British Airways: All flights cancelled amid IT crash - <AUTHOR> http://www.bbc.com/news/uk-40069865 <comment><USER2> One of the unions has been quick to attribute the issue to the outsourcing to India of some of the IT responsibility, which the right wing press here has been all too eager to publish, but BA have rebuffed this and said at this stage they believe the root cause was a power supply issue - sure, that could be attributed somewhere along the lines to an 'alpha male business asshole' (as I read in one of the comments here), but it's probably best to wait and see what the post-mortem really is rather than seek to blame someone, somewhere, be it a businessman, an Indian dev team or anything else.

I am reminded of a post a while back regarding AWS' issues affecting multiple data centres (I forget the specifics), and how their post mortem didn't appropriate blame on anyone (which it really easily could have), but rather their own checks and balances, which allowed the issue to arise in the first place. I do hope that when the dust settles we see a measured response rather than a witch hunt.

<comment><USER3> I've found that not only is it good to not assign blame in postmortems, but it's also accurate: The culprit usually _is_ the checks and balances, as mistakes _will_ happen, and the goal should be to have failsafes and detection.

I'm reminded of airplane accidents: Whenever you hear of an airplane accident, it's always some amazingly crazy series of things going exactly wrong to get the plane to crash. We have a tendency to think "wow, what bad luck", but a better way to think about it is that airplanes are _so safe_ that an accident' _can 't occur_ unless a whole series of things go very specifically wrong.

A company's goal should be to increase the number of necessary things that need to all go wrong before there is downtime.

<comment><USER4> One other important point is that the very term "root cause" is extremely harmful in that it presumes a primary failure and already seeds the idea of one bad actor and, by proxy, blame. Systems today are too complex to blame upon one or two things - we operate in a very complicated, "complected" world both in our software and in many organizations.

While there are always technical causes for larger technical failures, I've seen far too many times RCA post-mortems performed that result in witch hunts instead of a solemn contemplation of how things could be better done by everyone. Such an RCA may ignore that a normally careful engineer was overworked by managers, never is lack of relevant monitoring and testing due to budget cuts cited, and you'll certainly never see "teams X and Y collaborated too much" as a reason for failure in these places. Because in a typical workplace, the company's values and culture are never related to a failure. You can't objectively measure how bad or how good a culture is either. Why make it part of post mortems when you don't think it's a failure?

<comment><USER5> I don't recall ever having a manager use the term root cause analysis in the way you are implying. Usually we are looking for the cheapest or most effective process change that will prevent that class of problem happening again.

</comment></comment></comment></comment><comment><USER6> In the tech-related (but now fully mainstream, unlike a few years ago) news these days, there are a number of recurring themes.

1\. Massive security breaches affecting major corporations, governments, and so on.

2\. Massive IT outages, affecting corporations, governments and so forth.

It doesn't take a lot of incidents to mark them as 'massive' since things are strongly centralized in this world.

Meanwhile, in the last 15 years of my IT career, never have I seen such a strong push towards offshoring. One would think that with such a vulnerable IT landscape mixed with an unprecedented dependence on IT infrastructure, that CTO's would want to spend more and not LESS on operational costs.

I'm slightly baffled.

<comment><USER7> Is there any evidence that IT outsourcing has made matters worse? Or is it only worse if the provider is located offshore?

Arguably, delegating IT operations to a proper IT company could improve security and reliability.

We use a low cost offshore IT provider and we haven't had any security or reliability issues so far ([https://gsuite.google.com/](https://gsuite.google.com/))

<comment><USER8> The key is incentives. An IT outsourcer's goal is generally to fulfill their contractual obligations (to the letter not the spirit) for as little money as possible.

So if something like security or reliability isn't clearly stated in contracts (and it's extremely difficult to do that well) it is disregarded.

An outsourcing company is not going to spend money it doesn't have to, simple as that.

SAAS like gsuite is an entirely different prospect. you're buying a service from Google not outsourcing your IT to them. If google's service was insecure or unreliable no one would buy it.

<comment><USER7> I don't see why an IT outsourcing company would not have the greatest incentive to take security and reliability extremely seriously.

Is there anything worse for an IT service provider than being blamed for a massive IT outage at a global corporation? This is headline news.

And I don't see any difficult contractual issues at all. On the contrary. A massive outage, by definition, means that the contractual obligation is not being met.

<comment><USER8> Security costs money, reliability costs money. If it's not in your contract, you don't pay for it.

if there's any outage that is because the customer didn't ask you do do something that's their fault not yours.

For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it?

Would you patch all your systems immediately even if it caused availability issues if it wasn't explicitly outlined in the contract?

would you explain to your shareholders that your profits were lower this year because you undertook activities not specified in your contracts because they were good for the security and reliability of the services you managed...?

When outsourcing contracts are bid for there's a common experience of lower costs win. that inevitably leads to items that aren't strictly required being excluded.

<comment><USER7> _> For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it?_

I would assume that the contract calls for particular service levels and that downing the entire fleet of a large carrier for days is in breach of that contract.

If the contract says "provide service X with 99.999% availability" the service provider cannot come back and say, oh but you forgot to specify that we should run a redundant data center to guarantee that availability.

<comment><USER9> >If the contract says "provide service X with 99.999% availability"

If you read those contracts, you have to read what the consequences are for breaking that uptime guarantee. Usually it's something silly like 10% off your next bill.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> By using IT outsourcing in India (Tata?), Poland, BA and its parent is revealing some important information: They are cutting corners to the point of risking airline operations. The question is, where else are they unnecessarily cutting corners? Are they cutting unnecessary corners on airplane maintenance?

Other quality airlines have outsourced IT or part of their IT operations, but they are careful about choosing their IT vendors.

For example, Israel's national carrier, El Al, which also has extremely good security against hijacking, outsources at least its ticketing as a cost savings move, but this it does to Lufthansa the German national carrier, which uses the Amadeus Ticketing platform. El Al is saving money over running their own operations, but still using a reliable vendor.

Quantas, the airline of Australia, outsources its IT operations to IBM. They did not choose the cheapest alternative, but a reliable one.

Contrasting with Israeli and Australian flag carriers El Al and Quantas, BA the British flag carrier made some extremely unwise choices trying choose a "cheapest" solution, instead of a money saving cheaper solution.

Compared with El Al and Quantas, BA management has shown us that quality of operations is not their top priority. The question is, where else in their operations is this a problem?

BA management is revealing to customer and shareholder alike that customer service and shareholder value is not their highest priority. They are signaling to shareholders that it is time for a change before they further harm the BA brand and before some serious accident happens.

<comment><USER11> Yes, it's a cyclic trend in IT:

      Step 0. Well functioning and balanced company.
      Step 1. Why these engineers are so expensive? We can hire 'ten for one' in 'country A'.
      Step 2. Cut local IT budget twice, put goals to have *zero* local IT budget in 2 years. Outsource everything to 'country A'.
      Step 3. People are fired, everything is outsourced, operational knowledge accumulated over the last few years is lost.
      Step 4. Why everything is broken and we loosing millions? The service is of a quality like we live in 'country A'!
      Step 5. We need to hire high quality local team that can take *ownership* over product. We are willing to pay a fortune.
      Step 6. Well functioning and balanced company.

Not sure, if airplane maintenance is being treated the same way.

<comment><USER12> You cat bet it is: [http://www.vanityfair.com/news/2015/11/airplane- maintenance-...](http://www.vanityfair.com/news/2015/11/airplane-maintenance- disturbing-truth)

FTA:

>The airplanes that U.S. carriers send to Aeroman undergo what's known in the industry as "heavy maintenance," which often involves a complete teardown of the aircraft. Every plate and panel on the wings, tail, flaps, and rudder are unscrewed, and all the parts within—cables, brackets, bearings, and bolts—are removed for inspection. The landing gear is disassembled and checked for cracks, hydraulic leaks, and corrosion. The engines are removed and inspected for wear. Inside, the passenger seats, tray tables, overhead bins, carpeting, and side panels are removed until the cabin has been stripped down to bare metal. Then everything is put back exactly where it was, at least in theory.

>The work is labor-intensive and complicated, and the technical manuals are written in English, the language of international aviation. According to regulations, in order to receive F.A.A. certification as a mechanic, a worker needs to be able to "read, speak, write, and comprehend spoken English." Most of the mechanics in El Salvador and some other developing countries who take apart the big jets and then put them back together are unable to meet this standard. At Aeroman's El Salvador facility, only one mechanic out of eight is F.A.A.-certified. At a major overhaul base used by United Airlines in China, the ratio is one F.A.A.-certified mechanic for every 31 non-certified mechanics. In contrast, back when U.S. airlines performed heavy maintenance at their own, domestic facilities, F.A.A.-certified mechanics far outnumbered everyone else. At American Airlines' mammoth heavy-maintenance facility in Tulsa, certified mechanics outnumber the uncertified four to one.

<comment><USER13> To be honest this article is not great

Maintenance facilities are usually certified by the local aviation authority

Aviation is also "regulated" by two extra entities: plane lessors and insurance companies. Both won't be happy if the maintenance done at these facilities is not correct

</comment></comment></comment></comment><comment><USER14> The main KPI for BA's IT function is the percentage of jobs they have moved "nearshore" (to Krakow).

