Show HN: Make an app by adding JSON to this app - <AUTHOR> https://github.com/Jasonette/JASONETTE-iOS?hn <comment><USER3> I've built similar platforms. Naturally, I think they are awesome. They are a core part of very valuable products like SAP, Salesforce, etc. You will get a lot of push back from high developers who prefer direct access to the native api or html. Please don't let them discourage you. My response to them is that they can build reusable components that are driven by your json layer (win- win). There are enough developers who will benefit. Try to get funding sooner than later. I waited too long. You can't keep up building this by yourself.

<comment><AUTHOR> Thank you for the advice! Honestly it means a lot!

<comment><USER4> Don't listen to the haters. This is extremely valuable. Especially in E-commerce.

Like when you have an ever expanding product line and new categories are being added all the time. Ever wondered why Amazon uses web views all over ?

Many E-commerce companies would love to be able to do extensive A/B testing or add analytics on the fly but are crippled by the App store and the limitations of native apps. Some have even built versions of this themselves.

What we need is an Android port of this and then this will be some hot shit. I am willing to help on the iOS side in any way I can.

<comment><AUTHOR> Thank you! Please follow the project and join the Slack channel if you can :)

<comment><USER4> But my personal view is that we should support a syntax that is a subset or derivative of HTML while being performant so that any existing web framework can generate smooth native apps (while also side stepping Apples rules against implementing a browser engine :P).

It sounds stupid but I work in E-commerce and have wished for this many times.

<comment><USER5> That sounds like React Native: [https://facebook.github.io/react- native/](https://facebook.github.io/react-native/)

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Guys, the author here. This is my first open source project and I worked really hard on it for 5 months.

I think it's really cool, and I hope you guys like it. I would appreciate any kind of feedback!

<comment><USER6> Hi Ethan, it looks very interesting, one feedback and one question: Feedback: you should try to slow down the gif demos, at least in my Chrome/laptop they are quite fast and the viewer can't really appreciate it completely

Question: I see that XCode is required, I don't have a Mac only an iPhone). Any possible way to use Jasonette without a Mac? I've seen some services like Mac in a cloud but I was more thinking about alternative methods. For example, as the only setup required is to provide the URL, couldn't you create a generic Jasonette test/dev app where you can provide the url and do the testing/development directly only on the json side?

<comment><USER7> You can run the latest MacOS in VMware on Windows. It works perfectly - <USER2> "VMware Unlocker" as a starting point. This setup actually runs faster than the older Mac Mini I bought specifically to develop for iOS, and it's obviously much more convenient to be able to use a Mac from Windows whenever needed. Both Xcode and a $99 Apple Developer subscription are required if you wish to distribute the app anyway, so I'd suggest you go the VMware route if you don't want to buy Mac hardware or use a cloud service.

<comment><USER6> I heard that running MacOS on a non-Apple hardware was not considered a legal solution. Am I wrong?

I thought my idea of having a test Jasonette app where you put the url from the app after the boot to do your testing could be very easily doable and way not it could allow also to test the various existing apps that OP created: he could create a test app that downloads a list of his demo apps (so it is always up to date), show a dropdown or similar to choose the demo app + allow you to specify your own custom test url using the keyboard of the device. In this way you have both a demo and a test application :)

<comment><USER7> IANAL but I'm fairly certain that given Apple's resources, if they wanted to stop this practice, they'd have obliterated VMWare Unlocker from the map. It's been around for years, they certainly know about it, and they haven't done anything about it. So if not expressly legal, they certainly don't seem to have a problem with it.

</comment></comment></comment></comment></comment><comment><USER8> Instead of JSON, you could also consider sending XML markup. Oh wait, or maybe reuse an existing SGML/XML standard called...HTML.

And then you could add scripting...

<comment><USER4> Hey everyone ,

I've thought of making a Native renderer for some subset of HTML like Google AMP that would work on both Android and iOS. That way all existing web frameworks could generate native apps.

But you'd have to do something like this to ensure that you're not breaking Apples rule of not making your own browser engine.

<comment><USER9> Easy- transpile it ahead of time. The ban is on runtimes.

</comment></comment></comment><comment><USER10> I found it interesting that the author has actually submitted the same idea 4 times to varying degrees of interest:

[https://news.ycombinator.com/submitted?id=gliechtenstein](https://news.ycombinator.com/submitted?id=gliechtenstein)

It's easy to forget that good ideas take a lot of time and iterations until they become magical. Great things do not happen overnight and without much sacrifice. The majority of people would give up the first time the community dismissed their prototype.

Big props for not giving up.

<comment><USER11> Exactly my thought. You need a bit of luck along with good project to get viral on HN. Otherday I saw simple PDF memo generator got lots of traction while so many other cool apps didn't even surface up.

</comment></comment><comment><USER12> Very cool.

For what it's worth most med-high profile games are built on similar techniques albeit at a larger scale. You're largely building tools and reusable components that let designers, artists and animators define behavior, look & feel.

It goes by a couple different names but the most common one I see is "Content Driven Development". As you've noticed it has all sorts of benefits like fast iteration time, updates on the fly and ability to allow non-coders to bring in their perspectives to build experiences.

Don't let the ivory tower haters get you down, it's a very powerful and valid approach in the appropriate domains.

<comment><AUTHOR> Thank you for the encouraging words!! { ˃̵̑ᴥ˂̵̑}b

<comment><USER13> Taking this a step further, perhaps this can become a quick mock up tool ?

</comment></comment></comment><comment><USER14> Been there, done that. When I coded games, I made some simple JSON based file format and almost whole game was in form of JSON. I even implemented conditional and loops in JSON.

But It can easy lead to inner platform effect. Not needed complexity. And in JSON you can't write JS code (needed for e.g. event handlers).

So I switched to JS. Still data-driven approach (simple hierarchical objects with data), but with power of JS (and if you're use Babel, you could use JSX for your DSL).

So: I don't think JSON is best format for what you try to achieve. It's just so limited.

Besides what is added value of Jasonette? When I look on Jasonette I have feeling that it's just reinvents ReactJS but in JSON not JSX. Not sure if there is much profit with JSON format alone.

<comment><AUTHOR> [https://jasonette.github.io/documentation/actions/](https://jasonette.github.io/documentation/actions/)

<comment><USER15> Please consider reading this.

