

And of course, personalities are a great idea, and not mutually exclusive with a strong AI. One thing I very much disagreed with was when he said an AI can roleplay, but a player wouldn't do that, the player just plays to win at all costs. But earlier on he even talked about one of the player types is people who play for a narrative. Those are roleplayers. So, especially at lower difficulty levels, it makes a lot of sense for the AI personalities to trump optimal play. But that doesn't mean you can't have a strong AI in general, that makes some limited sacrifices for the sake of fun.

Likewise with diplomacy. It isn't about making the game as difficult as possible. If that were the goal, you could just make the player lose when he loaded the game. It's about making it feel like you're on roughly even footing with your opponents, so that success has meaning. To that end, I would expect each empire to act in its own best interest, and therefore treat the player the same as it would any other opponent. It's also why diplomatic options need game mechanics to enforce them. As he pointed out, if there's no mechanic to stop a player from accepting money for peace, and then declaring war again, then there is no reason to every pay for peace. You should design these mechanics with player behavior in mind, and the AI should use them the same way players do. Think about how players behave with one another, make that fun, and then make the AI behave similarly. This wasn't possible given their constraints, but it's certainly possible in the more general sense.

As far as "making the game too hard isn't any fun" that's the problem. Too hard is subjective. What's too hard for one person is perfect for another, and way too easy for yet another. If anything, to please the maximum number of people, you'd have to write (or train) a very skilled AI that can compete with the brightest players. If you can do that, it should be much easier to tone it down or penalize it to make easier difficulties for the average and casual players.

</comment></comment></comment></comment><comment><USER19> I've never specialized in AI but from my experience on game teams most of the challenges revolve around making the AI 'fun' to play against, which is not generally very well defined. It's also about taking feedback from designers and playtesters and figuring out how to adjust the AI to address that feedback. Machine learning techniques aren't really used much in game AI, partly due to these aspects. It's not necessarily obvious how to adjust some black box ML model in response to feedback from playtesters on balance issues or from designers on making the AI more or less 'agressive' or other qualitative feedback. Usually it's more a collection of rules and heuristics with various parameters that can be adjusted to tune the behavior and allow for different difficulty levels etc.

</comment><comment><USER20> I always thought it would be an interesting to write an AI for a shooter like Call of Duty or Halo, which is trained on real player data, according to your skill level. Most FPS games already record match data, so the dataset is available. What might happen is that the AI might evolve as the player meta evolves, and would learn what types of maneuvers work in certain situations, it would know average accuracy for a skill level to adjust itself, etc. It would also allow the game to fill in low player population, e.g. during a low traffic time or for a player with a ping that is too high, with bots that act human-like. Maybe wishful thinking, but I always thought it was an interesting thought.

</comment><comment><USER21> Like others have said, balancing play-ability is hard. Another problem is users may perceive the AI cheats which hurts fun.

But I'd say another hard thing is that every game needs a different approach to AI. Some need path finding, which is well documented. Others need resource balancing which is less so. The newer and rarer the game mechanic, the more novel the AI.

I would say Machine Learning is not useful except in a handful of games and if yours is not in that category, you risk spending a lot of time for little pay off. And even if in those categories, ML will be working to win not to maximize fun so they could end up being too good or to cheaty looking.

</comment><comment><USER22> One big issue I can imagine with applying ML is that most games are buggy and poorly balanced, but the majority of your players arent optimizing machines (outside of speedrunners), and will follow "natural" paths, so its fine.

The only kinds of games that see enough time and resources to the same issues that would trap an AI in some optimal but horribly boring strategy (or rather, "unfair" strategy) would be competitive multiplayer games — and even then, only those that can classify for e-sports. That is, those games who already treat players (or rather, the wetware community optimization machine) the same as they would treat your ML AI.

</comment><comment><USER23> I've been thinking about this a lot, too!

Honestly, I think the most challenging factor is that when you are working on machine learning for your game.... you aren't really working on your game. i.e., you're not writing storylines, creating visuals, audio, programming general interaction, etc. Machine learning (if you don't have a ton of experience) can be super time consuming and unless your game is 100% based around the sole idea that it is ML.. all of that time is taken away from the rest of your game.

<comment><AUTHOR> Yes I agree, I think the idea here is to provide applied machine learning as a service to game devs.

</comment></comment><comment><USER24> I actually think there would be value in having machine-learning / AI in a game that would dynamically try to match the human player's skill without overwhelming the human player. The goal would be to maintain parity such that the human's player response would always be "I was this close, and I could have done X, Y, and Z" as opposed to "I had no chance".

</comment><comment><USER25> A friend is working on a solution for this. Check it out [https://yuri.ai](https://yuri.ai)

<comment><USER26> Why is it named Yuri, if I may ask?

<comment><USER25> After Yuri from command and conquer.

</comment></comment></comment><comment><USER27> IIRC, the developers of Final Fantasy XII said in an interview that the Gambit system that the player uses to set the behavior of their computer controlled party members is basically just a GUI representing the same logical structure used behind the scenes for enemy behavior.

<comment><USER28> I love that Gambit system and wish more games would adopt similar systems. The Rules based approach allows complex behavior to emerge from a relatively simple set of rules. Although this is a per-unit approach, in combination with an overarching management AI, this could be very engaging.

</comment></comment><comment><USER29> What I understand from machine learning is that the actual learning takes a lot of compute power and learning data. So you can't have and AI that adapts during gameplay. The AI will "just know the optimal move for any given play state.

<comment><USER18> If your game doesn't give competitors perfect knowledge of the game state, it would make sense for the AI to track previous activity of its current opponent as part of the 'play state' for making decisions. For instance, if it doesn't know where the enemy is, but the enemy has attacked from this direction every time so far, it would prepare for another attack from that direction. Or if the last time the AI made a given offensive move, the player countered effectively a certain way, it may modify its next offensive to overcome that counter. The longer the game, the more it could appear to be learning to counter its opponent, even though, as you say, it's just making the optimal move given the current state of play.

</comment></comment><comment><USER30> Stopping it from making a base an Antarctica which players can't invade due to a bug

</comment><comment><USER31> My guess is you want it challenging but not too hard.

</comment><comment><USER32> _Mixing Concepts_

The biggest surprise I have found on this subject is this strange entanglement of ideas between "AI designed to kill the player" ("Military" AI), and "AI designed to make the game fun ("Game" AI). This is like comparing a F-22 stealth fighter to a 747 commercial airliner -- sure, both are technically "jets", but they serve ___completely_ __different functions.

The only AI we should be talking about here is AI designed to make a game more engaging and enjoyable for the player. That may include __emulating __a __tiny __bit of behavior that __resembles __military tactics, but only where games use that as a topical facade -- unless you play The Sims _waaaay_ differently than I do.