Not that I think this is the Krakow workers' fault, mind you; rather this (and the string of similar IT incidents recently at BA) seems to fit the pattern of upper management focusing on driving down costs to the exclusion of everything else.

<comment><USER15> Krakow is a big tech center, is in the EU, and it's not obvious why moving jobs there would have anything to do with a drop in quality.

<comment><USER14> It's not about Krakow per se. But when a company works towards specific targets like "90/10 supplier offshore ratio", rather than metrics based on quality or efficiency, I don't think quality comes first.

<comment><USER16> On the one hand I've never seen a successful project with non-colocated teams, whether 300km away or 10.000km away. On the other hand, I'm surprised a airplane company is so much localized in UK.

<comment><USER17> Basecamp

</comment></comment></comment></comment></comment><comment> a-dub Looks like their new (as of 2 yrs) CEO comes from the low-cost airline world: [https://en.wikipedia.org/wiki/%C3%81lex_Cruz_(businessman)](https://en.wikipedia.org/wiki/%C3%81lex_Cruz_\(businessman\)) so that may be a hint...

Although, I've seen this sort of thing before... Usually it starts with a middle management hiring of some alpha-male business asshole who is driven to advance his career and thinks that because he can use a spreadsheet that he's qualified to run IT. He'll then go on to sell upper management on some kind of ridiculous story straight out of some bullshit CIO magazine about how consolidating all the existing best-in-class systems into one system will cut costs and open opportunities for building and mining customer data to increase revenue. He'll get the greenlight and a shit-ton of capital, and then he has to make the decision about whether to build or buy. That question is irrelevant, as our intrepid hero has no idea what the fuck he is doing and will fuck things up regardless of which path he takes. Once the "new system" is fully half baked, he then shoves it out all over the company in some ridiculous balls to the wall no going back roll out plan. Subsequently there will be huge problems, massive lines, pissed off customers, pissed off employees... but this is where our intrepid hero really shines. His mastery of the art of bullshit successfully deflects all blame from himself and his incompetence onto the users/operators (eg, people who are responsible for revenue generating businesses) of his monstrosity. Somehow it is forgotten that outages never happened before and all the revenue loss and customer ill- will is blamed on the operators for not having well-tuned disaster recovery plans in place for manual operation.

Of course the only disasters they ever dealt with were a result of his incompetence, and in a stunning feat of failing upwards, he's destined to helm the company (and then likely others) within a few short years.

</comment><comment><USER18> Quite a lot of mixed gossip in the Daily Mail article

>Yesterday's issues are the fourth BA failure in the past month, with problems on June 19, July 7 and July 13

>Union leaders say hundreds of BA staff complained about 'FLY' system and most workers say it's not fit for purpose

>A survey by GMB of 700 staff in June found that 89 per cent said training was poor, 94 cent suffered delays or system failures and 76 per cent said their health had suffered because of stress or anger aimed at them by frustrated passengers.

etc [http://www.dailymail.co.uk/news/article-3695151/Philip- Schof...](http://www.dailymail.co.uk/news/article-3695151/Philip-Schofield- melts-Heathrow-check-computer-failure-hits-BA-passengers-starting-summer- holidays.html)

<comment><USER19> That article is from July, 2016, which is why the dates "in the past month" don't compute.

</comment></comment><comment><USER20> One of the big take-aways from this is actually about how _not_ to handle situations like this.

Problems happen - even huge ones - and I think most customes understand that. What they don't understand is being given little or no information about what they should do, and also being given vague, contradicting and even false information.

The BA Twitter feed seems to be the main source of dubious information. They are telling people to check the website for flight status info - but it only works intermittently, and different parts of the site say different things; for example, the flight status tool says my flight is cancelled, but the booking management tool says it's all fine.

On the Twitter feed they are telling people that they are contacting people and they rebooking them _automatically_ \- but it's apparent this is happening for very few people.

They are telling people to rebook on the _website_ \- which only works intermittently, and will not allow rebooking even when it is working.

They are telling people to _call_ them to rebook - but their call centres seemed to be working on normal working hours (rather than getting all hand on deck), so were not in operation between 20:00 and 09:00 (or whatever; it varies by country). During working hours, when calling any call centre anywhere in the world, you just get a recorded message and are then disconnected. Some people say they did get into the call queue, and have been waiting on hold for 7+ hours!

They are sometimes telling people they _shouldn 't go to go to the airport to rebook, and sometimes telling them they _should* go to the airport to rebook.

Yesterday they were telling people they could book alternative travel with a different airline and then claim it back from them... and today they are saying they won't pay if you book alternative travel - this could cost passengers dearly.

The CEO, Alex Cruz, also made a laughing stock of himself yesterday when he randomly donned a yellow high-visibility vest to do a recorded message in an office.

Honestly, the whole thing has been a lesson on how _not_ to treat your customers when things go wrong.

</comment><comment><USER21> Airlines these days are run by a complex set of systems most of which have to work in order to have the airline function. I remember a few years ago SABRE (one of the 3 major GDS companies in the world) had a 4 hour outage (I worked for a division). Half the world's airlines stopped functioning. Generally these things seldom go down but when they do, hell breaks loose. Often these systems not only do reservations, but crew scheduling, weight balancing, check-in, manifest creation and a whole host of other small but important things. Airlines also integrate some of their own pieces into the contracted ones, and some just contract almost everything. It usually comes down to money. Even Southwest Airlines which doesn't share its res data with anyone uses a GDS backend for a lot of things (in this case SABRE).

<comment><USER22> Southwest was never on Sabre, per se. They had their own, separate reservation system, operated by Sabre the company, but not the main "Sabre Res System" / PSS. It was called SAAS, and sometimes "Cowboy".

They moved off of that recently though, and are now on Amadeus/Altea.

<comment><USER21> Was true when I worked there, of course changed since then.

</comment></comment></comment><comment><USER23> I'm curious if anyone can give insight on how the passenger backlog is resolved in these situations. How was it done before smart digital systems (probably circa 1980's?) and how is it handled today given all the intertwined applications. I can imagine that it must be fascinating and equally exhausting on a grand scale.

<comment><USER22> >How was it done before smart digital systems

Manually. The TPF reservation systems have a concept of "Queues". They would place travel records that needed to be reaccommodated onto a queue. Then, reservations agents would "work the queues" from their green screens, make phone calls, etc.

>how is it handled today given all the intertwined applications

Depends on the airline, and the system, but the general answer is "partially automated". The processes for less widespread issues is more automated. Think like a major storm in the northeast. Global outages are less automated because you're dealing with multiple issues, not just passengers.

</comment></comment><comment><USER22> Shopping, flight status, etc, on their website is working, so their central reservations system isn't down.

[http://www.bbc.com/news/live/world-40069977](http://www.bbc.com/news/live/world-40069977) says _" A BA captain has said the failure affects the passenger and baggage manifests"_

So it's an legality/operational thing. Passengers can get boarding passes, etc, but the plane isn't allowed to take off without proper manifests.

<comment><USER24> According to reports on flying forums checking is being processed manually with huge queues as a result, flight status screens aren't working, etc.

Until an hour or so, ago login to the website was down for me.

So it seems it's a very widespread outage that they're in the process of recovering from

<comment><USER22> Likely they turned both of those off on purpose. If you can't depart due to lack of a manifest, you turn off flight status and check-in.

I was able to do a flight status a little while ago though.

</comment></comment></comment><comment><USER25> I wish there was a listing of company IT quality somewhere similar to the list of 2Fac financial institutions.

I'm leaving my citi card for a chase one due to poor infrastructure but I could have avoided a lot of wasted time if I hadn't opened it in the first place.

<comment><USER26> Problem is it's highly variable from engagement to engagement.

A lot of the quality and poor performance could be bad process/management on the clients side (though a outsourcing company will profit hugely from).

</comment></comment><comment><USER27> I feel close to their IT staff having to deal with this on a Saturday afternoon.

Partially OT: anyone wanting to share any on-call horror stories? :)

<comment><USER22> Airlines are especially stressful, as the problem compounds with time. Once you hit 45 minutes or so of downtime, you start invalidating downstream flight connections. Two hours in, and you've issues with crews not being legal to fly. Four hours in, and there's not enough capacity the following day to fix the missed flights from today, etc.

<comment><USER28> are there commonly algos or decision support tools to help unravel that in an optimised way?

<comment><USER22> Sort of. The software is called "automated re-accommodation". But you're solving for several intertwined problems. Which aircraft models / tail numbers fly which flights...they have different seating capacities, nautical range, etc. Which crews are assigned to which aircraft. They aren't all qualified to fly every model. And, they aren't all in the right city, so you have to "deadhead" them there. And, finally, which passengers go on which flights.

They do have solver/optimizer algorithms, but you can imagine it's not a button press thing. There's a lot of human process, trial and error, etc. Oh, and federal laws about crew hours / legality plus union work rules. You can't just assign crews wherever you want for example...you have to consider seniority, their "home base" where they live, etc.