[https://en.wikipedia.org/wiki/Inner- platform_effect](https://en.wikipedia.org/wiki/Inner-platform_effect)

I, too, went down the path of JSON -> Compiler -> Code, and I essentially just made a worse version of what I was looking to simplify.

<comment><AUTHOR> Thanks for the article. I am sorry to hear what happened to your project, but I think, in my case because I didn't build this from scratch, but it was extracted out from an existing app, I was able to get this to a point where I'm very satisfied with the result.

My goal was to make something that will help myself build, iterate, extend my existing app much faster, and it really did, so that's when I realized it would be great if I can open this up so others can use it as well.

To be more specific, nowadays I can build, iterate, and extend apps significantly faster, as in what used to take couple of days I can now build in 30 minutes. Maybe it's just me but I'm sure if I can do it, anyone can do it.

</comment></comment></comment></comment><comment><USER16> Really great stuff!

What is the most advanced application you have created with this? What functionality do you think is still lacking?

If you were to try to create a full featured app I imagine you'd find that working in Swift is the better option.

What this reveals to me is that the App Store submission and update process is so time consuming you would rather write your logic in Json than in native Swift/ObjC.

If Xcode let you instantaneously push app binary updates would this be as useful?

<comment><AUTHOR> There's an issue thread where we're discussing this: [https://github.com/Jasonette/JASONETTE- iOS/issues/4](https://github.com/Jasonette/JASONETTE-iOS/issues/4)

<comment><USER16> The advantages of creating your own wysiwyg editor is that you can control exactly what functionality Jasonette supports and allow developers to create views across different platforms (right now Xcode is Mac only). But have you considered starting with Interface Builder and creating a tool to convert IB views to JSON? Interface Builder is home to a lot of developers who already understand how to use that tool, asking devs to work in a new half baked editor would probably be frustrating and add more complexity/moving parts which is your enemy as a new project/endeavor.

If you create a tool that just converts IB views to JSON you can demonstrate progress much faster and learn and experiment with what the requirements of the final editor are. It will be much easier to stand up and way less effort than maintaining your own editor codebase while the project is young. Your time is the most valuable thing you have so don't spend it creating a new editor which could be its own project in itself. You want to put it towards expanding missing functionality between JSON and native components. One day when you find success and if you really still need to limit the user you can move all the functions you made for converting Interface Builder views into your own custom editor.

I think first thing I would do is take a very complicated interface view from a native project and analyze the view hierarchy and report errors to the user like "Warning: Nested UITableViews are not supported in Jasonette", "UIButton delegate will be ignored", etc. Then once you create this sort of 'unit test' that the IB is well-formatted you can then go about exporting it to JSON.

There may be a world where you actually are able to use all of the functionality of IB and don't ever have to have your own editor.

<comment><AUTHOR> Interesting, I haven't thought of that idea. I'll make a note so when we get to it we'll make sure to look into the option. Thank you so much for the advice!

</comment></comment></comment></comment><comment><USER17> This is very interesting, although JSON is not a very comfortable format to build manually - I think writing in YAML or CSON would be much cleaner to read/write, and easily converted to JSON. Also, any plans on building a UI for generating this JSON? If you have predefined components, you could make some sort of designer that builds the JSON for the user, that could turn into a commercial project I think.

<comment><USER18> Transpilers should be pretty straight forward. Maybe even for HTML syntax.

<comment><AUTHOR> Yeah we were actually discussing whether we should support HJSON natively or not [https://github.com/Jasonette/JASONETTE- iOS/issues/5](https://github.com/Jasonette/JASONETTE-iOS/issues/5)

But as for HTML, I decided to incorporate it natively because it's def worth it: [https://jasonette.github.io/documentation/templates/#html](https://jasonette.github.io/documentation/templates/#html)

</comment></comment></comment><comment><USER19> Wow this is really impressive.

If you had enough JSON-to-native "modules", basically anyone could write a native app in a few hours (since functionality in most apps is pretty much standard stuff)!

Hell, if you pushed this further you could create an app store for code, letting you buy additional modules to plug into your app like lego.

</comment><comment><USER20> Wow that is actually a brilliant idea. Would you ever consider making an android version?

<comment><USER21> I had a similar idea and started with an android app [1] for creating an app template with a simple interface directly on the device. It's not as powerful as this, but maybe I can implement basic support for these templates. But right now this would be only like a viewer and not something that can be used for own apps, not sure how useful that could be.

[1] [https://play.google.com/store/apps/details?id=com.bashtian.a...](https://play.google.com/store/apps/details?id=com.bashtian.appcreator)

</comment></comment><comment><USER22> Very neat and well put together! Thank you for taking the time to prepare nice documentation to go along with it! Congrats on your release!

<comment><AUTHOR> Thank you! I had no idea documentation would be this hard. As a wise man said, I learned that open source project is "1% inspiration and 99% documentation" :)

</comment></comment><comment><USER23> Congratulations! I think you have "discovered" QML, my favorite environment for rapid GUI development, incredibly intuitive. You may want to to look into that for inspiration.

</comment><comment><USER24> This is really cool.

Why not also support the web? With an Immutable store you could easily use react to display this app on the web without needing native install.

Great job. Look forward to seeing where this goes.

</comment><comment><USER25> What would be the feasability of an Android port? I like the concept, but hate that it's for a platform that I refuse to touch with a ten-foot pole.

</comment><comment><USER26> Students (especially younger ones) often need more help seeing the light at the end of the learning tunnel. Something like this is a great start to teaching development and spurring them onto an actual language.

I usually don't start with CSS let alone SCSS for websites, basic HTML shows them instant results for what they typed and gives them more endurance for the longer learning curve (but more power) provided by CSS.

</comment><comment><USER27> OK, this obviously looks like a web browser (native...) using json instead of (xml-like) html, though it's not good as a markup language.

Interesting is having declarative templates on the client side, instead of server-side, for accessing json APIs. Of course you can do this in browsers (and it is done), but this is cleaner and simpler, being a fresh reinvention.

</comment><comment><USER28> Is anyone working on an Android port? I'd definitely want to give it a go.

Haven't checked yet, but is there a spec for the json?

</comment><comment><USER29> Small detail I enjoyed from your website (on mobile, might be different for desktop) : header text positioned to the right of the screen (or content div).

Position right is something we don't see often. This shows it is a great way to make your page easier to read.