 _Easy Mode_

There are several posts here where people assert that "they don't want a game to be hard, that would be bad". As a counterexample, I would invite these individuals to view the awards, testimonials, and revenue from the ["Souls"]([https://en.wikipedia.org/wiki/Souls_(series)](https://en.wikipedia.org/wiki/Souls_\(series\))) series (Demon's Souls / Dark Souls). I have spoken to psychology experts at game development conferences, as well as professors that explicitly study psychology in games -- and they are still struggling to define and quantify the exact elements that came together to make this series such a hit. But there is no denying that it is an absolute favorite, with a huge following, and tremendous profits to prove the efficacy of the model.

Obviously, I'm not advocating that "every game should have a Souls-style difficulty curve". That series caters to a specific audience -- and there are an ocean of subtle differences between fans of the series. The point is: broad statements like that go directly against a mountain of evidence. We need to think about this issue with its full (tremendous!) complexity, and how to leverage some immense computing power to address it. Speaking of which...

 _Based on your Purchase History..._

Right now, companies like Amazon and Google are mashing up the entire history of everything you've purchased, every web page you've ever visited, along with demographic and social media data about you. They can then deliver a product recommendation / advertisement / etc. within milliseconds that targets _your_ specific needs, ___even for things you didn 't realize you wanted / needed yet_ __.

If that can be done in milliseconds, then the same principles can be applied to tweaking the difficulty for players in real time. You don't even need to maintain a hot internet connection to constantly feed some huge cloud implementation at all times -- some local processing combined with daily or weekly micro-updates can do the trick. For a perfect example of local / cloud balance, check out SnapChat -- that thing uses the local computing power on your _phone_ to identify your face, and then attach various 3D objects and effects to it __in real time __. That 's done at 20-30 FPS on a smartphone _without_ any special dots or markers to help "anchor" the models. That's amazing. And it's all possible because the [Convolutional Neural Network]([https://en.wikipedia.org/wiki/Convolutional_neural_network](https://en.wikipedia.org/wiki/Convolutional_neural_network)) models that make that possible get trained on the cloud and downloaded every now and then.

So, yes -- you _can_ code a game to dynamically customize itself for every single player. This is the [exact point of my video series]([https://www.youtube.com/watch?v=hTDSGU2vAow](https://www.youtube.com/watch?v=hTDSGU2vAow)) about this subject. Thus far I've made over a half-dozen Skyrim mods that demonstrate some of these concepts, and our team is expanding into other games that are finally opening up their engines to 3rd parties. If folks would like to talk about the nitty-gritty of all that, I'm happy to chat.

</comment><comment><USER33> None of those (e.g. lighting, physics, graphics) are truly difficult today with the advent of modern game tools (e.g Unity). Assuming you know basic vector math and can think in 3 dimensions, most problems related to sound, physics, graphics etc can be solved by some Googling.</comment>


Social Steganography: Learning to Hide in Plain Sight  - <AUTHOR> http://www.zephoria.org/thoughts/archives/2010/08/23/social-steganography-learning-to-hide-in-plain-sight.html

<comment><USER2> I don't know, it seems like a lot of trouble to work around a problem caused by the medium (facebook).

<comment><USER2> And, I know she's using the term loosely, but in general steganography does not require a loss of information. "Always look on the bright side of life" conveys much less information than "I just broke up with my bf".

</comment></comment><comment><USER3> Funny, this URL is _exactly_ the same as the one posted yesterday: <http://news.ycombinator.com/item?id=1630579>

</comment><comment><USER4> Facebook lets you restrict visibility on any post to a list. So this is umm a bit pointless really.

<comment><AUTHOR> Facebook was just used to give an example of where/why/how people apply social stenography.

edit: add a 'why' and a 'how'

<comment><USER5> But what's not added is -- it doesn't work that well.

Human beings have always sent multiple messages to multiple people to keep an equilibrium between multiple types of social connections.

But the problem is that this approach doesn't scale. The more groups you are in, the harder it is to send multiple messages simultaneously and effectively.

<comment><USER3> Political speeches are great at this. They use words and phrases that mean different things to different groups of people. And it scales to millions of people.

</comment></comment></comment></comment><comment><USER6> That's been tackled exhaustively long ago:

[http://www.youtube.com/watch?v=ifmRgQX82O4&feature=relat...](http://www.youtube.com/watch?v=ifmRgQX82O4&feature=related)</comment>


Apple's new deal for journalism should send publishers running - <AUTHOR> https://www.theverge.com/interface/2019/2/13/18222498/apple-news-publisher-deal-50-percent-lol <comment><USER2> I think tech several pundits predicted Apple would shift significantly to more rent-seeking behavior after the last quarter decline in iPhone sales. This appears to be confirmation of that trend.

</comment><comment><USER3> The Apple Tax continues to rise. Sadly, many publishers will run to it, not having learned the consequences from the Apple app store or YouTube Red. They will enrich Apple greatly and fight over the scraps Apple leaves for them.</comment>


Deprecating password authentication in GitHub API - <AUTHOR> https://developer.github.com/changes/2020-02-14-deprecating-password-auth/ <comment><USER2> Wondering when they will start with implementing proper access controls on their API's. At the moment, a personal access token does have scopes, but it is quite limited:

\- Repo access is all or nothing. A read-only token is not possible, an 'issues-only' token is not possible.

\- Personal access tokens are not scoped to repositories or organizations. So your personal toy project token also allows access to your super-sensitive employer's repository. On top of that, your employer is unable to prevent this, unless you start using Github Enterprise _and_ an SSH CA, which is far from trivial.

It's nice that they drop username/password access, but as long as personal access tokens have such broad permissions, it does not really add any value (you should have been using 2FA anyway).

<comment><USER3> What is really weird is this isn't quite correct, they do have scoped personal access tokens, you just can't make them. If you use GitHub actions, it generates a scoped PAT that only works for that repository for your actions to use.

I use deploy keys rather than a PAT as they can be scoped (single repo and can be read-only), but they are more work and are limited to git actions rather than the whole GitHub API.

The fact they clearly have the internal capability for this makes it incredibly odd they aren't exposing it for users to use, and I agree it'd be a really valuable thing to have.

<comment><USER4> GitHub Actions tokens are actually based off our newer "GitHub apps" system and not "OAuth apps". GitHub app tokens support much more granular controls (both in terms of abilities and resources). OAuth doesn't lend itself to super granular controls since they are scope based (ex. Defining a scope per repository doesn't really scale). This whole area is something we want to address with personal access tokens in the future.

</comment></comment></comment><comment><USER5> > During a brownout, password authentication will temporarily fail to alert > users who haven't migrated their authentication calls.

This took me a second to correctly parse. Would have been better written as: "During a brownout, password authentication will temporarily fail. This is to alert users who haven't migrated their authentication calls."

<comment><USER6> This confused me too. It also confused me that they only occur for 3 hour periods on 2 specific days. You wouldn't be "alerted" unless you happened to attempt login during those windows.

Can anyone provide more context for this deprecation strategy?

<comment><USER7> Best to compare Brownout to other strategies that get to the same end result. The goal is that this feature (password authentication) goes away. A common default is a flag day. There's an announcement (maybe now) and on a set date that feature just goes away.