<comment><USER28> I was in the middle of some major rail cancellations a couple of months back over 2 days - on the 3rd day many of the assets were out of place around the country - they were clearly trying to solve it manually and the impact escalated over the day even though most of the original problems had cleared

it's got to be a great problem to work on - and must be pretty rewarding to watch when you get it right

<comment><USER29> Remember on 9/11/2001 when the US FAA declared a nation-wide ground stop, and rerouted all inbound international flights to other countries (e.g. Canada [https://en.wikipedia.org/wiki/Operation_Yellow_Ribbon](https://en.wikipedia.org/wiki/Operation_Yellow_Ribbon))?

<comment><USER30> Do you have some airline/IT ops stories about that day and the aftermath? If so, I (and I'm sure others) would be delighted to hear about them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> >BA chief executive Alex Cruz said: "We believe the root cause was a power supply issue." //

That shut down BA operations World wide? Does that seem likely? Possible? They don't have power fail-over and operational centres in different countries?

I've been re-shaping my aluminium foil hat and wondering if there wasn't a specific terrorist threat that's been covered up; but then where I am there have been 2 cities suffer bomb threats (with attendance of bomb disposal and armed police) that seem to have been buried in the news completely. Also I've heard elsewhere that staff on the ground reported the incident as due to "hackers" almost immediately - the speculation being 'before they could possibly have known that' \- which suggests some sort of disinformation process.

/wild-speculation

<comment><USER32> Same thought here. Ten years ago the UK foiled a terrorist plot to bomb 6-7 airplanes in flight from the UK to the US. That's the origin of the ban on bringing large amounts of liquid on board. [1] The recent bomb in Manchester was apparently made using peroxide, too.

Assuming they identified a real, immediate, and massive threat, I can see why they would prefer to ground all planes until they've sorted things out.

[1] [https://en.wikipedia.org/wiki/2006_transatlantic_aircraft_pl...](https://en.wikipedia.org/wiki/2006_transatlantic_aircraft_plot)

<comment><USER33> Half the planes taking off at Heathrow are not BA. If they wanted to ground the planes, shutting down ATC would be the better way.

<comment><USER32> You're assuming the hypothetical threat is not specific to BA.

</comment></comment></comment></comment><comment><USER34> Airlines should band together and form working group to redevelop the old system in modern open source tech.

Yes it would probably take 5+ years to develop and roll out, but they can't keep maintaining these 50 year old mainframes that cost them tens of millions a year in downtime.

<comment><USER35> "Redevelop the old system in modern open source tech" is a tough sell when so many of these airlines are differentiating on technology. Myself and many other frequent fliers will not engage with companies with poor functionality and bad UX. We move or stay loyal when airline tech allows us to do & see most of the things we need.

<comment><USER36> Their tech is not open enough to even allow for proper innovation and differentiation. That's the main issue with legacy IT.

When you live in a world w/ Docker, REST (and every other open tech there is), you can build systems which are way more innovative.

<comment><USER37> _When you live in a world w / Docker, REST (and every other open tech there is), you can build systems which are way more innovative_

That's quite funny because Docker and REST are just half-arsed reinventions of mainframe features from the 1970s.

<comment><USER36> I completely get where you're coming from, but you also have to acknowledge for example that Docker is open source.

That's not a trivial add-on to IBM mainframes, it provides every developer (w/ minimal resources e.g a laptop or free tier cloud service) the ability to run production-like environments.

Sometimes, we take that for granted, but having worked for an airline IT, I noticed the bottleneck didn't come from hard algorithmic issues (most advanced route features were very basic to implement), but from the huge leap between production and dev environments: this was not Ubuntu on a server VS a MacOS on a laptop (manageable...), this was Ubuntu VMs (so should be close to prod?) vs cryptic data center clusters that had impossible-to-replicate features.

As for REST, airline IT use an outdated messaging mechanism. It implements versioning and grammar, so should be clean and nice to work with? Not really... The messages were impossible to read for an inexperienced dev (opposed to XML or JSON).

I heard plans to put JSON blobs in one of the fields of the messaging mechanism (completely destroying the value of versionning and grammar btw). That was not necessarily a bad idea, just a reaction to the lack of supported tooling, and readability for an obscure messaging mechanism.

Again, I get where you're coming from, but I'm just allergic to nostagia for the sake of nostalgia where the old features clearly lacked essential features for 2017.

</comment></comment></comment></comment></comment><comment><USER38> The facts are clear. No effective mirror system or failover system. I've architected major 365x24 systems repeatedly in my career: Removing the possibility of power supply failure across the primary and secondary sites (and even within single site) is absolutely fundamental. That clearly has not been done here, at least to the extent of making sure that the solution is effective- and the blame I would guess lie within a crazy management and decision structure that seems to increasing permeate IT within large companies. Tata do have some good staff (from my first hand experience over many years):However, from my more recent experience, there is an increasingly MASSIVE CLIFF EDGE in talent/competence in within Indian companies generally, (and to some lesser extent UK companies as well): So the possibility of having "very assertive, but stupid or incompetent" middle and even senior managers is becoming an ever greater real-world problem. The criteria and method for selecting candidates for IT related work does not help - in particular role, competency, and "modus operandi" of recruiting agencies, is pretty atrocious, as many a seasoned contractor will attest! But ultimately, I think Alex Cruz and his CIO must take responsibility for a lack of diligence and competence. They clearly do not understand the most basic truth of high reliability, mission-critical IT: i.e. They NEVER needed cheaper IT staff (with all the attendant risk within their industry) , but rather much fewer technical staff, of the HIGHEST QUALITY, for all BA's key systems. And that I'm afraid means probably not putting Indian companies at the top of the list.

</comment><comment><USER24> One customer was told that the root cause was a "lightning strike on a datacentre", although it sounds pretty unlikely (there are storms today in the UK but surely there'd be a DR plan?)

<comment><USER22> They do have DR plans, but the reality is that whole thing is a huge distributed system with parts from different vendors, in different locations, etc, with decades of legacy.

A power outage the reboots a whole datacenter would screw any major airline for at least half a day.

Thus far, nobody has found the economics of a modern, truly HA setup worth the cost. Outsiders greatly underestimate the complexity too. Think something like 40 disparate applications from different vendors, or some homegrown systems, in different geographical locations. Then, all the client applications are in buildings you don't own (airports) where you aren't allowed to control the infrastructure.

If it were a high margin business, perhaps things would be different. It's not.

<comment><USER39> > _If it were a high margin business, perhaps things would be different. It 's > not._

Most of the loss here is not from lost bookings; a lot of people who prefer BA will probably just wait and book once the systems are restored.

It's going to be from secondary losses -- lawsuits, ding to the reputation and so on.

These numbers are estimatable, even for low-margin businesses.

<comment><USER22> I agree, but I've been around this sort of thing and seen the post incident analysis, been in the discussions, etc. Despite the huge costs of these outages, they pale in comparison to the costs of a real HA solution for all "needed to fly" applications.

To give you some idea, ITA Software was bought by Google for $700 million. They were some of the best and brightest minds in this space, on par with any Silicon Valley darling. They successfully wrote a modern replacement for one popular airline function...shopping. They failed, however, at delivering a modern reservation system, despite tons of money and talent invested.

<comment><USER39> > _Despite the huge costs of these outages, they pale in comparison to the > costs of a real HA solution for all "needed to fly" applications._

Then, quite honestly, it's the rational decision for airlines to take.

Even Google accepts that perfect reliability is impossible, and they're sailing in a pillow-strewn gold-plated yacht down a Mississippi of money.

</comment></comment></comment></comment></comment><comment><USER40> I've managed enterprise IT applications shift support to India. I have to say when its done right, it can work well sometimes.

But my experience has taught me this. The vast majority of time its a fragile egg shell waiting to crack. When it fails, it fails miraculously. An IT support team on this scale is one of those things you should keep close to your product or customer.

Occasions like this I guarantee a bunch of execs somewhere in BA will pay ANYTHING to have some of their loyal IT staff back to take control of the situation.

<comment><USER41> But within 4 months no one in the BA C-suite will remember this happened.

</comment></comment><comment><USER42> There might be a better word than "crashing" when describing airline computer systems malfunctioning. Nevertheless, was happy to hear it wasn't a plane.

</comment><comment><USER43> I can't help but be amused of the fact that all of the money British Airways thought they saved, by outsourcing their IT, was just squandered by the additional expenses it's going to cost them to fix this mess. And I'm not even factoring in all of the money this bad PR is going to cost them in the near and long term.

</comment><comment><USER44> All those UML diagrams didn't make the software good.

</comment><comment><USER45> Henceforward, BA passengers will be required to bring portable power supplies with them and make them available to airport personnel when asked to do so. Failure to do so will result in forced removal from the aircraft. Over and out.

<comment><USER3> Nah, BA isn't a US airline.

</comment></comment><comment><USER46> Companies ruined or almost ruined by Indians [http://sammyboy.com/showthread.php?98021-Companies-ruined- or...](http://sammyboy.com/showthread.php?98021-Companies-ruined-or-almost- ruined-by-imported-Indian-labor-%28US%29)

</comment><comment><USER47> TL;DR: yet another massive chaos because some "smart" PHB doing "cost reduction" in IT.

</comment><comment><USER48> Apparently whole Heathrow airport, .. was shut down yesterday. United and Lufthansa has to cancel their flights there too. So it meant more passengers trying to get with other plans to neighbour countries.

</comment><comment><USER49> For reference, British Airways' parent company made a profit of €2.5 billion last year, and expects higher profits this year [0].