<comment><AUTHOR> Thank you for noticing! :)

</comment></comment><comment><USER30> I'm at a restaurant reading this so I haven't had a chance to test it out yet but having reviewed the website I already see a massive use for this: Programmatic app building. This is an awesome idea. I can't wait to play with it.

</comment><comment><USER31> This plus Huginn will be awesome for dynamic apps

</comment><comment><USER32> Looks like a new name from jasonclient.org. Previously discussed 6 months ago: [https://news.ycombinator.com/item?id=11736817](https://news.ycombinator.com/item?id=11736817)

<comment><AUTHOR> Yup I worked on open sourcing it for 6 months! This is the open source version of Jasonclient

</comment></comment><comment><USER33> Nice to see you getting so much positive feedback, here is some negative feedback balance it out:

* How is this different from any of the other declarative app building systems that have, as yet, failed to take the world at large by storm?

* Why JSON? I get it's universal but it's also annoying to write. Why didn't you consider YAML or , even better, HOCON?

* Do you really think loop syntax in a declarative language is a good idea, because to me it always comes across as a nasty anti-pattern to get around the fact that declarative languages don't tend to handle this well?

Otherwise, nice effort. Better than anything I've ever shown to the world :-)

</comment><comment><USER34> This seems similar to what is used internally at AppSpotr[1] (disclaimer: I'm a former employee). They also use JSON to represent apps that can be rendered in iOS/Android clients. The difference is that apps must be built using a WYSIWYG editor rather than by editing the JSON directly.

From my experience, a JSON representation works very well for a big percentage of all the apps out there, and you can often do without custom code. Good job creating this open-source version, it looks very expressive and useful!

[1] [https://www.appspotr.com/](https://www.appspotr.com/)

</comment><comment><USER35> So what this is, is an IOS hypermedia (AKA true REST) client, for consuming APIs serving a custom (as opposed to generic) hypermedia format.

The format itself is designed for a particular problem domain, namely outputting mobile-application specific controls and behaviours.

It would be an interesting exercise to extract those aspects into a custom vocab for JSON-LD + Hydra (or Siren, or (insert) other generic hypermedia formats).

[http://www.markus-lanthaler.com/hydra/](http://www.markus- lanthaler.com/hydra/)

It would also be interesting to have the hypermedia format defined as a schema somewhere.

</comment><comment><USER36> Is this HTML reinvented? :)

<comment><USER37> Seems similar, but there are definitely advantages to this approach. HTML is crap for making apps.

</comment></comment><comment><USER38> This is really great one. Shameless plug, we've built similar (but smaller) concept for the filter form of our apps[0] (cross platform, natively for Web, Android and iOS) mainly because we were tired of having to change the search filter form fields and logics in every app update. Now, we just have to change the configuration and the filter form changes instantly.

[0]: web version can be found at - [https://www.99.co/singapore/rent](https://www.99.co/singapore/rent)

</comment><comment><USER39> This is awesome! I actually had this same idea and built a platform for non- technical people to have the ability to build native apps. We picked Xamarin.Forms as our mobile framework because that way we could target most of the mobile platforms and share as much code between those project. We also picked Drupal a CMS to give non-techies an easy framework to build things out. I am going to keep an eye on this project for some different ideas and maybe one day we can pick your brain with our idea/platform.

</comment><comment><USER40> This looks very cool. And tempting at the first glance. As I read more of the documentation, I can't help stop comparing it with React-native for the rendering part. I remember somebody mentioning server-rendered mobile apps in one of the early react-native apps. This is pretty much achieving that.

However, the comparison ends there. This is great! Its just too simple to make an app and probably when the app grows one could create a transpiler to generate this json

<comment><AUTHOR> Thanks! You'd be pleasantly surprised to learn what's coming up, please follow the project to stay in touch :)

</comment></comment><comment><USER41> Android and web dev here, how would you compare this to nativescript and such? Instead of learning a new dsl, isn't web to native simpler? Unless you're developing a game I've never found native to be necessary. I'm one of those devs who moved from native to hybrid for faster development speed

[edit] I really like how you're participating in the comments and how you reply. I really hope you do well, you seem like a nice person :-)

<comment><AUTHOR> Thank you! If you thought these JS based app development was fast, you're in for a real treat! Check out these apps I wrote as exercise: [https://github.com/gliechtenstein/botlist.json](https://github.com/gliechtenstein/botlist.json) & [https://github.com/gliechtenstein/kitty.json](https://github.com/gliechtenstein/kitty.json)

I built these in around 15 minutes each, and you can too, once you get used to the markup you can too (which also is great since all you need to learn is the consistent JSON syntax which works for actions, view layouts, and styling. There is no real "environment setup" and "becoming a programmer" process that most people need to go through just to get anything running).

</comment></comment><comment><USER42> One use case: you have a game or app, and want to publish rich promo screens for new features or in game events. Even to old versions of clients. We once built a tiny in-house framework for this, based on Lua (game downloaded a package of Lua script and image resources and displayed the promo). If there was something ready to use (and multiplatform - at least android and ios), we could have saved quite some development time.

</comment><comment><USER43> I know, it is too simple, people's head just exploded.

Well, there seem to be great number of uses for this. I think this is excellent idea. Off to make an app... or two.

</comment><comment><USER44> I tried building the instagram clone but get:

Failed to create provisioning profile. The app ID "home.master.Instagram-UI- example.Jasonette.com.githubusercontent.raw" cannot be registered to your development team. Change your bundle identifier to a unique string to try again.

Anyone knows whats up? I ran the setup and inputted 2 and supplied the URL from the Github..

<comment><USER45> The app ID is alreay in use. Change the string (add your name or something)

</comment></comment><comment><USER46> I made something very similar in 2004. Instead of JSON, you would supply PHP arrays. The enabled to mix in some conditional code and make it more flexible for different usage patterns. We shipped a pretty big ERP application this way. I have since left the company, but the software still works on 200+ installations.

</comment><comment><USER47> How do app permissions work? Is there a way to make Jasonette request only the permissions needed by my JSON?

<comment><AUTHOR> what kind of app permissions?

<comment><USER48> Push notifications/camera/photo access and such?

</comment></comment></comment><comment><USER49> Late to the game--where does logic go? Looping? DB access? Would they be written in Objective C as actions?