For users who pay attention (say, us) and prioritise accordingly these strategies are the same, they know the feature it going away and can plan for that.

But for users who weren't paying attention or who didn't correctly prioritise, adding a Brownout offers some final warning that helps push more people to start preparing before the final flag day happens.

It doesn't need to get everyone, if 80% of users whose business processes still depend upon password authenticated GitHub notice something went wrong, and during diagnosis discover that what went wrong is they're relying on a deprecated feature, that's a big improvement over 100% of those processes dropping dead on flag day.

Brownout is a desirable choice where you're sure that some large population will not heed the advance notice. I bet that a lot of corporate GitHub setups have all contact mail from GitHub either going to /dev/null or to some business person who hasn't the first clue what "password authentication on the GitHub API" is. Maybe they'll email the right dev person, maybe they forward to an employee who left six months ago, either way it's far from certain anybody who needs to take action will learn from an email.

With UX feature deprecation you can tell the live users of the service. But in APIs even if you notionally have a way to feed stuff back (like a "warnings" field in the results) it's probably blackholed by lazy programmers or lands in a debug log nobody reads. So "It stopped working" is the best way to get attention, but without a Brownout that's permanent. The user learns what's wrong too late to do much about it which sucks.

Brownout is something ISRG's Let's Encrypt has used, because of course Let's Encrypt is largely an API too, they publish feature changes but a huge fraction of all their subscribers aren't paying attention so the Brownout is the first they'll know anything is happening that matters to them.

<comment><USER8> > Best to compare Brownout to other strategies that get to the same end > result.

Sure, the isolated period blackout ("brownout" is a bad metaphor) of the deprecated function has some obvious communicative utility compared to flag day, but once you accept shut-off for communication, it kind of immediately suggests communication methods that have a stronger guarantee of reaching the audience, like progressively frequent blackouts (or probabilistic denials) over a period of time leading to total shutoff.

</comment></comment></comment></comment><comment><USER9> What is not secure about using HTTP basic auth over a properly secured HTTPS connection?

<comment><USER10> Haven't read the article yet but I will be surprised if it claims that. I would imagine it's more about using your primary means (password) of authn which has worse consequences than using a secondary, revocable means (token) upon compromise.

<comment><USER9> The blog post[1] that the article links to does state:

>> We are announcing deprecations that will improve the security of GitHub apps and APIs

[1] [https://developer.github.com/changes/2019-11-05-deprecated-p...](https://developer.github.com/changes/2019-11-05-deprecated- passwords-and-authorizations-api/)

<comment><USER4> It's not at all about the security of delivering credentials over https, but more about the the complexity of trying to defend against weak passwords/credential stuffing with an api. For example, it's more or less impossible to add a defense in depth flow like [https://github.blog/changelog/2019-07-01-verified- devices](https://github.blog/changelog/2019-07-01-verified-devices) to an api.

<comment><USER9> > it's more or less impossible to add a defense in depth flow like > [https://github.blog/changelog/2019-07-01-verified- > devices](https://github.blog/changelog/2019-07-01-verified-devices) to an > api.

Except that email, as described in the blog you linked to, is not a secure means of communication. What would be secure is to use a client side TLS certificate as part of the authentication process. That is, your browser/device sends it as part of the TLS connection negotiation process and then you authenticate via the username and password (via HTTP basic auth).

They're already doing something like that whenever one pushes or fetches from a git repository hosted on Github through ssh key authentication. It wouldn't be much of a stretch for Github to allow an account holder to upload a CSR and then Github signs it and makes a certificate, which the account holder can then add to the browser's or OS's certificate store.

<comment><USER4> The verified device flow isn't meant to be as strong as 2FA, but is a very strong mitigation against mass credential stuffing attacks for all users.

In terms of client certs, see my response in [https://news.ycombinator.com/item?id=22849985](https://news.ycombinator.com/item?id=22849985). I agree client certs would be great. However, it can be tricky to couple your app logic with transport based security. A good example of this...chrome/google introduced a crazy cool concept called "channel bound cookies" - [http://www.browserauth.net/channel-bound- cookies](http://www.browserauth.net/channel-bound-cookies), but it never gained any traction because of the complexity noted.

</comment></comment></comment></comment></comment></comment><comment><USER11> Feature request: allow association of the same ssh key with multiple accounts.

In essence stop using git username globally and start supporting user names.

<comment><USER12> I was once told explicitly by GitHub Support (just as a reminder) that one person having multiple accounts is against their TOS, so there's that. (This was years ago, not sure if TOS has changed in this aspect.)

<comment><USER13> wat

Never heard such a restriction even mentioned, let alone enforced.

<comment><USER12> Well you just heard. At least they say "we do not recommend creating more than one account" at the moment. [https://help.github.com/en/github/getting- started-with-githu...](https://help.github.com/en/github/getting-started-with- github/types-of-github-accounts#personal-user-accounts)

Enforced — of course not (guess why I was told), but it stands to reason that they probably won't add a feature to facilitate TOS violation.

<comment><USER11> GitHub is not what it used to be when this "restriction" was made. These days, where a lot of companies decide to go with github, it's not uncommon for people to have one personal account and one work account.

This becomes messy to manage, as it's not easy(as far as I know) to use the same account on your personal PC to do both personal and work work.

</comment></comment></comment></comment></comment><comment><USER14> Is anyone else bothered by the use of "deprecating" to mean "removing"? Historically, deprecated features are ones that still exist, but their use is discouraged.

<comment><USER15> And it does still exist, until November. Deprecation is a transition period, instead of just removal without warning, but without future scheduled removal then deprecation would serve no purpose.

</comment></comment><comment><USER16> What I'm most worried about is the deprecation of Personal Access Tokens because I have yet to find the equivalent for doing something like "Create a Deployment with a single cURL request to the Github API" that will work past September.

I wish they replaced it by tokens tied to specific repos and with scopes instead of that new Webapp Flow thing that looks a lot more complicated to implement than a curl request (I had planned to look into it this month, but obviously other worldwide events took priority).

</comment><comment><USER17> I think the auth method is slightly less important than the offered feature set. F.ex. you cannot ask if a specific user has sponsored you and for how much. This is probably the ONLY important feature to have an API for!

The only way to get this data now is to paginate through all sponsors with their GraphQL interface!

</comment><comment><USER18> > All password authentication will return a status code of 401...

I've always found it strange that an HTTP 401 is used to indicate two very different server-side states:

• "this resource requires authentication, and you didn't attempt authentication"

• "as an early step in the request flow, you tried to authenticate yourself—but your authentication failed (due to e.g. having an unrecognized username; or using the wrong authentication method; or, of course, having the wrong password)"

I mean, I get it; in the end, after trying and failing to authenticate, the request-processing continues (with the "auth" field in the server's model of the request state being nil, just like it would be if you hadn't attempted auth); and the request you're making at that point is still an attempt to request an authentication-required resource. You're "not authenticated" at that point, so 401 it is.