Without meaningful consequences at the top of the executive chain for sub-par IT/infrastructure quality, these kinds of incidents seem inevitable. But how do you hold people responsibly for "bad" software? We could adopt something akin to how PE licenses are required for civil engineering in the US. I suspect it is in the industry's best interest to address this need before a government entity decides to.

[0] [http://uk.reuters.com/article/uk-iag-results- idUKKBN1630MA](http://uk.reuters.com/article/uk-iag-results-idUKKBN1630MA)

</comment><comment><USER50> Crash might not be the best word to put in a sentence containing British Airways. My brain was frozen for a couple seconds until I understood what had crashed.

</comment><comment><USER51> I have zero evidence, and am simply working through a though exercise, but it could be targeted?

Maybe a group on behalf of a nation state is testing out its muscle. Or sending a warning. Maybe the UK did something recently a nation didn't like, and this is the new form of "diplomatic protest". Or sending a warning shot.

I remember reading last year that the large Delta airlines outage was cyber terror related.

It really feels like we're not too far off from a war between two nations without a single bullet fired. What happens when a country is hit with nation level ransomware? Ie not, "give us $300 bucks and you'll get your PC back", but "sign XYZ treaty and you get your country's water system back"? Or "we'll restore your internet and turn your powerplants back online"? How much will a wealthy country (like us in the US) be willing to stomach of seeing people going thirsty and hungry before they want their govt to capitulate?

Of course the world will condemn and complain, but as has always been the case the country with the largest Army makes the rules. And we might be using the wrong measuring stick. Microsoft missed the boat by thinking (along with most of the industry) that measuring computing meant measuring PCs. It wasn't until it was too late that it realized that computing was about to be dominated by Mobile and smaller. They were using the wrong measuring stick.

Are we on the verge of an era where an army should be measured in its digital strength and not its physical strength? It's a very scary thought.

As an American I think first of the risks to my own country. How long could we sit with a nationwide blackout, and the internet down (for anyone using backup generators)? Food rotting in shipping containers because no cranes can offload it. No easy communication or flights for quick way to move people or things around.

As a country (and as a world) I can't help but feel we're really not doing enough to take a risk like this seriously. It's just a feeling, but based on small incidents here and there it really feels to me like something in the next 5-10 years is gonna happen that'll make us all drop our jaws and say "I didn't think this was possible."

Regardless of your political beliefs, a lot of people around the world didn't think last year's US election was possible. I was shocked by it as well, but it also opened my eyes to how much more really is in the realm of possible.

As engineers we have much a deeper knowledge of the risks involved and as a result a much greater responsibility of raising awareness and getting the problem fixed.

EDIT: I'm not sure of the original location I saw the Delta stuff, but a quick look now turns up this link.

[http://observer.com/2016/09/did-a-cyber-attack-ground- delta-...](http://observer.com/2016/09/did-a-cyber-attack-ground-delta- airlines/)

And yes, I'll repeat this above comment is purely speculative by me.

<comment><USER22> There's a little insider knowledge on the Flyertalk forum.

See this post, for example...a BA employee: [https://www.flyertalk.com/forum/28366141-post168.html](https://www.flyertalk.com/forum/28366141-post168.html)

Later, there's some talk about a power outage and/or lighting strike, again from BA employees.

<comment><USER51> I could be mistaken, but from what I'm seeing in that thread they really have no idea what caused it. Which, btw, seems fairly reasonable for how early into this incident it is. I wouldn't expect a root cause for a while.

Delta Airlines also called their outage a "power outage", but it looks like there was reason to believe it wasn't.

[http://observer.com/2016/09/did-a-cyber-attack-ground- delta-...](http://observer.com/2016/09/did-a-cyber-attack-ground-delta- airlines/)

<comment><USER22> I don't put much stock in that article. Their conspiracy theory is that no other businesses saw a power outage. But it didn't have to be a supplier/mains problem. They could have had an issue with their own, internal power grid. Their data center likely has a UPS, generators, huge switches to move back and forth from battery/mains/generator etc. A fault there would cause an outage.

Edit: Yep. [http://bgr.com/2016/08/14/delta-finally-explained-how-one- po...](http://bgr.com/2016/08/14/delta-finally-explained-how-one-power-outage- grounded-an-entire-airline/)

</comment></comment></comment></comment><comment><USER52> Who is John Galt?

</comment><comment><USER53> Hopefully, this will be a wake-up call to the industry - government regulation in IT is needed.

<comment><USER54> The UK government (perhaps the relevant one in this case) does not have a stellar track record of figuring out how to make big IT systems and projects successful. This knee-jerk appeal to regulation is unconvincing to say the least.

<comment><USER53> A modified form of ITIL would do a lot of good for important sectors. Let me put it another way, if the industry won't regulate itself, then they will be regulated by force.

<comment><USER37> _A modified form of ITIL would do a lot of good for important sectors_

You've never used ITIL for real, have you? Because if you had you would know that no amount of process can replace good engineers, and good engineers don't want to work in ITIL shops...

</comment></comment></comment></comment><comment><USER55> if this is another case when they employed a horror coder who doesnt know to program, they'd better employ me !

</comment><comment><USER56> Maybe they hired the managers who handled Deepwater Horizon. Although this time around, I don't think Donald Trump should send a nuclear sub to drop a nuke down the shaft on day two of the disaster. I'd wait at least a week.

</comment><comment><USER57> This is a distant early warning of the impending demise of commercial aviation. The inexorable rise of the price of fuel will eventually make flying unaffordable for all but the military and civil servants. Airlines are already struggling to remain solvent, and are cutting costs everywhere they can: salaries, squashing passengers to increase seats/plane, nickel & dimeing us with baggage surcharges, etc.

Offshoring IT is an example of cutting costs to the bone.

Your grandchildren will only know of flying as an ancient legend.

<comment><USER58> This is nonsense, fuel prices have been plummeting amid new extraction tech and long term demand destruction. These are fundamental changes and if you're still droning on about peak oil you're just operating on old bad info.</comment></comment>


Stepping Away from Sass - <AUTHOR> https://cathydutton.co.uk/posts/why-i-stopped-using-sass/ <comment><USER2> The case for CSS variables is interesting. I'm still trying to figure out the best way to integrate them with a CSS framework I created, called Bulma: [https://bulma.io/](https://bulma.io/)

There's a few ways to combine Sass variables and CSS variables:

      - make all Sass variables available as CSS variables as well, so $primary will also exist as --primary
      - assign a CSS variable to a Sass one: $primary: var(--red)
      - assign a Sass variable that was defined as a CSS one: $red: var(--red) and then $primary: $red

Color functions are one aspect that isn't well supported yet by CSS only.

There's also a more "philosophical" question: why offload the variable resolution to the client side when it can be done at compilation time? If you're not gonna update a variable's value at runtime, it doesn't really need to be available as a CSS variable.

It's like single page apps that always render the same content, and are better off rendered once on the server side and delivered as static HTML, instead of being rendered thousands of times by each client.

But to be fair, CSS variables have other benefits, like creating color variations very quickly:

      // Sass
      .is-success
        background-color: $green-invert
        border-color: $green
        color: $green
        &:hover
          background-color: $green
          border-color: $green-invert
          color: $green-invert
        &:active
          background-color: $green
          border-color: $green
          color: $green-invert

      // CSS
      .is-success
        --color: var(--success)
        --invert: var(--successInvert)

Even with CSS variables, Sass still has a lot of benefits listed by other commenters here, like reusable mixins and nesting. And one of my favourites: @extend!

<comment><USER3> I just want to say thank you for bulma, it is a top notch project and I recommend it to everyone.

</comment></comment><comment><USER4> Does a preprocessor really complicate the workflow?

Variables are still new and not fully supported.

Being able to nest css selectors is major win for me.

Reusable mixins is another.

I just don't see a compelling enough use case today to switch to pure css for non trivial applications.

<comment><USER5> >>Does a preprocessor really complicate the workflow?

I've just spent yesterday getting sass to work with my Golang project.

I used to have a nice simple makefile task, that compiled the project (in a split second) and launched it on localhost so I could find out where the problems were. My only dependency was the Go compiler. If I changed the css, the next page refresh sorted it.

Now I have a "sass watch" task, which compiles the scss to css. But that requires node.js, and npm (there are golang scss compilers, but all of them are either not being maintained, or have problems, or only support older versions of scss). I have to run this in a separate terminal so I can stop it when I need to.

I've deliberately not looked at my global node_modules directory. If I don't look, I don't have to worry about how many js libraries just got installed on my machine, and I don't have to think about who's maintaining them, and if they're now malicious. As long as sass only touches the css files, and css isn't Turing-complete (yet), then I don't need to audit any of that, and I can assume that it's not injecting malicious code into my application.

Though there are possible attacks on my site that could originate with code injection from a $malicious_left_pad js library, even via css, but it's enough of a stretch that my paranoia can live with it. I can check out the compressed css every now and again and see that it's not importing anything it shouldn't, and be reasonably sure that I haven't just compromised all my users' security.

So yeah, it's not so much that a preprocessor is a complication, it's that a preprocessor allows a malicious package to compile whatever it likes into files that I will then serve from my domain to my users, who trust that I'm not serving them malicious files. That's policed not at all by npm, or any of the package managers, who cheerfully assume that all javascript developers are honest.