<comment><USER49> OK, I missed that actions can be chained through an optional 'success' action: [https://jasonette.github.io/documentation/actions/#b-handlin...](https://jasonette.github.io/documentation/actions/#b-handling- another-actions-result)

</comment></comment><comment><USER50> This is very cool! Do you have a spec to share? First thing i thought of is that it would be awesome to write webapp and static site generator implementations of the jason spec.

Im in the process of making my own static site, and im storing as much of configuration and content as possible in json.

</comment><comment><USER51> This is a wonderful idea! Making app development faster and easier can only be a good thing.

Now if only it were possible to place a generic version of this app on the App Store and allow users to load in the JSON for whatever app they want. Sadly I very much doubt Apple would allow it.

</comment><comment><USER31> This is quite useful with a Huginn server setup to dynamically feed JSON out [https://github.com/cantino/huginn](https://github.com/cantino/huginn)

</comment><comment><USER52> Neat project! I've been working on something similar here: [https://github.com/mcudich/TemplateKit](https://github.com/mcudich/TemplateKit)

</comment><comment><USER53> Native app newbie here. Can this solution be used to present data tables?

</comment><comment><USER54> Well you do need to be a little bit of a programmer. You have loops in there, and evaluating properties of objects, etc. Interesting idea and it looks like you've done a nice job of it.

<comment><AUTHOR> I think I need to make some changes to the main screenshots, those are actually one of the most advanced features of Jasonette.

You don't really need to use those templates at all. What those templates do is let you do advanced stuff like client-side rendering, dynamic data processing, etc.

But you can build a full fledged app WITHOUT any of those advanced stuff. Watch the video on the website and you'll get it immediately!

</comment></comment><comment><USER55> Hey Buddy!, Great concept and smooth execution. Something for Android?

</comment><comment><USER56> Cool idea. But I'm wondering if this is allowed in the App Store?

<comment><AUTHOR> Yup, in fact this was extracted from production apps on the appstore. Here's one: www.textethan.com

The way this works is like how a web browser works, all the code you will ever need is already in the binary, the JSON markup is just used to custom- construct your own app to your liking in realtime.

<comment> yoz-y What do you mean by extracted? Did those applications use something similar or did you collaborate with the creators?

<comment><AUTHOR> No that's me. I'm Ethan, and I created that Ethan app. Jasonette was born out of my frustration with various aspects of working on the Ethan app. So that app (and all other apps I have created since) currently run on Jasonette. Sorry for the confusion with names.

</comment></comment></comment></comment><comment><USER57> This is nice. I always wondered why something like this isn't available. I built a nested tab-bar menu system for an e-commerce app recently which can be generated from a json file.

</comment><comment><USER58> What about Push Notifications? Are they supported somehow?

Great project, by the way!

</comment><comment><USER59> Is is possible to include some kind rich text/html editor that can send data back to a server via JSON? Is it possible to send any user data back to a server with Jasonette?

</comment><comment><USER60> Congrats on the release !

this actually reminded me of a startup which lets you create a native app using API documentation ( swagger ).

Edit : If I can find the bookmark, I will the link to that startup here.

</comment><comment><USER61> This is awesome. Do you plan on releasing an Android version?

</comment><comment><USER62> > "text": "{{$jason.find('#about h2').text().trim()}}"

Yeah, you can only get so far being declarative. Miracles don't happen.

</comment><comment><USER63> The more I scrolled down this page the more impressed I got.

What's the performance like? Does it handle switching views back and forth? Keep state?

<comment><AUTHOR> Thanks! I think the best way to see is to actually jump in and try it out. I tried my best to make the onboarding as seamless as possible, so normally it should take like 20 seconds from download to having the app on your phone (assuming you already have latest XCode installed)

It does handle switching back and forth and everything else you would expect from a native app, because it _is_ native (and not an emulation) :)

</comment></comment><comment><USER64> Great Job.

This is the next iteration of Titanium Appcelerator and Xamarin style apps (which basically do the same thing but internally).

</comment><comment><USER65> I would recommend adding documentation for shipping to the App Store.

Even if it's as simple as "just build and submit".

</comment><comment><USER66> Never thought you could do that much with just JSON, this looks very promising for students or for fast prototyping.

</comment><comment><USER67> Is there support for loading more pieces of the app on demand (so the server can generate them?)

<comment><AUTHOR> can you elaborate?

</comment></comment><comment><USER68> This looks really interesting. How can you localise an app's UI when using this?

<comment><USER42> I immediately thought of backing this with a simple node.js server and using templating for this.

</comment></comment><comment><USER69> Looks cool but what kind of apps are you supposed to build with this?

</comment><comment><USER70> This is great. I am new to iOS and this seems very promising.

</comment><comment><USER71> FWIW, the name is quite similar to [https://github.com/google/jsonnet](https://github.com/google/jsonnet)

</comment><comment><USER72> how to make an app in 15 min | How to develop a mobile app free [https://www.youtube.com/watch?v=tnsYachOafk](https://www.youtube.com/watch?v=tnsYachOafk)

<comment><USER73> Didn't know Red Hat spams hacker news for some crappy mobile app thing!</comment></comment>


Time zones in databases - <AUTHOR> http://www.vertabelo.com/blog/technical-articles/timezones-in-databases

<comment><USER2> I too wrote on this point. In my opinion you are creating a future headache for yourself if you use "Timestamp with time zone"

[http://www.hydrogen18.com/blog/time-zones-and-databases- dont...](http://www.hydrogen18.com/blog/time-zones-and-databases-dont- mix.html)</comment>


Google releases 'Primer' app that helps startups learn marketing fast - <AUTHOR> https://itunes.apple.com/us/app/primer-marketing-lessons-for/id918628107?mt=8

<comment><USER2> [https://www.yourprimer.com/](https://www.yourprimer.com/)

Interesting that they put out the iOS version first. You wouldn't ever see Apple put out something on Windows before OSX. Presumably the Android version isn't ready yet, but what does that signal about Android development compared to iOS development? (not necessarily a true signal, but within Google it could potentially be controversial)</comment>


The Future of Twitter Is Collections - <AUTHOR> http://txt.jazzychad.net/post/4f56c49dd5994e8efdce

<comment><USER2> This is the same complaint that a ton of people had with Google+, as the feature seemed even more important there and Google already had circles representing interests, they were simply "in reverse". This led to exactly the same feature request, and it was obvious to everyone that it should apply to Twitter.</comment>


Ruby gems are still not safe to use - <AUTHOR> http://cristianobetta.com/blog/2013/02/02/ruby-gems-are-not-safe-to-use/

<comment><USER2> The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

<comment><USER3> Another approach is to completely move away from using Ruby, Ruby on Rails and related software.