But it really seems like auth processing should have its own "off ramp" in the HTTP request-processing lifecycle—i.e. if you ask for auth, and auth fails, you get a code and the request isn't processed any further, so it doesn't matter that the request you made is auth-required.

(After all, we mentally model HTTP resources, fundamentally, as URLs; and URLs put the auth stuff in the _origin_ part, not in the _request sent to the origin_ part. I would naively expect that an auth failure would resolve at the same stage as an unrecognized Host name!)

When you're coding an HTTP client, it's very hard to debug a corrupt Authorization header, because all you know, when you have anything even slightly wrong, is that the server is pretending it didn't see it!

\-----

And yeah, I know, in practice, why this isn't the way things are. Historically, one of the first uses of the Authorization header was through Apache's mod_auth_basic, which refers to an .htpasswd file in a directory to determine the set of valid auth credentials for all resources descending from that directory. In this model, auth is resource-specific, rather than server- specific; so it makes sense that, if you're sending auth, and auth is unrecognized, but the specific resource you're authing _against_ turns out to not _require_ auth, then the server can proceed just fine without sending you a 401.

However, I don't think there's any modern use-case where auth is resource- specific like that. HTTP auth "realms" are almost always per-origin these days. It makes a lot more sense to think of auth as something happening at the level of an implicit _HTTP gateway_ between the client and the server ultimately sending the resource, where the gateway can know what server (realm) the client wants to route to—and so can auth the client on that basis, and deny the request if that auth fails—but the gateway _can't_ know anything about what the auth requirement policies are for individual resources on the backend it's sitting in front of.

<comment><USER19> Separating those cases expsoses the existence of an object, even if you can't access it.

Whether that matters is up to you, but I get the impression most people just default to not exposing existence. There is 403 which helps split these.

<comment><USER10> How does 403 help? Isn't that for when authentication worked but authorization didn't?

<comment><USER18> Correct. You're supposed to send 403 only when 1. you've successfully "logged in" with a set of credentials, but 2. the user that those credentials map to, doesn't have rights on the resource. If you haven't authed at all, and there's a resource there _requiring_ auth, you're supposed to send 401.

<comment><USER20> This usage of 403 should be used carefully. It's often (probably usually) the case that you still don't want to expose existence of a resource even to an authenticated user who is not authorized to that resource. It's generally better to return 404 in that case.

<comment><USER21> The distinction is whether the resource is owned by another tenant or not. Often a user can view a resource but aren't allowed to edit it, at which point 403 is correct. However if it's something owned by another tenant entirely, and is not public, then a 404 is correct.

</comment></comment></comment></comment></comment></comment><comment><USER22> Might want to update the title to indicate that this is for the API.

<comment><USER23> Agree. The omission makes the title sound more sensational than it is. Token- only API authentication is not uncommon.

</comment></comment><comment><AUTHOR> Thanks for comments !

</comment><comment><USER24> Everything is getting more and more complicated for hobbyists over time. Mandatory HTTPS certs coming eventully, APIs forcing more convoluted authentication methods, GDPR compliance (probably going to scare away a lot of people from doing anything like writing a twitter clone hobby project, or even static sites where they might have to spend extra time configuring access logging) and other burdensome laws like the one from California, getting whined at if anyone catches a whiff you use passwords to log into SSH. So many barriers that less people are going to end up participating.

<comment><USER25> > APIs forcing more convoluted authentication methods

It's not really that convoluted: it's just setting a header with a fixed token, which is actually simpler than HTTP auth.

</comment></comment><comment><USER26> Slightly alarming that github has allowed username:password on api calls up to now- they have definitely kept quiet about it

</comment><comment><USER27> Breaking apis, is breaking apis. Even for security reasons.

Removing something that works is not, in itself, "improving" security. It is breakage in the holy name of security.

If you have broken your system in the name of security it is not a more secure system. Its just a broken system that does not do its job. It might be "more secure" when users fix api usage, in the mean time its useless and is going to cost everyone time & money to fix.

It might makes more sense in the long run to move to something with a stable api.</comment>


Ask HN: Should I invest time into learning a terminal-based workflow? - <AUTHOR> I currently run Linux and do most things on the command line, except web browsing (Firefox), chat, email (Thunderbird), and text editing (vscode).
I've seen some people do everything in the terminal. Should I learn vim or emacs? Use a TUI email client? Uuse TUI chat clients? Why?
It will probably be a long time till I'll have another opportunity to invest time into something like this. <comment><USER2> The main reason I use vim is because I sometimes find myself working remotely on a foreign system. I know vim will always be available, that I am infinitely more productive with it, that it works with ssh, and that it requires modest resources.

If you don't find yourself in the situation from time to time, the only reason I can imagine you might prefer to learn vim is the insane productivity boost. Being able to do a vast amount of work from home row is a big deal to me.

Is it your impression that your working life is somehow less effective than it would be if you used these tools? If not then you simply don't need to pick up that particular skill.</comment>


Norwegian municipality loses 25 000 classified documents in the mail - <AUTHOR> http://www.nrk.no/nordland/minnepinne-med-flere-tusen-personopplysninger-sporlost-forsvunnet-1.12303870

<comment><AUTHOR> English summary: When Rana municipality changed archive system they choose to send 300 000 documents, of with 25 000 was classified, on an usb stick trough snail mail. When the envelope arrived it was torn, and the usb stick was missing. The Rana City manager warns any finders that it is a criminal offense to misuse data one does not have legal access to.

Since that does not state that the data was encrypted we can probably assume that it was not.</comment>


REI to sell sprawling new and unused headquarters to shift to remote work - <AUTHOR> https://www.cnn.com/2020/08/13/business/rei-sell-campus-coronavirus-trnd/index.html <comment><USER2> I know personally at least two employees who left REI when they announced plans to move to these headquarters a few years back. Then, remote work wasn't an option for employees and they didn't want to have to start commuting through Bellevue traffic (previous location was in Kent) or move to Bellevue (a significantly more expensive area). The attitude seemed to be that the wealthier people in upper management made the decision to move at the expense of "regular" employees. Glad for their current employees that this is happening, but it seems a little late.