<comment><USER6> Use sassc and call it from your makefile.

<comment><USER7> Not sure what it's like today, but last time I tried to use sassc it was a nightmare. The official repo was just the library with no CLI. I couldn't find a CLI that didn't also require me to compile it myself. Very frustrating.

<comment><USER8> You might be thinking of libsass. sassc is dead simple and solves all of this users issues.

<comment><USER7> Correct me if I'm wrong, but doesn't sassc require the user to compile it?

<comment><USER9> You're right, on OSX you can brew install sassc

<comment><USER5> there's a Debian package :) thanks for the tip :)

<comment><USER5> just got this working with fswatch and sassc, thought I'd feed back that this is perfect, thanks :)

<comment><USER8> Heh, I just woke up and read this and thought "well thats enough problem solving for today" :) Glad we could help you avoid the hell that is adding npm to a non-node project!

<comment><USER10> Another thank you from here! I've had to use node just for sass in the past and this is a much nicer solution.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I honestly have never seen the value in pre-processors when writing CSS. I think they abstract a lot of low-level understanding of your UI and make your stylesheets overly complex. They definitely keep things sane when doing CSS at very large scale (for example dealing with color palettes, fonts, etc) but are not that useful when you're writing different components with different rendering needs.

Nowadays I just do functional CSS (Tachyons, Tailwinds, Fractures, etc). It has some drawbacks but you can go faster and change things more atomically without breaking everything when changing a class, and you have the safety given by the fact that every property have the same level of specificity (which can be overriden by JS generated style attributes, in case you need to manipulate the DOM directly)

Also, you can address your rendering needs atomically which works very nicely when you're writing components in isolation. They also are an excellent approach when doing server-side rendering since you can store classes combinations in variables that can be passed from one template to another or used and overriden in the same template as it gets evaluated by the server. It's almost like a pre-processor without the hassle of recompiling your sheets.

<comment><USER12> > I honestly have never seen the value in pre-processors when writing CSS.

As mentioned, theming and consistent ux requires far less writing and copy paste with a preprocessor than in pure CSS.

I think React's approaches make CSS feel simpler but often just sweep the inefficiencies under the rug.

A lot of this is being fixed with CSS4, so these will go the way of jQuery. And while you don't need jQuery today, it served as an important polyfill for a long time.

<comment><USER13> > _A lot of this is being fixed with CSS4_

CSS4 won't have nesting. SCSS isn't going away as long as nesting isn't a thing in native css.

(Also css variables are awful to use. Honestly, CSS-WG should have just copied most of scss's syntax)

<comment><USER12> I agree about CSS variables.

I'm unsure about the merits of nesting. Tends to make for some hard-to-read code.

<comment> frosted-flakes Most nesting I do uses the '&' parent selector, so it's not "real" nesting.

      .a-long-class-name {
          background: firebrick;
          &:hover {
              background:  red;
          }
      }

This approach has some clear benefits (less verbose and it groups related code together) with little or no downsides.

<comment><USER12> Same, but this can definitely get long, ala

& > div, & a, & a { &:hover } etc.

<comment> frosted-flakes Your example is a bit confusing. This would be a more idiomatic way of writing it:

      .some-class {
          > div, a {
              background: blue;
              &:hover {
                  background: red;
              }
          }
      }

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> A lot of folks here are saying that they couldn't live without nesting CSS selectors.

FYI the CSS Working Group approved a working draft of native CSS Nesting last month; it's in "stage 1."

[https://drafts.csswg.org/css-nesting-1/](https://drafts.csswg.org/css- nesting-1/)

There's a PostCSS polyfill you can use for it today. [https://github.com/jonathantneal/postcss- nesting](https://github.com/jonathantneal/postcss-nesting)

<comment><USER15> when I use sass nesting it's almost always to do BEM style selectors via `&-`, which really is soo much easier to read than having to type the full selector every time, especially when you have A LOT of components in a directory structure.

sadly this use case seems to be missing from the coming spec :(

<comment><USER16> Agreed. This is trivial to add if you use postcss (postcss-nested)

<comment><USER17> Correct me if i'm wrong but postcss is js or node.js only, where's sass is trivial to add with any language.

<comment><USER18> I'm not totally sure but I think that for Sass only you'd still need Ruby or Node.

<comment><USER19> Sass has LibSass which is a C++ port of the Sass engine (which was originally written in Ruby). There are wrappers available in many languages, such as Go, Java, Node, PHP (and even Ruby, interestingly enough).

[https://sass-lang.com/libsass](https://sass-lang.com/libsass)

</comment></comment></comment></comment></comment></comment><comment><USER20> I read somewhere a quote like, "a bad abstraction is worse than none at all." And for that I'm always on the lookout for things that look the same but aren't actually. Careful not to merge them via abstraction because they might deviate heavily all of a sudden and now you have to refactor a lot.

CSS is the #1 place where I spot those cases. And I feel that Sass and other CSS preprocessors mostly lend themselves to shooting yourself in the foot with abstracting similar things that aren't actually of the same category.

<comment><USER21> Well said, creating _good_ abstractions is hard and takes careful consideration. Hopefully the abstraction has some kind of benefit; simplicity, flexibility or extensibility. I've personally found SASS to be cumbersome with the encouraged nested of CSS and tightly couples the CSS to the DOM markup.

A better abstraction in my opinion is a utility CSS library like _Tailwind.css_. It feels strange at first, but compose-able _utility styles_ eventually feels like a good abstraction, with less shots to your feet.

<comment><USER17> > A better abstraction in my opinion is a utility CSS library like > Tailwind.css

Exchanging sass with postcss based framework in my book is _the worse_ abstraction for almost any purpose.

<comment><USER21> Why is that? Have you used it for significant projects? I've found the hierarchy of CSS classes and where they're defined (e.g. global or component) become hard to to manage and refactor when you want to reshuffle components around...

I feel postcss-based styling is simply more predictable and easier to refactor. And the abstraction, which can be clunky at first, becomes a sort of intuitive DSL which let's you develop faster...

</comment></comment></comment></comment><comment><USER22> The only thing I still couldn't live without is nested selectors. Writing maintainable CSS at scale is impossible without them. I really wonder why they haven't been made native yet.

<comment><USER23> PostCSS [0] can do this and is far easier to install.

[https://github.com/postcss/postcss- nested](https://github.com/postcss/postcss-nested)

<comment><USER22> Not sure how the install could be easier than "get a single command line tool and run it against your root source file". If you're talking about the Ruby version, node-sass doesn't require any of those extra steps

<comment><USER23> Have you ever tried to get libsass installed on a CI server? Painful.

<comment><USER22> Nope, though you're generally supposed to use a project that _uses_ libsass (of which there are many), not use it directly. If the issue is the binary itself, then maybe the Ruby version is what you want after all.

<comment><USER23> That's not the point. Installing via a library is actually worse. NPM will bypass proxy settings via the postinstall script.

My point is that the libsass library should be ported to WASM to ease the installation in a CI environment.

</comment></comment></comment></comment></comment></comment><comment><USER24> Everyone forgets that SASS is meant to be programmable CSS.

It has loops, functions, namespacing, arrays, maps, and tons of utility functions (especially around color).

If you treat it as CSS+ then you're not really benefitting from it's true potential.

<comment><USER25> > Everyone forgets that SASS is meant to be programmable CSS

That sounds like a solution looking for a problem... The vast majority of real SASS I've seen has been much like the stuff this article mentions.

> If you treat it as CSS+ then you're not really benefitting from it's true > potential

People aren't looking for "potential", they're looking for a way to accomplish their design goals whilst keeping their stylesheets maintainable. The real use cases where SASS is actually worth the complexity overheads are getting fewer and fewer.

</comment></comment><comment><USER26> Hi, undergrad here. That is to say, I'm not anything close to an expert in web design, but just in the course of making a simple static website to show recruiters I realized a lot of lessons like these about how modern HTML/CSS/JS can really handle anything you throw at it without having to worry about frameworks or precompilers. Sure, Bootstrap and SASS helped get a prototype up fast, but I feel like that gain in productivity was wasted once I had to fight the framework for the fine details, and just writing what I wanted in vanilla- land ended up writing out the frameworks as a byproduct.

Is this a common pattern in industry as well?

<comment><USER27> It is a bit of catch-22 IMHO, for some. If you're very experienced it is just as easy to roll your own (although others may not onboard as quickly compared to well known libraries). If you're not very experienced then if you try to roll your own it may wind up being a mess. I'm in the middle and once I understand a library well I know its limitations and use its components as they were intended where I won't have to customize them too much, and roll my own components for the rest. This largely sidesteps the issues I used to have of wrestling with UI frameworks. I hope that helps.

<comment><USER26> Certainly! I wanted to hear some viewpoints about full vanilla vs framework- based development, and your view of grokking the tools and implementing what it doesn't cover is a great one to consider.

</comment></comment></comment><comment><USER28> I'm quite surprised by the number of comments on Sass/CSS pre-processors being of little to no value while we have created a huge complicated Frankenstein mess with webpack/React and the rest.

<comment><USER29> I am quite surprised at how the wheels have turned. I remember a year ago I was interviewing people and each single candidate listed SASS as a skill, and almost everyone during the interview claimed its their preferred method of working. (my team so far has been using plain css and are happy with it, so that surprised me a lot back then).