I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development.

Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates.

Furthermore, the focus should not be on cranking out libraries and code as quickly as possible, especially when said code is rife with security holes.

There are many other programming languages, libraries and communities that take a far more sensible approach to software development. We see far fewer of these kinds of issues arise when things are not done the "Ruby" way.

<comment><USER4> I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now.

You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes.

Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things be fixed within the Ruby community? Yes.

So if you want to advocate that people shouldn't use Ruby or Rails, fine, your prerogative. But please, stop being an asshole while doing it.

<comment><USER3> Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes?

Will they do the responsible thing and throw out all of the existing, poorly- written code?

Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start?

Will they throw out their flawed development philosophies, so that they don't get into the same situation later on?

I'm unfortunately inclined to think that we'll just see more of the same. These problems will be "patched" over, at best, rather than fixed at the root. In fact, proper fixing of these issues would go against everything that the Ruby community stands for.

That's why I think that moving away from Ruby and Ruby on Rails is a responsible approach. Some problems just can't be fixed, and I think we've encountered some of those in this situation.

<comment><USER5> I see your comments on every Ruby-related thread and you sound like a broken record.

Many of us Ruby-users see the problems in a similar way and try to fix them. It's a learning process and it happens right now. The ruby community is also not an uniform blob. We are not 37signals and we are not the rubygems team. Many of us disagree with some decisions made at these places. Most of us also use other languages and are well aware of the trade-offs that Ruby implies.

This is all worth discussing and the specific problems are worth fixing. The rubygems-team happens to be working on their problem, which is a _hard problem_ , right now; <https://gist.github.com/4696144>

Your mindless bashing on every Ruby HN-thread contributes nothing. Please use your time for something more productive, e.g. you could go to your preferred language community and help them fix _their_ security problems, which they also have plenty of.

<comment><USER6> I'd reeeaally like to see a second group of dedicated maintainers that are more concerned about security to step up to the plate, fast. The guys behind Ronin are doing great, but they are really just 2 guys battling against a community which have a track record of producing a code base that has had 8 code execution and 8 SQL injection vulnerabilities so far.

[http://www.cvedetails.com/product/22569/Rubyonrails- Rails.ht...](http://www.cvedetails.com/product/22569/Rubyonrails- Rails.html?vendor_id=12043)

[http://www.cvedetails.com/product/22568/Rubyonrails-Ruby- On-...](http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On- Rails.html?vendor_id=12043)

</comment></comment></comment></comment></comment></comment><comment><USER7> "Stop running code on gem install."

\- this is a real issue. I've used rpm shell execution to modify sshd as well as other system components in order "install" additional software. [http://web.archive.org/web/20090211040821/http://www.idle- ha...](http://web.archive.org/web/20090211040821/http://www.idle- hacking.com/2008/05/i-say-cap-you-say-rpm-i-cap-your-rpm/)

as you can see from that archived post, it's very important to have trust of what you are installing. especially when you have to install with root permissions....

Seeing how many references exist to "sudo gem install blah"... this is very serious as it's a high reward if you're able to get your remote code executing with root privileges (assuming as most would not limit sudo access e.g. user ALL=(ALL) ALL )...

<comment><USER8> I don't see the big gain in stopping to run code on install. By definition, we install gems to run code. If we don't trust the gem author not to mess with our system on install, how can we trust him not to mess with our system when we use the gem? Granted, there might be some people that install gems as root and run them as unprivileged user only, but even as a non-root user it's a problem to run code you don't trust.

<comment><USER9> Well... you would have to trust both the gem author and those who might have compromised an author's credentials. And my understanding is that the install can easily be running under a different set of credentials than normal use. (not a Ruby or Rails user here)

<comment><USER10> You don't need root to do serious damage. Even if you secure the gem installation process, the code inside the game can just do damage later. I think a signing system to prevent third party tampering of gems is the best that any developer packaging system can do.

</comment></comment></comment></comment><comment><USER11> Even if 5% of the rubygems ecosystem contained malware, the biggest danger to most projects is the inclusion of gems that are sloppily maintained. Just because something is released as a gem does not mean it has good code quality or that good development practices were used to create it.

The default behavior of bundler is to grab the latest compatible gem version, and in many cases this breaks things bc of little or no QA on the part of some gem maintainers.

The top 10% of gems are well maintained but the rest should generally be avoided.

</comment><comment><USER12> Worrying about code execution at install is silly. The whole point of installing a gem is to download code that you're going to execute.

So the whole gem (install code and runtime code) needs to be trusted, and should be verifiably signed by somebody you can trust.

<comment><USER13> I think the overall points raised help shape the bigger conversation about the current state and implementation of Ruby Gems.

Who built your Gem? How do you verify that still holds? You may trust developer A who released a nice Gem, but what about when he pulls in a dependency, that pulls in another dependency, and suddenly you have gems from developer B, who loves to stick a Yaml parser out there for all to compromise.

The whole design needs a rethink.

<comment><USER8> But isn't that a problem where no good solutions exist? We share code to reuse code. If we insist to allow only one level of dependencies, then we restrict code reuse which is bad in other ways: you promote reimplementation of functionality, more often bad than good.

</comment></comment></comment><comment><USER14> Is it safe to install rails with something like 'gem install rails' right now? I'm totally new to Ruby and to the Rails framework, but I was going to start a side project with it this weekend (today). Any advice on how I can safely get setup while the community is figuring out how to cope with the intrusion?

<comment><USER15> yes, all gems have been verified.

<comment><USER14> Thank you.

</comment></comment></comment><comment><USER16> Removing the ability to run code on gem install would be quite disruptive. I think that establishing a universal gem signing policy and/or some form of whitelist/blacklist strategy would be a better solution. Consumers need to be able to trust the installations of the tools they use. The same risks apply to any other installation process. Think of how we install RVM or Homebrew.

</comment><comment><USER17> Sorry in advance for being off topic, but: I rely a lot on Clojure repos like clojars.org and I in addition to checking my few Rails and Sinatra apps in the last few days, I have become a little concerned about the same sort of thing happening with clojars, main mavin repos, etc.

</comment><comment><USER18> This hyperbole is very silly! Weaknesses appear in everything when it becomes popular.