</comment><comment><USER3> Assuming more and more large corporations begin to do this, is there a particular sector that can take advantage of all of these empty office buildings?</comment>


A statement from, actually, Louis CK - <AUTHOR>

I love it when people I perceive to be famous take the time to personally reach out to a couple of thousand people like this, so I thought I'd share for those who didn't opt-in.
Hi.  This is LOuie.  It seriously is me. Im even going to leave the O stuipdly capatalized because who would pay an intern to do that?? Okay so you bought the thing with my fat face on it and you clicked the button that said i could email you. And i know that now you are thinking "aw shit. Why'd i let this guy into my life this way?". Well dont worry. Because i really swear it that i wont bug you. I will not abuse this privalage of having your email. You wont hear from me again... Probably, unless i have something new to offer you. The reason i'm writing now, in the back of a car taking me to the Tonight Show set, is to let you know that as of now there is some new and cool stuff on my site, related to Live at the Beacon Theater. Theres a thing where you can download and print a dvd box cover and label so you can burn and make your own dvd of the video. And theres a new option where you can gift the special to as many people as you want (for 5 bucks each) and they'll get a nice gifty email from you with a link to the video.
Also, some of you may know, i recently made a statement (that sounds so dumb. Like i'm the president or something) about how the video has been doing online. Im pasting it in here below in case you missed it.
Lastly I'm planning to put some more outtakes of the show on youtube and i think i will put one on the site that is only available for free to you folks on this list, who bought the thing and opted in. But dont hold me to that because really i just thought of it and typed it.
Okay well please have a happy rest of the year and more happy years after that. And please even have been happy in your past. What?
Thanks again for giving me 5 dollars. I bought 3 cokes with it.
Regards. Sincerely, Actually,
Louis <comment><USER2> Louis, don't buy the cokes, you are already fat. :)

I bought Louis' work yesterday. And hats off to the performance.</comment>


Ask HN: iOS app using WP as back end. Doable? - <AUTHOR> I have a small niche marketplace online business , its one man shop. It's running on WP. I want to build an iOS native app(SWIFT) while still using a WP Backend.  I can't afford a custom backend. I have a buddy who is a SWIFT dev with a day gig, he will give me a reduced rate. Im comfortable with WP. To avoid the 30% apple fee. I want to charge customer for their product listing inside the APP in WEB via email after they upload images + summary of product listing (pending approval) I get a notification ( via email) of new Listing and email customer a STRIPE payment link, they pay and THEN I make the listing live in the APP. I would LOVE some feedback from the community on if something like this doable , someone who has used WP as CMS for an iOS app and charged in WEB.  Thank you. <comment><USER2> WordPress is just PHP, so yeah it's doable but not pretty. How comfortable are you with PHP?

Have you looked into low/no code solutions? - that workflow would be pretty doable with something like AirTable or an Azure Logic App.

<comment><AUTHOR> I have a dev who can / will do it. Our website is in WP right now.

</comment></comment><comment><USER3> WP as CMS - easy, [https://developer.wordpress.org/rest- api/](https://developer.wordpress.org/rest-api/)

If you are selling physical items, the Stripe iOS integration is really simple.

If you are doing digital items or functionality or services, you are required to use the IAP API and pay the fee.

<comment><AUTHOR> No physical product. we sell Ads , We charge a listing fee to list your product that you are selling.

<comment><USER3> Then that sounds like you owe Apple the % if you want to be on their platform.</comment></comment></comment>


Predictive AI Doubled Site's Traffic and Rankings - <AUTHOR> http://blog.marketmuse.com/how-marketmuse-helped-neil-patel-double-his-traffic-and-rankings <comment><AUTHOR> Interesting approach to content creation and optimization. Will be fascinating to see in different contexts.</comment>


AU metadata laws under fire as 'authority creep' has more agencies with access - <AUTHOR> https://www.abc.net.au/news/2018-10-19/authority-creep-has-more-agencies-accessing-your-metadata/10398348 <comment><USER2> Was posted here a couple of days ago, but the headline has since changed: [https://news.ycombinator.com/item?id=18261235](https://news.ycombinator.com/item?id=18261235)

(might just be posting this so my comment on the other thread isn't entirely wasted)</comment>


Boing Boing will go dark on Jan 18 to fight SOPA - <AUTHOR> http://boingboing.net/2012/01/14/boing-boing-will-go-dark-on-ja.html?utm_source=dlvr.it&utm_medium=twitter <comment><USER2> Simple piece of code to put in your .htaccess if you want to join in:

      # RewriteEngine on (enable if you don't have it yet)
      RewriteCond %{TIME_YEAR}%{TIME_MON}%{TIME_DAY} ^20120118$
      RewriteCond %{TIME_HOUR} >7
      RewriteCond %{TIME_HOUR} <20
      RewriteRule ^(.*)$ http://sopastrike.com/ [L]

This will redirect any request, to your protest site of choice on Jan 18th, between 08:00 and 20:00 (local webserver time). Assuming Apache of course!

<comment><USER3> I have a feeling sopastrike.com will go down that day. What about you?

<comment><USER2> If everyone would redirect to sopastrike.com, yeah :) would be good to set up a generic black page with simple explanatory text somewhere, hosted on something nice 'n scalable.

</comment></comment></comment><comment><USER4> January 18 is shaping up to be my most productive day ever.

<comment><USER5> I agree!

</comment></comment><comment><USER6> _Big Content haven't just declared war on Boing Boing and Reddit and the rest of the "fun" Internet_

If it's war, then we ought to develop some kind of offensive strategy.

<comment> daniel-cussen Repeal DMCA!

<comment><USER7> And cancel the _last_ 20 year copyright extension. Better yet, overhaul the copyright laws, leave copyright to 10-20 years only, just like it was originally, and strengthen the fair-use laws. Allow anyone to take any creative work and remix it however they want as long as it's for non- commercial purposes.

It's time to get pro-active rather than re-active every time they come out with a new bill. Let's change _their_ laws before they change ours.

</comment></comment></comment><comment><USER8> Reducing the usefulness of the Internet sucks as tactics go.

SOPA advocates are taking the war to the legislative process since they're losing elsewhere. Let's answer by raising the political stakes: organize instant protests, flashmob their buildings, name and vocally shame the supporters.

<comment><USER9> <http://nytm.org/sos/> has what you need: NYC protest at the offices of Sens. Schumer and Gillibrand for their PIPA endorsements.

We want more cities to come on board. Can you help?

</comment></comment><comment><USER10> We need a StartupPAC

</comment><comment><USER11> By blacking out, do they mean actually removing all content for that one day, or just something symbolic like applying a dark theme on their site?

<comment><USER12> The most they'd ever do is a stylesheet change or an overlay on top of the text. Actually removing their content, for even a day, would irreparably screw up their search traffic in the future. Any site that big is being constantly revisited by Googlebot.

<comment><USER13> Conceivably, we could serve the normal site to search engine spiders and black it for everyone else. However, we have a complex load balancing setup that may make this impossible.

An all-black theme would do the trick, but redirecting using Temporary Redirect shouldn't screw up search if we do it right.

<comment><USER14> Your best option would be a 302 redirect to a SOPA-specific page. Google won't follow that and it shouldn't screw your search engine rankings. At least, that's how I understand it.

<comment><USER15> I wouldn't really want to count on that; Google tends to guess what common response codes mean. The safest response would probably be to use "503 Service Unavailable" with an error page.

</comment></comment></comment></comment></comment><comment> Tim-Boss Does anyone have a link to the latest list of websites taking action on the 18th?