Is it considered bad practice now? How did it rise so quickly, how did it fall so quickly, what's going on in the web dev world?

<comment><USER30> Sass and other CSS generators were useful a few years ago for rapid code generation. However, CSS has caught up as have editors and it's hard to see what real advantage Sass has today.

Some novel things like a primaryColor variable to easily adust your theme is easily replicated with a traditional find/replace.

The fewer frameworks / compiles-to X languages you have to learn the better.

IMO, a little redundancy is better than a little complexity or a little dependency.

<comment><USER31> Using a find and replace instead of a variable holder is extremely bad practice. I should not have to copy/paste my site's brand colors every time.

The original reason I switched was for nested structures so I could stop repeating myself. E.g.

div {

      &:hover {}
      .class ul {}

}

This made it much more pleasant to write in sass.

The other thing is mixins. If vanilla css doesn't support this then it's still a no-go.

Lastly I'm confused why sass of all things is an issue. It's basically css, and very lightweight. You just add one step in your preferred build tool to transpile sass -> css. "vanilla is magically better" is not an argument.

<comment><USER30> I used to write only in Sass for these same reasons, but switched back to CSS.

CSS now has variables (if you really need them -- chances are you don't).

The redundancy of writing a selector multiple times is sightly annoying, but I don't think it rises to the level of value I need to include a new dependency in my app or build pipeline.

<comment><USER31> That still doesn't account for mixins, which turn out to be very handy. Some examples here.[0]

[0]: [https://css-tricks.com/custom-user-mixins/](https://css- tricks.com/custom-user-mixins/)

These are preferable because you can compose them as needed for elements, instead of having to make extra classes.

> CSS now has variables (if you really need them -- chances are you don't).

I fail to see how you could -not- need variables. Not many, mind you, but using none at all boggles the mind. For starters, DRY code is fairly fundamental. When you update a referenced variable you only need to do it in 1 place. Relying on "find and replace" leads to "oops I accidentally missed one, now we have a bug that could have been totally avoided".

It also helps with consistency for site theming/branding. You can define $primaryColor, $primaryHighlight, $secondaryColor, $textColor, $backgroundColor, etc, and reference these down the line instead of copy/pasting and getting bugs if the specs change.

<comment><USER32> _> When you update a referenced variable you only need to do it in 1 place. Relying on "find and replace" leads to "oops I accidentally missed one, now we have a bug that could have been totally avoided"._

Isn't that the point of selecting classes in the first place? That said, I understand the utility in using it for things like individual colors, as you described.

<comment><USER31> Classes do suffice if you follow the convention of "small, atom-like css classes". I personally hate this style and prefer compositional css classes for a component or a structured object.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> What I _really_ love about sass is using [https://include- media.com/](https://include-media.com/)

I hate writing media queries, but

      @include media("<desktop", ">tablet") {
      }

Takes most of the pain away.

</comment><comment><USER34> Hello "human centered designer, specialising in interaction design, HTML & CSS"

Your font is too big.

<comment><USER35> Everything else v awkward as well

</comment></comment><comment><USER7> I recently built a new website from scratch after about three years working in other software areas. Found to my surprise that I came back with some very different opinions about how CSS should be structured than I had in my web dev days, and I didn't end up using SASS at all. Still think the code ended up cleaner and more modular than what I wrote before using SASS. The only feature I really missed was @extend, but making the code I would have put in the % selector an actual class and using that in addition to a specialization class in the HTML worked well enough.

</comment><comment><USER36> The biggest thing Sass annoys me is in Node.js environment, I have to choose either node-sass which depends on native module which require extra compilation or matched pre-built binary. Or I have to choose ruby-sass which depends on a global installation of Ruby. Both of the options are brittle.

For SPA I found it's easier to use CSS-in-JS solution like styled-component or emotion. Or for Typescript I just use typestyle.

For non SPA I usually go vanilla CSS for simple stuff and stylus for complex stuff.

</comment><comment><USER37> Worked a lot with CSS for 10+ years and SaaS' nesting is amazing. I still have no clue when to NOT nest, but oh well, it is so useful to componentize the stylesheets.

<comment><USER38> Nesting is okay for one-level.

However it violates the principle of least astonishment. How come a button inside .header differs from the button inside a .footer, then where are the differences defined, inside the button.scss or header.scss? Then one must take into consideration CSS Specifility and sprinkle !important everywhere.

Instead, use modifier (in BEM) or create two buttons (.header-button and .footer-button) or create 2 utility class (.is-header-btn, .is-footer-btn) or just use TailwindCSS and you're good to go for all kinds of requirements, without ever resort to !important

<comment><USER33> > However it violates the principle of least astonishment. How come a button > inside .header differs from the button inside a .footer, then where are the > differences defined, inside the button.scss or header.scss? Then one must > take into consideration CSS Specifility and sprinkle !important everywhere.

That's true. On the other hand, who is still trying to figure those things out without using their browser's dev tools and source maps?

Using Sass also doesn't mean that you can't use two button classes or utility classes.

</comment></comment></comment><comment><USER39> Interesting. CSS has certainly come a long way.

I'll still use Sass for the convenience of nested selectors, though.

</comment><comment><USER40> Pedantic point. It's 'Sass' and not 'SASS'.

Sass certainly pushed things forward in CSS world. Without Sass and LESS, Stylus et al. I am quite certain we wouldn't have CSS custom properties and colour functions. Great additions to the language.

That said, I left Sass specifically some years ago. [https://benfrain.com/breaking-up-with-sass- postcss/](https://benfrain.com/breaking-up-with-sass-postcss/)

Tangentially related — in terms of dealing with CSS tooling/output for large projects with many devs I have found the PostCSS ecosystem indispensable.

I wrote this a few years back after setting things up with PostCSS at bet365.com this way: [http://ecss.io/chapter9.html](http://ecss.io/chapter9.html)

The good thing about PostCSS is you can reduce the features as CSS becomes more capable and easily incorporate extra tooling like autoprefixer.

</comment><comment><USER41> I need more coffee, I misread "Sass" as "SaaS" until several sentences in...

> I also unintentionally, (at least at first) removed all traces of Sass from > my codebase.

Especially this part, still thinking that was "SaaS" :)</comment>


Show HN: We just launched the Circles concept. - <AUTHOR> http://www.sharescribe.org

<comment><USER2> It seems like the thought process of every fledging social network this morning was: Google is launching their social network? Perfect! Time to launch our similar but not quite finished rival product. We might just get listed at the bottom of a techcrunch article in the resulting hubbub!

</comment><comment><USER3> So Alpha.. doesn't work at all. Doesn't even have a demo of how it's supposed to work.

Took me 15 seconds to give up and close the tab.

<comment><USER4> You have ten more seconds of patience than me.

<comment><USER3> Meditation does the trick..

</comment></comment></comment><comment><USER5> Little turns me off more than artifacty images without alt tags.

<comment><AUTHOR> Sorry, my design skills are lacking.

</comment></comment><comment><USER6> Google's not even launching after all the _buzz_.</comment>


Show HN: Saas.do – Build powerful webapplications without coding - <AUTHOR> https://www.saas.do <comment><USER2> So it's a basic form builder with drag and drop triggers. UI looks nice. Is there api access? Can I do batch data loads? Is there a permission model for the objects? Any analytics? These are all features I would expect from Salesforce lite.

<comment><USER3> Hi there, I am the co-founder of saas.do. Let me get to your questions. 1\. Api access: yes, there will be one so you can trigger workflows. All entities have automatically REST API. Your even are able to configure which entity have the API enabled.

2\. Batch data loads: We have a data import feature for excel right now. I imagine to have other data types like csv, sql. Via the API batch data loads will be possible.

3\. Permission: There different levels for permission handling. For fields of an entity you are able to set group permissions. On the entity level you are able to set also group permissions and tenancy scope. For the UI builder you can set permission on single elements and components. A row, a container a table a chart etc.

4\. Analytics: Right now we have a basic analytics module. You are able to map chart types with entities and add those to your custom view which you can create with the UI builder.

If you have any questions, just bump me a line.

Cheers,</comment></comment>


What did Apple edited "anonymously" on Wikipedia? - <AUTHOR> http://wikiwatchdog.com/#!search/en/apple.com

<comment><USER2> Are you implying that any of these edits are malicious or self-serving? And that they are sanctioned by Apple (as opposed to, say, being made by employees during their lunch break)?

I don't understand your motivation for thinking these pages are noteworthy.

<comment><AUTHOR> It was just a matter of showing the potential of a tool like that, it's possible to uncover some malicious or self-serving edits like: Sky is removing critics from his page <http://wikiwatchdog.com/#!search/en/sky.com/216355/446125412>

or Dell that is removing critics [http://wikiwatchdog.com/#!search/en/dell.com/102490/32008505...](http://wikiwatchdog.com/#!search/en/dell.com/102490/320085057)

or a Dell employee that vandalizes the Dell page <http://wikiwatchdog.com/#!search/en/dell.com/102490/88573397>

<comment><USER2> If you flesh out this analysis it could make for a good series of blog posts.</comment></comment></comment>


Mainland China sees rise in new coronavirus cases - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-china-toll/mainland-china-sees-rise-in-new-coronavirus-cases-idUSKBN21N009 <comment><USER2> Why do we even report this fake news. China's numbers are all bogus. Might as well just phrase it as today the Chinese government decided they had 30 cases, yesterday they felt like 19 was the right number.