There needs to be something like the "app store" and I don't mean specifically apples' own.

But we need some of the big corps using ROR to step forward and provide complete support for this type of project.

</comment><comment><USER19> Then y many are giving lot of hype?

<comment><USER20> Because Ruby is something they use and they want to fix the problem. If they don't highlight the problems, nothing will get solved.</comment></comment>


Chatbot that overturned 160,000 parking fines now helping refugees claim asylum - <AUTHOR> https://www.theguardian.com/technology/2017/mar/06/chatbot-donotpay-refugees-claim-asylum-legal-aid <comment><AUTHOR> I remember seeing this technology posted on HN at its debut. Nice to see it applied to navigating a much more critical portion of bureaucracy.

Not the first time, either: [https://arstechnica.co.uk/tech- policy/2016/08/donotpay-chatb...](https://arstechnica.co.uk/tech- policy/2016/08/donotpay-chatbot-lawyer-homelessness/)</comment>


Xkcd Password Generator - <AUTHOR> http://preshing.com/20110811/xkcd-password-generator/ <comment><USER2> I kind of feel like all these passwords schemes and discussions about password strength fundamentally miss the point. Password reuse is the single greatest threat that any user faces. Nobody's going to guess your gmail password, even if its just six random lowercase letters. They're going to get it from a database dump of a compromised site where you reused that password.

I have well over a hundred websites listed in my password manager. There is not a chance that I could remember a unique password for every one of them, no matter how easy they were.

<comment><USER3> Wouldn't it be then enough to just simply use a unique scheme? I mean if noone will guess your password and just use possible DB dumps, this would be more than enough:

G#00gl3

A#m4z0n

F#4c3b00k

...

<comment><USER4> If a human can see one of your passwords, it's extremely easy to crack the other ones, no matter H0w m4ny tricks you try to use.

<comment><USER3> I know, but the OP said DB dumps are the biggest problems, not the password strength or if someone sees me typing it

<comment><USER2> Even that ridiculously weak password scheme would _probably_ stay secure until there were a few DB dumps. Then you'd be screwed for reusing the same password scheme across multiple sites. That was sort of my point: reuse is the enemy.

</comment></comment></comment></comment></comment><comment><USER5> Neat, I have the following in my `.bashrc` to accomplish pretty much the same thing. It should be noted that I do not use it for passwords (I have a password safe for that), but I do use it for passphrases since I may have to read them over the phone.

        secret () {
            # '\u' for `sed` is a GNU extension.
            shuf /usr/share/dict/words \
                | grep '^[A-Za-z]\+$' \
                | head -n 3 \
                | sed -e 's|\(.\)\(.*\)|\u\1\2|g' \
                | tr -d '\n' \
                | sed -e 's|$|\n|g'
        }

        > for _ in `seq 7`; do secret; done
        InterweaveMakariosEncrusting
        DisseminatingAgriculturalistCautioned
        EffectuatingCobblersEgos
        AccidentalKopeckRevolts
        RefDivansUndersigns
        SalesmanSubmitterFlak
        TempsIlluminedQuickening

<comment><USER6> Good luck reading "makarios" over the phone, though. You need a phonetically distinct alphabet, like the NATO alphabet, and entropy is very low there.

<comment><USER5> Your mileage may wary, but I have never had any issues reading them to the human operators. Security questions are bad policy anyway and I assume that they are less picky when hearing "SiloRepossessedTapir" compared to "SiloRepossessTapir", than for "Mary" to "Maria".

<comment><USER6> Wouldn't such a misheard phrase make the password you've set not match?

</comment></comment></comment></comment><comment><USER7> Ever since reading that xkcd comic and learning about diceware, I've really wanted to create a password generator that could spin out complete diceware sentences of arbitrary length. (Markov chains?) Mnemonics of various kinds could be taken into consideration: rhymes, onomatopoeia, etc. Instead of a 4-word nonsense passphrase, you'd get something like "the red rancid raccoon bit into the butter bucket biscuit" — easy to remember _and_ secure. Unfortunately, I'm not too familiar with this subset of programming.

(Limiting the word pool of each slot due to mnemonics would complicate the entropy calculation, but it should still be fairly straightforward.)

</comment><comment><USER8> The most important thing I realized when it comes to passwords was the classification into 2 types: strong passwords (keys, local login, local encryption, master passwords for password managers) which is best generated using the Xkcd method, and then the less obvious _disposable_ passwords (all non-local usage, i.e. websites and other temporary need). For the later, I use SuperGenPass[1]. It ensures that 1) my passwords are not reused across sites and 2) they are strong without the need to remember them directly. Because SGP uses hashes, it is very easy to add counters to existing passwords/secret phrases and create a brand new password without much mental effort. I've outlined such a procedure in the issues[2]. Using counters in the "secret" field, I will probably never ever need to change my master passphrase.

I won't deny though that for mobile use, it's a bit cumbersome. The Android app is fine and free[3], and iOS app is a buck[4]. And overall it's a pain if you must login to sites frequently (ideally, using a native app reduces this greatly, login once until you manually logout).

It's also pretty confusing for non-technical people to get behind. I actually sent out an entire email blast to friends and family giving them my best attempt at an explanation, argument, and tutorial of how to use it. I don't think anyone did it.

So while the interface is kind of clumsy, the strategy is solid and I love knowing that I can use it.

[1]: [http://www.supergenpass.com](http://www.supergenpass.com)

[2]: [https://github.com/chriszarate/supergenpass/issues/40#issuec...](https://github.com/chriszarate/supergenpass/issues/40#issuecomment-61357038)

[3]: [https://play.google.com/store/apps/details?id=info.staticfre...](https://play.google.com/store/apps/details?id=info.staticfree.SuperGenPass&hl=en)

[4]: [https://itunes.apple.com/us/app/supergenpass/id451606360?mt=...](https://itunes.apple.com/us/app/supergenpass/id451606360?mt=8)

</comment><comment><USER9> instead of remembering passwords i remember only one function i've been using for many years which takes the name of the site as an argument and returns the password as the result.

</comment><comment><USER10> I just use Diceware: [https://qrmn.uk/dwr/](https://qrmn.uk/dwr/)

(With thanks to Alyssa Rowan for the CSPRNG design. Public domain - feel free to copy it.)

For really important stuff, actual dice just to make sure.