<comment><USER16> Mentioned at the end of the article: <http://sopastrike.com/>

<comment><USER17> Not reliable. There seems to be little if no policing of the submissions, so sites like Facebook and Google are on the list several times and likely submitted by jokers.</comment></comment></comment>


Anyone using cheap CDNs? Me likes SimpleCDN - <AUTHOR> http://www.simplecdn.com/

<comment><USER2> The owner of SimpleCDN struck me as a bit flaky and rude. When I searched then for reviews of SimpleCDN you'll see some red flags in the way he responds to other people.

I asked something about this myself a long while back: <http://news.ycombinator.com/item?id=181010>

If you have your "showdead" flag on settings, you'll see some comments there that are kind of anti-SimpleCDN from people who had commented on nothing else before and/or just signed-up that day to comment. I'm not sure whether that's someone trying to discredit them or just a coincidence.

We considered using them (and played with their service a tad), but Cloudfront has been working well enough for our needs (since we also use S3 a lot).

<comment><USER3> +1 for Cloudfront. I've been pleased with it so far, especially considering how easy it was to set up. My biggest downside is that they don't support https, which can be a deal breaker for some people.

</comment></comment><comment><USER4> One advantage that SimpleCDN has over Cloudfront is that it support http pseudo-streaming of flv and h264 video. I wrote some notes on it here:

[http://www.brightyellowcow.com/blog/Video-Streaming-Be- your-...](http://www.brightyellowcow.com/blog/Video-Streaming-Be-your-own- YouTube.html)

</comment><comment><USER5> We've used CacheFly and have been really happy. The price is right and at our low number of transfers it always maxes out the customers downstream pipe. The only issue we've had is some of our customer's internal firewalls have blocked one of our files that 5GB+ but I guess that would happen not matter which CDN we used.

</comment><comment><USER6> I've used CloudFiles from Rackspace. It does the job

<comment><USER7> I use CloudFiles as well, and I've been 100% satisfied. They use Limelight for CDN, which is amazing for the price.

<comment><USER8> If CNAMEs worked I would be sold.

</comment></comment></comment><comment><USER6> It's a bit of a hack, but if you upload something to google app engine, isn't that kind of a CDN?

</comment><comment><AUTHOR> It could always be cheaper of course. Please share your experiences with this or other CDNs.

<comment><USER8> SimpleCDN change their pricing structure often. I've also experienced quite significant amounts of downtime.

Also their routing system routes me to Chicago even though I'm based in London.</comment></comment>


Gut microbes regulate neurons to help mice forget their fear - <AUTHOR> https://www.nature.com/articles/d41586-019-03114-1 <comment> Pick-A-Hill2019 from the article - "The microbiota-deficient mice were unable to update their response, and showed persistent fearful behaviour long after control animals had adapted. Chu et al. found the same phenomenon in mice that had been raised germ-free in sterile isolators and so had never developed a gut microbiota." Seems conclusive enough though I wished they gave further details about the microbiota and whether something like fecal transplants were effective. The supporting DOI document is 404 at the moment.

(personal note - although animal research troubles me ethically I accept that there are few alternatives to it currently, although Cerebral Organoid research is proving interesting. Link if interested [https://www2.mrc- lmb.cam.ac.uk/group-leaders/h-to-m/madeline...](https://www2.mrc- lmb.cam.ac.uk/group-leaders/h-to-m/madeline-lancaster/)).</comment>


Ask HN: Ideas for making life an adventure for kids, without technology? - <AUTHOR> What are some awesome ideas to make life an adventure for kids, and fun for everyone involved too? Specifically looking for ideas that have zero technology involved. <comment><USER2> By tech, I presume you mean programmable devices. I mean, everything in your life is from some sort of technology!

In my part of the world, wild blue berries and huckle berries are in season. Go find some woods and seek them out.

Try camping! Or volunteering at a farm.

Build a book case with them. Or a loft bed. Or something simpler like a bird house.

</comment><comment><USER3> Over vacation last month I cut up a couple hundred feet of PVC pipe,got a bunch of fittings, and then the cheapest, biggest piece of cloth from the craft store. My nieces and nephews made some pretty cavernous forts with it! (I think the cost was around $150).

</comment><comment><USER4> Without technology? You are on hacker news bro.

</comment><comment><USER5> Treasure hunts!</comment>


A Board with No Women Is a Sign That You're Not Making Good Decisions - <AUTHOR> https://www.linkedin.com/pulse/board-women-sign-youre-making-good-decisions-adam-bryant/ <comment><USER2> It's not really a sign of anything. Decisions should be made on who is best for the job, not gender or skin color.

Forcing diversity (which lets be honest..an entire board of women is not 'diverse') only proves that a specific gender or minority can't get the job on their own.

<comment><USER3> I've also heard the case of a survivorship bias where most startup founders are men, since men are more risk taking in general (or at least the standard deviation on risk taking is a lot larger), and that these companies start looking less risky when they are already fairly successful

</comment></comment><comment><USER4> A board without a woman is like a fish without a bicycle.</comment>


Paul Walker Died - <AUTHOR> http://www.cnn.com/2013/11/30/showbiz/actor-paul-walker-dies/

<comment><USER2> It is such a loss to the movie industry and considering his popularity in f&f movies and the fact that he died in a car crash its more painful. He will be missed always as an actor we will miss you paul, RIP paul.</comment>


Walking man animation using only CSS3 - <AUTHOR> http://andrew-hoyer.com/experiments/walking/

<comment><USER2> I have been downvoted for saying something along the lines of this before, but: I am extremely frustrated with all those CSS3 and WebGL demos on HN. I have yet to see anything that wasn't possible 10 years ago as a native app or as a Flash program. There have been at least 10 of those demos on the front page in the past few months. It's enough.

<comment><USER3> The demos have shown me how powerful CSS3 (and CSS2 before it) is. My take away is that CSS3 is very powerful and can provide a user experience that could replace what could only be done in native apps and proprietary plugins before. The demos similar to the posts about running a Linux instance on top of JavaScript in your browser, or whatever new language has the greatest new features or libraries... they may not be immediately practical, but they keep me informed about the state of the art.

</comment></comment><comment><USER4> Do this to mess with it and enjoy:

inspect element and go to div class="me" and increase the time: .me, .me div {

-webkit-animation-duration: 20000ms; } Optional music: <http://www.youtube.com/watch?v=BumcoxotNb0> It looks much better

<comment><USER5> I've found that I prefer it to be around 500ms :)

</comment></comment><comment><USER6> A long while ago i did something similar, exporting an animated scene from blender ( [http://www.cuppadev.co.uk/wp- content/uploads/2009/12/walk.ht...](http://www.cuppadev.co.uk/wp- content/uploads/2009/12/walk.html) ).

For reference, the script i made: <https://github.com/jamesu/csstransformexport> (note: not compatible with v2.5)

</comment><comment><USER7> Not working in IE6.

Edit: It's a joke.

</comment><comment><USER8> Smooth on galaxy s2 stock browser as well.

</comment><comment><USER9> Nice, looks great on Android/FF. As expected, does not work on Android/Opera.

Should the shadow expand and shrink with the movement of the legs?