</comment><comment><AUTHOR> This is scary. But as Bill Gates suggested, as long as there is no vaccine that can be rolled out world wide, we will have to continue living differently.

<comment><USER3> How about No. How about Bill Gates and his friends sell a few jets and start building free clinics in every major city?

It's been two months of contradictory advice and hypocritic pontificating from experts. I'm getting real sick of all the "torture everyone forever" advice from our dear leaders, how about all these billionaires actually do something instead?

<comment><AUTHOR> Not everything can be solved with money. Developing a vaccine will take time and tests, Bill Gates even said the foundation is developing 7 factories for different approaches in parallel and likely only 1-2 of them will be useful. Normally this is done sequentially to not waste money.</comment></comment></comment>


How do magnets work? - <AUTHOR> http://www.coolmagnetman.com/maghow.htm <comment><USER2> Lets start with a simple case: Imagine there are two parallel wires with current flowing in opposite directions. There are roughly the same number of electrons and protons in each wire but the electrons, unlike the protons, are in motion. Now, imagine you ARE an electron whizzing down one of those wires. If you look around, you'll see all the other electrons in your wire are (more or less) stationary relative to you but the protons are moving backwards at a great speed. Now, you look over to the other parallel wire. Over there, the protons are moving at the same speed and in the same direction as the protons in your wire but the electrons in the other wire appear to be moving backwards twice as fast! In any interval of time, you pass twice as many electrons as you do protons. Because opposite charges attract, this produces an attractive force that we label "magnetism."

Disclaimer: This may be utterly wrong. This is my understanding from the internet and a first-year engineering electromagnetism course.

<comment><USER3> I would refine your explanation a bit--you were 90% there but you got the direction of the magnetic force wrong, and the way I learned it involved special relativity. So when you are sitting on an electron in one wire and you see the protons zipping backwards in the other wire and the electrons twice as fast as that, the phenomenon of "length contraction" (<http://en.wikipedia.org/wiki/Length_contraction>) occurs because all these particles are moving close to the speed of light. Since from your reference frame the electrons are moving _faster_ than the protons, they are length contracted to a greater degree, so they appear to have a higher charge density than the protons. Therefore the repulsive electric force between your electron and the charge density of the electrons is greater than the attractive force between your electron and the charge density of the protons, so your electron is repelled (and we observe this as the magnetic force).

Laughable ASCII diagram (just note that within each wire, the opposite charges are intermingled, not separated like shown):

              Lab reference frame     Reference frame of e- on wire 1
                                                   V
                  - - - - - - - ==>          -  -  -  -  -
      wire 1      +  +  +  +  +          <== + + + + + + +

              <== - - - - - - -        <==== </comment></comment><comment></comment><comment>-
      wire 2      +  +  +  +  +          <== + + + + + + +

                                      charge density of e-'s in other
                                      wire is greater than that of p+'s

So, two wires with current in _opposite_ directions _repel_ each other, not attract. You can do the above exercise with the currents in the _same_ direction to see that relativity would then postulate that the protons in the other wire have greater apparent charge density than the electrons, causing a net attractive electric force observed as magnetism.

<comment><USER4> The free electrons in a conductor move at nothing near the speed of light, though.

<comment><USER5> Even though the speed of the electrons is nowhere near the speed of light, electromagnetism is so strong that the tiny length contraction at those speeds is enough to produce the magnetic force.

<comment><USER6> Yes, this is the correct answer. It's a relativistic effect that is nonetheless observable at velocities not usually considered to be relativistic.

I think this is extremely cool, BTW: any ordinary refrigerator magnet serves to demonstrate the truth of special relativity. Indeed, since the propagation of a photon involves oscillating electric and magnetic fields, the very existence of light itself depends on relativity.

So in a strange and unexpected way, one could say that when Michelson and Morley went searching for the ether, they actually found it. The fact that the speed of light is the same in every inertial reference frame is precisely what allows it to propagate at all.

</comment></comment></comment></comment><comment><USER7> I prefer this explanation by Richard Feynman:

<http://www.youtube.com/watch?v=MO0r930Sn_8>

<comment><AUTHOR> That's not really an explanation, though. It's really saying - you don't know enough (yet) for me to explain what I know, although I don't know everything.

<comment><USER7> It was still the _best_ explanation he could give.

</comment></comment></comment><comment><USER8> I think this summarizes the article: "Why? We don't really know, but we can observe some consistent rules."

</comment><comment><USER9> Comments tl;dr: Electric fields + special relativity = magnetic fields

This is 'relatively' unknown triumph of special relativity ;-)

"What led me more or less directly to the special theory of relativity was the conviction that the electromotive force acting on a body in motion in a magnetic field was nothing else but an electric field." - Albert Einstein

</comment><comment><USER10> Here's a question for you. Take two bar magnets. Put one on a table. Hold the other above it. The magnet on the table will be attracted to the one you're holding and will jump up and stick to it. The magnet on the table has just done some work. But magnetic fields do no work. What just happened?

<comment><USER11> You did the work by moving the magnets away from each other. This converts some of the kinetic energy you created by moving them into potential energy. As you moved the magnets back closer to each other, some of this potential energy converted back to kinetic energy, until they were close enough that the force exerted by the magnetic field exceeded that of gravity, at which point there was a large conversion of magnetic potential energy into kinetic, and then gravitational potential energy.

Further, note that since a force was exerted over a distance , work was indisputably done. Exactly what did that work is a matter of opinion, but work was certainly done.

</comment></comment><comment><USER12> I don't see any relativity in the actual post, but I'm happy to see it here in the comments. For more info, of course, the real source is Einstein's "On the Electrodynamics of Moving Bodies"

</comment><comment><USER13> reminds me of that : <http://www.youtube.com/watch?v=OvmvxAcT_Yc></comment>


Man-in-the-middle attack on Mobile Facebook possible due to lack of HSTS header - <AUTHOR> https://gist.github.com/bartekn/6924685

<comment><USER2> It's important to note that even if the HSTS header was present on the mobile site, the exploit would still be possible since many mobile browsers do not support HSTS[1].

[1][http://michael-coates.blogspot.com/2013/09/security- capabili...](http://michael-coates.blogspot.com/2013/09/security-capabilities- comparison-hsts.html)

</comment><comment><USER3> >We are slowly rolling out HSTS across the entirety of Facebook's infrastructure. The fact that m.facebook.com does not send this header currently is by design.

Why not? For browsers that don't support HSTS, the header will be ignored. For those that do support it, the end-user gets better security. Is there a feasible reason for not enabling it everywhere? My guess would be so Facebook can disable SSL for certain browsers?

</comment><comment><USER4> I don't get this header. Wouldn't the man-in-the-middle that is using something like sslstrip also be able to strip out any header they choose to?

<comment><USER5> Yes, this is the case, but _only_ in the first request. As soon as an HTTP user agent gets such an HSTS header, it will only communicate via HTTPS until _max-age_ expires.

<comment><USER6> Only if the browser supports HSTS. Many do not, especially mobile browsers.

</comment></comment></comment><comment><USER7> Useful post simply for bringing attention to HSTS; of which, I've never heard.

</comment><comment><USER8> I think marking cookies secure only is more important than hsts, but if both lack, then it's quite bad thing.

Btw. There are many sites like this out there. So this isn't news actually. There are even more sites which lack https completely.</comment>


Show HN: Devpen – Markdown Editor with GitHub Style - <AUTHOR> https://devpen.io <comment><USER2> One thing I'd love is a Markdown editor that has full integration with Google Drive, like how Draw.io does. Changes are automatically saved to Drive so everyone else on your team can see them instantly. Other team members can view and edit the file in Drive just by clicking the file in Drive, they don't need to install or sign up for anything.

A lot of web based Markdown editors let you save to and import from Google Drive, but I don't want yet another system to manage files with.

<comment><USER3> _> One thing I'd love is a Markdown editor that has full integration with Google Drive, _

That's not a technical problem.

It's a market problem, I nicknamed the "pay or pray dilemma of free software".

To solve your problem you either:

 _Pay_ someone to build a solution on top of Google's interfaces (Drive API/Chrome extension etc.)

\- or -

 _Pray_ for Google to provide desired functionality. (Or alternatively for some indi developer to provide said functionality for no rational reason other than their own interest in the problem).

The odds of success are not evenly distributed between the two options.

<comment><USER4> This comment reads like a criticism, but I don't see what anyone did wrong.

It's true that to have a thing, you either have to pay for it or pray for it, or make it onesself.

But before any of that, comes discussion if what would even be a good idea or not. Why does it bother you so much that people talk about what they would like?

Some developers actually want users to discuss what they would like, in order to know what to take a chance on building.

Also, it's a perfectly "rational reason" to build something to provide to the world, when you realize just how much you benefit from the world of things other people have built and given away already.

In fact, what is not very rational, is advertising that you don't consider it rational to contribute to community efforts.

<comment><USER3> Brian, you are reading it wrong.

That was an observation.

And specifically you are reading the term "no x other than y" wrong.