</comment><comment><USER11> Two years ago I wrote about why this type of password is no longer safe: [https://medium.com/@hnlean/imp3n3tr-ble5832-not-an- impenetra...](https://medium.com/@hnlean/imp3n3tr-ble5832-not-an-impenetrable- password-anymore-db9f4fbff1ba)

(See step #6 in the list of steps in the article)

I'm sure the situation has only got worse since then.

<comment><USER12> > But you're forgetting the massive GPU array. The hacker runs a program that > generates random combinations of two, three or four dictionary words and > tries it against your password hash. It's going to take a while because the > number of such combinations are very large, but it's not impossible.

The xkcd comic suggests a combination of four from a very modest 2000 (2^11) common words resulting in ca. 2^44 combinations to check. It also assumes 100 guesses/sec which result in over 500 years to break. That's precise math and a somewhat reasonable assumption.

You counter this with an argument like "the number of such combinations are very large, but it's not impossible". You give no new numbers, no counter- assumptions, you don't argue that 100 guesses per second is too slow, you just state this.

So in this form your argument is ungrounded.

<comment><USER6> 100 guesses/sec _is_ really slow, though, when a desktop pc can do billions of SHA hashes a second.</comment></comment></comment>


Show HN: 3D first person game rendered in CSS/HTML - <AUTHOR> https://pantel.is/projects/css3d/ <comment><AUTHOR> Hello HackerNews! Super excited to read all your comments (last time I was here with audiomass.co).

This is meant to be an experiment of rendering a full 3D scene in html/css. Of course there is a ton of (vanilla) JS to handle pretty much everything - <USER2> the main point is to explore what good ol' divs can do in a 3D context.

It might seem a bit off, because I am not a good artist/world builder, but it contains various features such as lights and shadows calculation (rendered on divs though background images + blend modes -- try clicking on the candle). Billboarding and sprite effects, geometry culling etc, as well as scalene triangle computation (which allows us to convert actual 3d models to html elements - [https://pantelis.s3-us- west-2.amazonaws.com/0/css3d/readme/t...](https://pantelis.s3-us- west-2.amazonaws.com/0/css3d/readme/triangles/css-render.png))

\-----

If this interests you, I am giving a presentation on how it is built and lessons learnt this coming Wednesday (2nd of September) at CascadiaJS 2020 ( [https://2020.cascadiajs.com/](https://2020.cascadiajs.com/) ), among a line up of awesome speakers!

<comment><USER3> Great game sir!! However i am not able to complete the first level itself I ate the food but still not able to lift the sewer in dark as it shows i am weak

<comment><AUTHOR> maybe there is one more item you can pick up :)

<comment><USER4> or burn

</comment></comment></comment></comment><comment><USER5> Thanks a lot for sharing! Very interesting experiment.

That said, please please, no "WASD". This is very uncomfortable on non-QWERTY keyboard layouts.

There are two solutions to this.

# Best solution

Game programmer always mean "the group of physically-positioned keys that happen to be labelled WASD on the _programmer 's_ keyboard", not "whatever keys that are _actually_ labelled WASD on the _player 's_ keyboard".

So, wherever possible, use an API that refers to key _position_ , not key _symbol_. This is possible in most programming environments, e.g. in Javascript using [https://developer.mozilla.org/en- US/docs/Web/API/KeyboardEve...](https://developer.mozilla.org/en- US/docs/Web/API/KeyboardEvent/code)

# Alternative solution

Alternatively, use keys that are stable across most common Latin keyboards layout, which means _no_ AMQWYZ.

ESDF is fine, as are RDFG, TFGH, or the traditional IJKL (see [https://en.wikipedia.org/wiki/Arrow_keys](https://en.wikipedia.org/wiki/Arrow_keys) for more).

If you want to be kind to Dvorak, Bepo, Colemak and other users, prefer the first solution!

[https://en.wikipedia.org/wiki/Keyboard_layout#QWERTY- based_L...](https://en.wikipedia.org/wiki/Keyboard_layout#QWERTY-based_Latin- script_keyboard_layouts)

<comment><USER6> Given that WASD is a standard in gaming I'm surprised by this approach. Do many games / game engines use key position? Isn't it easier to just add key remapping so outliers can configure freely?

<comment><USER7> Yes, just allowing the keys to be remapped is simpler and would serve all users with non-standard setups, not just the handful that use alternative keyboard layouts.

<comment><USER8> I'm surprised most Dvorakers don't already tend to have a utility installed to let them remap temporarily or for an application. This must be a common occurrence?

</comment></comment></comment></comment><comment><USER9> Really interesting! But why is the scene so dark? Gave up sooner than I'd like because had to squint really hard on the phone screen.

<comment><USER10> Pretty sure that is on purpose for the theme of the game.

I would probably give up if the game had OSHA approved flood lightning in a medieval dungeon prison cell.

</comment></comment><comment><USER11> Very awesome. In 1989 a game like that would have been an AAA title (well if given the resources to make it 40+ hours) And it brings back memories of so many games I played when I was 10-15. Wow nice job.

</comment><comment><USER12> Super impressive! I'd love to see a write up on how it was done. Do you think this is more performant that webgl?

<comment><AUTHOR> Performance for simple things is adequate, but relying on 2-point rectangles (origin(x,y), dimensions(width,height)) for geometry is extremely cumbersome. Also everything is hack piled on top of hack (for example there is no concept of a camera, the whole world moves around you instead to simulate the camera effect!).

So... webgl is still the way! This is meant to be an experiment to show what css/html is capable of!

<comment><USER13> > for example there is no concept of a camera, the whole world moves around > you instead to simulate the camera effect

Wait until you learn what a camera is :)

</comment></comment></comment><comment><USER14> Great demo! This was super inspiring. I haven't touched game dev stuff in a couple of years (after a bit of a Unity rabbit hole before that). Just might have to get back into tinkering after playing through this...

</comment><comment><USER15> One possible bug... playing in Firefox and I went F11 / full screen. Reached the end of the game I was locked out of all F keys in Firefox and thus couldn't restore my screen. Ended up having to kill the Firefox task. Possibly something in how you're capturing keystrokes? Not sure.

Overall great job! Agree with the comments about it being a little dark.. am on a laptop in daylight and it was hard to see with everyting maxed. Looking forward to more.

<comment><USER16> I was having trouble with keys mid-game, full-screened, and I couldn't exit either. But I was able to hit CTRL-W to close the tab, then I could F11 back to sanity.