<comment><USER10> Everyone forgets about -o-animate :(

</comment></comment><comment><USER11> Runs better on Safari 5.1.1 for me, than Chrome 15.0.874.100 beta and latest Aurora on Lion, MBP 2009 15", it runs very smooth

<comment><USER12> Safari is hardware accelerated - so a lot of the more advanced CSS effects will generally be faster.

<comment><USER11> Thanks for that, i was starting to wonder why

</comment></comment></comment><comment><USER13> Thanks everyone! For those talking about browser support, the experiment is coded to only work on Webkit and Firefox browsers. Perhaps shortly I will add the -o and -ie prefixes as it seems other browsers are starting to catch up with their CSS implementations.

</comment><comment><USER14> I made something similar using only html:

<img src="[http://www.mysite.joke/walkingman.gif>](http://www.mysite.joke/walkingman.gif>);

<comment><USER15> Looks like you're mixing up CSS and HTML!

</comment></comment><comment><USER16> Looks great Andrew. Also thanks for helping me with my Cloth Simulation when I emailed you a year or two ago. Really appreciated that.

</comment><comment><USER17> It seems kind of verbose having to define all of the keyframes and such. Very cool nonetheless.

<comment><USER13> Agreed. I can tell you it was quite tedious to write and would definitely not recommend this approach for anything practical.

</comment></comment><comment><USER18> One knee is displaced on ipad safari. Smooth otherwise though and pretty cool.

</comment><comment><USER19> Very well done Andrew. It works perfectly on my iPhone 3gs and on desktop with Chrome. Seems like Flash will be dead soon ;)

The only thing that bothers me is the legs. They go forward a little, but to the back a lot. And that seems un-natural to me.

Congrats!

</comment><comment><USER20> Easiest game of QWOP ever.

</comment><comment><USER21> Anybody just get a severe jolt of the Uncanny Valley effect?

</comment><comment><USER22> Cool. Now do CSS-only QWOP. Challenge accepted?

</comment><comment><USER23> Surprisingly smooth on an iPhone 3GS

</comment><comment><USER24> Looks nice in my firefox, cool

<comment><USER25> Thats strange, its not working on my Firefox version 4.0.1. Otherwise great on Chrome and Safari

<comment><USER26> May I strongly suggest updating to a not-insecure version of Firefox?

</comment></comment></comment><comment><USER27> Smooth as butter, love it!</comment>


We Are Living in the Anthropocene - <AUTHOR> http://bostonreview.net/forum/jedediah-purdy-new-nature <comment><USER2> This topic is honey for political junkies, but there are reasonable geological arguments in favor of this, and many of the arguments opposed to it are political or ideological in nature (the "but man is natural" argument for instance).

Epochs are defined by noticeable, large-scale changes in rock strata in lots of places around the globe: glaciation, extinction events, increased volcanism, movement of the continents.

It's inarguable that humans have had an impact on the planet which will be measurable in the rock strata for millions of years to come. We've tweaked the isotopes found in the air (the atomic age), we've spiked the carbon content of the atmosphere in a very short period of time, and our dominance of the planet has brought the extinction of many, many other species. These are facts which stand regardless of personal politics.

Maybe the best non-political argument against an anthropocene is that it makes the Holocene epoch almost meaninglessly short. I dunno.

Anyway, adopting, or not, this new definition will have basically zero impact on anyone's life who isn't a geochronologist, but here we are.

<comment><USER3> The new definition is a conscious acknowledgement of our (humanity's) impact on our surroundings at a global scale.

It is good for us to be aware of this when we make our decisions, geochronologist or not.

</comment></comment><comment><USER4> I rarely come across a piece I disagree with so vehemently, at such a core level.

My conclusion is rather: The politics of the Anthropocene will be democratic and horrible.

This article has pushed me more firmly into the re-naturalization camp of politics, economics, and nature.

I enjoyed reading it though, nice to see someone actually thinking about these things and not just being touchy-feely.

</comment><comment><USER5> Nature is no more or less "natural" than ever. Humans (and non-human animals!) have always and forever effected the ecosystem(s) they participate in. Sometimes in drastic ways.

It's true that we've increased the scale by an order of magnitude. or two. And it's probably true that it's not going to be pretty.

But it's no more or less "natural" than ever. "Natural" is probably not that useful a concept in general, it doesn't really mean anything in general, just like it doesn't mean anything on your food label.

> Both politics and the economy remain subject to persistent re-naturalization > campaigns, whether from religious fundamentalists in politics or from market > fundamentalists in economics.

Indeed, the whole concept of "the natural" is arguably always a right-wing and reactionary one. Used by people generally under a fantasy about what things _really_ "used to be" like, and that it was "always" that fantasy from forever until recently. I don't think it's a useful concept, I think it's downright dangerous when the fudamentalists start thinking they know what's "natural" (and thus, they assume, "good") and what isn't. But "sustainable" might be a useful concept for evaluation. As well as simply "good for humans", which is obviously subjective and a political question (a question of values and interests), instead of the feigned objectivity of "the natural". There's values and interests in the "re-naturalization" programs of fundamentalists and radical reactionaries too, despite their protestations to the contrary.

tldr: I think things are going to shit too, but thinking there's such a thing as 'the natural' _and you know what it is_ , tends to make it worse.

<comment><USER6> The reductionism take seems to be fairly popular on HN in general, and it's kind of frustrating.

You can technically make that argument that humans are natural and therefore all of their impacts are also natural, but the fact remains that when shown a picture of a forest and a cityscape, everyone will instinctively know which one is more natural.

Nature is a useful concept. There are mental health benefits to being around nature[0], there are physical benefits of being around less pollution, there are future-of-the-human-race benefits to keeping things closer to the status quo than we're on pace to do with global climate change. We are changing our planet, in some ways positively and in some ways detrimentally, but it's pedantic to argue that this change is "natural".

[0][https://www.washingtonpost.com/national/health- science/study...](https://www.washingtonpost.com/national/health- science/study-being-around-trees-and-other-greenery-may-help-teens-stave-off- depression/2018/01/19/252df102-fc92-11e7-ad8c-ecbb62019393_story.html?utm_term=.e70665481eb6)

<comment> ar-jan The issue is that even a huge ecosystem like the Amazon, which we tend to consider "natural", has in fact been heavily shaped by humans.

<comment><USER7> I see your point... However, fortunately, we are still able to tell the difference between a city block and the Amazon rainforest. The distinction between the two is still meaningful.

</comment></comment></comment></comment><comment><USER8> The brief timespan of the Cretaceous–Paleogene extinction event does not get a "-cene", let's maybe wait a few million years and see what/who's left before branding ourselves anything but an extinction trigger.

</comment><comment><USER9> Is this natural or artificial? Ever asked if a part of the rainbow is black or white?