It actually means x is an attribute of y, or a group, and y is of importance. As in "no player other than LeBron"

It was used in this context in a way similar to "We should send humans to Mars for no rational reason other than to prove that it is technically possible".

Thus, this comment has no rational reason other than to set the record straight.

</comment></comment></comment></comment><comment><USER5> The first thing I tried were checklists

        - [ ] foo
        - [ ] bar

It's my favorite thing about github style markdown. I doubt you need more ideas for your todo pile, but there's one for you.

<comment><USER6> Another one would be to add support for LaTeX rendering :)

<comment><USER7> I've implemented this in my app: [http://www.amitmerchant.com/markdownify- web/](http://www.amitmerchant.com/markdownify-web/)

Additionally, it has a dark mode as well.

</comment></comment></comment><comment><AUTHOR> Hi HN,

Imagine that you guys want to write documentation for your project by writing Markdown in Readme.md, to be published on GitHub later.

I'm an Android Dev, and I use a plugin to preview my Readme in Android Studio. And sometimes, I use other online Markdown editor, by doing live editing there. Problem solved, at least for now.

What I've found so far is that those solutions give me different style. And the problem usually arises after that. Sometimes, after updating the Readme.md file and push it to GitHub, there are some parts that are not suitable. Something like, H1 is too bigger for this section, or link is not shown well there, etc.

Devpen is an online tool to solve that problem.

<comment><USER8> Very cool - I've run into the exact problem you described many times in the past and actually considered building something very similar to this.

As a side note, it looks like <img>'s aren't working - try adding something like this:

      <img src="https://www.google.ca/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png" />

Making images format correctly in GitHub READMEs has always been a bit of a pain point for me, so this would be a nice feature to have.

<comment><AUTHOR> Hi, I've updated Devpen.io, and now it supports img tag, and html tag generally. You can try yourself there :)

</comment></comment></comment><comment><USER9> Right off the bat, I'd recommend adding a prompt if the window has any user input to prevent fat-finger tab closing (and therefore losing all work). Alternatively, consider using service workers.

<comment><AUTHOR> Agree, thanks for the feedback :)

<comment><USER10> And/or persist the buffer as long as possible. Especially from "back button" or browsing to another page and then navigating back.

</comment></comment></comment><comment><USER11> One of my favorite things about the GitHub editors by far is easy image embedding. You can drag an image file into the textarea and it handles uploading it, and then puts in the correct markdown code for embedding that image. In fact, I consider that single feature the differentiator of Github's markdown editor. I use it all the time at work when wanting to post a screenshot to describe my issue, etc. It was actually the first thing I tried when loading up devpen.io. :)

I realize that feature alone might be costly to build. You'd need somewhere to upload images to, maybe an S3 bucket, and maybe add a CDN, etc. Then you have to deal with abuse/have code to prevent infinitely large uploads, etc. It's not an easy feature, but thought I'd point it out as a potential thing to build. :)

<comment><USER12> One of those reasons I want IPFS to become a given part of the browser/web/internet infrastructure. If it was integrated as part of the web browser your web app could upload straight the local ipfs daemon. If someone wanted to abuse it they'd literally only be wasting there own disk space. The files would become unaccessible when the browser was closed, but an entire service industry could develop in top of storing you IPFS content across the network, for a small fee, you could even provide that for your users. But no need to worry about that upfront, the users barrier to entry is low, no account creation, no cards, and the content is available to share with other users immediately.

</comment></comment><comment><USER13> [http://hackmd.io](http://hackmd.io) is by far my favorite markdown editor. It supports GH style markdown but with even more features: \- Slideshow mode \- Inline graphviz/MathJAX/mermaid and some other stuff \- Collaborative GDocs- style editing (though no out of band comments) \- Image upload \- PDF export

It's also somewhat open source (community edition is AGPL). You can host it behind a vpn for internal use.

Admittedly they're not the most secure editor - e.g. image uploads are technically publicly accessible. Though supposedly there's an enterprise version coming out with those features at some...point.

Disclaimer: I don't work with these guys. Just a fanboy at this point. :)

</comment><comment><USER3> Nicely done.

It's interesting that such a simple need (editing a readme) is so not trivial.

Anyway, I built a similar tool once, with the github style sheet but with "in place editing" rather than side-by-side (and some other "experimental features").

You can make a doc using this link if you want to try: [http://public.docs.xstatic.site.s3-website-us- west-1.amazona...](http://public.docs.xstatic.site.s3-website-us- west-1.amazonaws.com/__markdown.html#)

</comment><comment><USER14> I'm pretty sure you can use CSS to make Typora to mimic GitHub style just as well.

[https://support.typora.io/Add-Custom-CSS/](https://support.typora.io/Add- Custom-CSS/)

EDIT: maybe the existing theme does the trick (I don't use that theme):

> {current-theme}.user.css under theme folder. If you choose Github as your > theme, then github.user.css will also be loaded.

</comment><comment><USER15> Implementation question: does it re-render the entire content on every keystroke? Or is it smarter, and does it re-render only the changed bits?

<comment><AUTHOR> Yes, re-render the entire content of the Preview side. Not smart yet. Re- rendering only the changed part would be great. I also thought that way, might take quite long time to implement it. So publish now, and improve performance later. So that I know if my solution is really needed by lots of people, before going deep. Thanks anyway :)

</comment></comment><comment><USER16> Nice! Thanks - I always find myself looking for a GH-flavored markdown editor and I always google for it. devpen.io is easy to remember.

This would be annoying and potentially impossible to get working, depending on GitHub, but it would be neat if you could point this at the URL for a markdown file on GitHub and it would open it up for editing and a PR.

</comment><comment><USER17> Very nice app. I found myself flicking between edit and preview on GitHub a lot yesterday, and I wanted nearly exactly this!

It would be especially useful if Devpen passed through the small amount of HTML that GitHub allows, such as `<p align="center">`.

<comment><AUTHOR> Hi, I've updated Devpen, and it supports general HTML now. Thanks for the feedback :)

</comment></comment><comment><USER18> Buttons seem misaligned [https://imgur.com/a/G3TTobk](https://imgur.com/a/G3TTobk) macOS High Sierra 10.13.4, Chrome 67.0.3396.79 (Official Build) (64-bit)

<comment><AUTHOR> Hmm, the empty space on left side of each button was supposed to be icon from FontAwesome. I think your browser didn't load FontAwesome well.

But that's okay, I've updated Devpen so that FontAwesome icons are now handled properly. Thanks for the report :)

</comment></comment><comment><USER19> Consider horizontal splits on mobile devices in portrait mode.

</comment><comment><USER20> I accidentally closed a page I was editing and lost my changes. You should add that thing which throws a confirming alert, which would have saved me.

<comment><AUTHOR> Fixed. Thanks for the feedback.

</comment></comment><comment><USER21> Code highlighting would be also a nice feature to add.

</comment><comment><USER22> I use [https://hackmd.io](https://hackmd.io) It's free, open source, real-time collaborative.

</comment><comment><USER23> It's nice, save would be great also a link to the documentation for your flavor of Markdown.

<comment><AUTHOR> Save button and documentation, noted. Thanks.

</comment></comment><comment><USER24> Now that vscode has live previews for markdown, I can't imagine having to remember some other app just for markdown.

It's such a nice feature.

This looks nice too, but it's just a limited appeal. Editors are way more intelligent then I ever thought they could get.</comment>


Visual DOOM AI competition results - <AUTHOR> http://vizdoom.cs.put.edu.pl/competition-cig-2016/results <comment><USER2> Funny but I think that this competition is a blatant case for _not_ using deep learning for everything. Apparently the software can have access to the depthbuffer. That makes the "defend the center" exercise extremely trivial and should make aiming and shooting much better than the demo we see.

I think that a scripted AI will be much better than a blind deep-learnt one. A level of deep-learning may add a good layer of intelligence, but I think that building it on some optimal bricks would be a good start.

<comment><AUTHOR> Depth buffer access was disallowed for the competition. It would be sad if the result of the competition was a hand coded AI that would work on DOOM but fail on anything else. A pure deep learning approach should be easily generalizable to other games.

</comment></comment><comment><USER3> I'd love to see this happening with self driving cars versus race drivers in an endurance race</comment>


Veto of Apple Ruling Likely to Upend Big Patent Battles - <AUTHOR> http://online.wsj.com/article/SB10001424127887323420604578648272862276836.html

<comment><USER2> Like many other iPhoney devotees, Obama doesn't like people messing with his deity.

</comment><comment><USER3> It will be interesting to see what other companies Obama will go out on a limb for and veto trade restrictions for.

I wonder if this move will nullify the other feature-trolling lawsuits taking place right now

</comment><comment><USER4> I hope that means it will stop Apples nonsense patent war against other companies, too - but I fear this is more like an encouragement for them to do it, because they now know they have the US administration's protection.</comment>


LSCOLORS Generator - <AUTHOR> https://github.com/ggreer/lscolors

<comment><USER2> A working version of this code is at [http://geoff.greer.fm/lscolors](http://geoff.greer.fm/lscolors)

I first wrote this back in college, when my knowledge of JavaScript and UIs were minimal. Now I look at it and see embarrassingly bad code. It's nice to realize how much I've improved.</comment>