Ultimately, let's not forget the name of the game: survival of the fittest. Unless free-will allows the choice to play another game ;)

Edit: apologies for my first downvoted comment, never meant to bring negative value to the discussion, especially on a topic that I'm glad to see here. Any improvement tips to share? :)

</comment><comment><USER10> Humans are a part of nature. Everything we do and all our technology is based on the laws of nature. Therefore by definition, everything we do is natural. Animals in general try to create an environment that is suitable for them - whether it be be birds building a nest, or beavers building a dam. Humans are just really, really good at modifying their environment, but we are still a part of nature.

<comment><USER11> This line of reasoning appears frequently, but it misses the concept people are referring to when they say nature. Words are defined through their use, and no person would describe a parking lot or the inside of a building as a natural environment.

I think most people picture a place without human activity at all when they imagine a fully "natural" environment, like an island thats never had people on it. In this interpretation, people living naturally would cause their environment to deviate minimally from how it would be in their absence.

We are currently the direct cause of an ongoing mass extinction. We have yanked the surface of the planet so far from equilibrium that it may never return to its previous state. We are from being a part of nature.

<comment><USER12> I agree with this definition of words and their utility, but I also agree with GPs definition of nature. Now we have two running definitions and they contradict, thus a debate ensues. Political debates are often a matter of warring sides trying to establish their meaning of a word over the other's.

Thankfully, we also have a reasonable expectation in the use of words in that they map to something real. The broader the internal consistency of that word, the more 'authoritative' it should be - although, admittedly, this is just my opinion. (Politics will surely have some say about this.)

On defining nature, we have witnessed two definitions.

1\. Not human.

2\. All of the cosmos.

Those who appreciate the theory of evolution, I think, will have a harder time determining where the threshold between human and nature would be.

<comment><USER13> > Those who appreciate the theory of evolution, I think, will have a harder > time determining where the threshold between human and nature would be.

All human terms are subjective that way. The universe is relative and probabilistic. Ideas like "nature" can be useful, but that's not to say the universe has a boolean type called "Nature" that actually exists in any objective sense.

Yet we keep having these sorts of debates year after year. Nothing exists in the ways that most people think them to be. I could care less whether something is "natural" if the conclusion has no use.</comment></comment></comment></comment>


Show HN: A simulation game for learning how to analyze the stock market - <AUTHOR> http://springfolio.com

<comment><AUTHOR> (still in beta, please give us suggestions or feedback, thanks!)

</comment><comment><USER2> I've bought few stocks, what should I do next? I don't see when the market changes next time (or how often) It seems to static.

<comment><AUTHOR> You can wait for the timer to count down or click the arrow to the right of the timer to skip to the next day, then it will show your profits or losses for that day.

The goal is to increase your money and experience over time, which will let you level up and unlock more stocks, allowing you to expand and diversify your portfolio.

Let me know if you have any other suggestions, thanks!</comment></comment>


Show HN: The Notorious BYG – Before You Go Travel Guides to 70+ Countries - <AUTHOR> https://byg.haiqu.io/ <comment><AUTHOR> I love to travel afar. Whether I was headed to the Great Wall, Great Pyramid or Great Barrier Reef, there were certain things I always researched beforehand: visa requirements, exchange rate, plug adapters, immunizations, safety alerts, et al.

Doing so, however, entailed visiting multiple websites to find all the accurate answers I needed. A super inefficient process.

So I created BYG. A collection of 'Before You Go' dossiers for over 70 countries (and counting!), where you can view all the key travel info you need to know about a country. Quickly, easily and on 1 delightful page.

Saving you time , money and international headaches .

BYG data is collected and updated from official government and NGO sources, using journalistic and academic research methods.

I invite you to check it out, and bookmark it for your next globe-trotting adventure.

Thoughts, feedback and questions are most welcome.

Thanks and Bon voYaGe!

</comment><comment> who-knows95 hey there! i love travelling too, and if this website is going to become a one-stop then i'll definitely keep it in mind.

a little bug stuff i found just through user end point use. \- passport selection is white, and only highlights when moused over. (google chrome) \- when i selected UK passport the max stay became blank (i know this is just a data entry thing)

i like the simple and straightforward layout, but i'm wondering if you can have a google map part that shows the country? or a outline of the country and it's capitals?

then i guess it depends on your vision for this is, if its just travel advice that's technical (plug style, currency) or if it's a travel guide ("best places to do in Croatia" kinda thing.)

anyway, cool stuff!

<comment><AUTHOR> Thanks for the feedback!

Re: bugs, I'm not replicating the Chrome issue on my end, but if you're amenable, DM a screenshot to me (@sashatobago) on Twitter or IG.

Max stay for UK passport goes blank if it's a EU Schengen country because -- for now! -- there's no max stay when you travel to those countries. Maybe I should add a tooltip?

Map - Was on the fence about including a map, wanted to see if users would request it and, if so, how they'd want to use it.

Vision - This is definitely just the beginning of what I want BYG to be. So any other thoughts you have on what features / content you'd find useful on your travels, lmk.

Happy Travels!

<comment> who-knows95 hey there,

tweeted to you, Whoknow01344807. with the pic.

ahah, well for a few more days we are good (crying inside). though some countries require you to report your presence if you are staying for non- tourist reasons.

([https://travel.stackexchange.com/questions/39201/length- of-s...](https://travel.stackexchange.com/questions/39201/length-of-stay-as- tourist-in-another-european-country-as-schengen-eu-eea-citize))

well, i have two minds about the map, if its just a black map, with a outline you could include main roads, capital/cities. keep it simple like your current style.

if you use google maps, you could tag cities/places to visit(?)

i think the currency should be flipped, with the countries currency on top, and then the exchange rate below it (my personal preference) {i also got the same white backed issue with the exchange rate)}

maybe include things about culture? food and basic language (hello, goodbye).

kind regards Joshua.

<comment><AUTHOR> Hi Joshua, thx for the tweet (that whiteness is a nightmare :-0, lol). Never encountered it when testing Chrome, but def a problem.

I can tell you were on the New Zealand page.

Do you mind if I ask... Was it on desktop or tablet? What OS are you using? And what version of Chrome? This will help me troubleshoot accordingly.

Love the other suggestions. Adding to the roadmap. (Note: I had thought about adding key language phrases but many languages have multiple ways to say Hello, Thank You, etc. But I may use the power of crowd-sourcing for that. Stay tuned!

<comment> who-knows95 ahah, that's no issue. i do love the NZ page.

desktop / win 10 (10.0.17134) / Chrome 71.

i did think about that, i guess it just depends on what you want the website to be.

adding the lang, map, culture and stuff is all extra stuff that adds value, but doesn't add to the technical information.

kind regards Joshua.

<comment><AUTHOR> Hi Joshua,

Bug FIXED! Hopefully this will prove true on your end.

Thanks again for alerting me to it. I wish you happy travels in these pre- Brexit days of yours ;-)

S

<comment> who-knows95 yer! looks all good on my end.

haha, thanks i might need it.

anyway keep us updated, i am interesting in how your site grows</comment></comment></comment></comment></comment></comment></comment>