</comment></comment><comment><USER17> Damn I didn't manage to hack it and make that game box on the full screen

I think it'd be way better user experience if this window wasn't that small

is the size performance related?

<comment><AUTHOR> it should be possible - you can check how it is rendered on mobile portrait and landscape modes (which is basically fullscreen). However, more intricate sizing might be hard to achieve since I 'm using pixel values so some things will probably look terrible in higher res. (this isn't the same as upscaling res let's say in canvas or webgl - it would be more like viewing an old website in a newer bigger monitor! But in theory it can be improved :) )

</comment></comment><comment><USER18> Awesome, I really like that it works on mobile, the controls are cool. Well almost the text flows out of the screen. I'm using Firefox mobile.

<comment><USER19> I can look around on mobile but I didn't figure out how to move. I tried tapping and double tapping everything but nothing happened. Only some "object is out of reach".

<comment><AUTHOR> You can move by swiping your finger within the purple-like circle at the right part of the screen. That circle simulates a joystick for character movement. And you can look around by swiping anywhere else on the screen!

</comment></comment></comment><comment><USER20> Has anyone tested with different browsers? Would love to see if there are differences between rendering this in Chrome/FF/Safari, etc.

<comment><USER21> First room has serious rendering issues on Firefox (Fedora Linux) with walls disappearing and some geometry becoming lines going to some point in infinity. Otherwise atmosphere and quality looks great, especially for a tech demo.

<comment><AUTHOR> Oooh, I think I know why. First room uses img tags for the walls. Image tags (and canvas tags) do not play well in 3D contexts. For example they ignore depth sorting and rely on z-index. So you cannot properly depth sort them. Now you might wonder why I picked img tags for lvl1, and then divs for lvl2. Profiling showed reduced mem usage for img tags and I thought I 'd take advantage of that optimization. (premature optimization and all that I guess!)

<comment><USER21> Interesting observation. Would it be very complicated to add an option to select img or div based rendering?

<comment><AUTHOR> Here - [https://pantel.is/projects/css3d/indexdiv.html](https://pantel.is/projects/css3d/indexdiv.html) (no option, but I force set the first level to use div tags instead of img. Curious if this fixes the FF linux issue!)

<comment><USER22> That way the issue with seeing through the walls is solved, but the bone for getting access to severs is not visible in inventory.

</comment></comment></comment></comment></comment></comment><comment><USER23> Awesome! Played it on my desktop and didn't have any issues with it being too dark as others have suggested. Keep up the good work.

</comment><comment><USER24> Very cool and just a suggestion ... have the keys that move the character ..overlay the game window at the bottom right of it (make it transparent and or give the user to the option to turn it off). I quickly saw them before playing, but forget what each does.

</comment><comment><USER25> Interesting, tried it on my 1980x1080 monitor and I had to scroll down to read the text. It doesn't seem to adapt very well to non-square browser sizes.

Also when viewing videos (such as the candle) I get a picture-in-picture icon.

Quiet enjoyed the game though.

<comment><USER26> It's not a resolution/aspect ratio issue it's a viewport vertical size issue. Anything with less than 768 absolute CSS pixels (not display pixels) will not fit the content. This includes 1080p at 150% DPI/zoom.

</comment></comment><comment><USER22> This is cool! Thank you for making this.

The game gets stuck on Firefox, Linux, at the scene "Suddenly, a devilish creature appears...". Nothing appears, and I can no longer look around, just walk.

<comment><USER27> Works for me on Linux with Firefox 70.

</comment></comment><comment><USER28> Reminds me of this: [http://cs-online.club](http://cs-online.club) Play counterstrike 1.6 in your browser

</comment><comment><USER29> Man, this is really promising and bring back the 80s memories, btw, do you think this will be the future of browser game? How about webGL? Or web assembly?

</comment><comment><USER30> Great work, very impressive and creative project.

</comment><comment><USER31> I bet JavaScript was thrown in the mix, can't quite see how this was made without it, I just might be wrong though.

<comment><AUTHOR> Yup, vanilla JS. Only the rendering is html/css. State, navigation etc, is all js.

<comment><USER32> Well, not just Vanilla, looks like three.js is in there too. That's a pretty extensive framework.

<comment><AUTHOR> Nope, threejs is used for a very specific thing at the end of the second level. There is actually nothing 3D-related webgl in it (except for a surprise at the end)

<comment><USER21> Couldn't figure out, how you did that in CSS. Now I know that a little bit of cheating was involved ;)

<comment><AUTHOR> hehehe, [https://pantelis.s3-us- west-2.amazonaws.com/0/css3d/readme/b...](https://pantelis.s3-us- west-2.amazonaws.com/0/css3d/readme/billboarding.png)

It's billboarding! (and the css lightsources are duplicated in the webgl world, so that the worm is properly shaded)

</comment></comment></comment></comment></comment></comment><comment><USER33> Amazing. Worked well on mobile, except the text went out of the screen a few time.

</comment><comment><USER34> Very impressive, great work! Got to the current end, looking forward to more :-D

</comment><comment><USER35> Good work, but I guess I'm too old-school: Mouse look and WASD give me fits.

</comment><comment><USER36> Got the torch in the hole!

Holding the mouse button to look around is awkward, but it was fun!

</comment><comment><USER37> Nice job, but a bit short, I started to be interested into the adventure :)

</comment><comment><USER38> I seem to have fallen through the floor. Refreshing doesn't fix.

<comment><USER38> Disabling Vimium plugin seems to have fixed it, but it was weird in that I had already told the plugin to ignore all keys for the domain. Only fully disabling the plugin worked. And it's weird that it caused me to fall through the floor...

</comment></comment><comment><USER39> Ultima Underworld vibe

<comment><USER11> Yes that's what immediately came to mind - 40 year old's represent!

</comment></comment><comment><USER40> Kind of reminded me of Elder Scrolls 1 : Arena.

</comment><comment><USER41> nice! played until the ending so far.

</comment><comment><USER42> How do you get out of the dungeon?

<comment><USER34> Here is a rot13 'walkthrough" of what I did to get to the the 'credits' message (decode per-line if you don't want to reveal subsequent steps)

rkgvathvfu pnaqyr

rng sbbq

trg obar

hfr obar ba frjre tengr

tb vagb frjre

Cneg 2

fgnl fgvyy gjvpr ng yrrpu

teno gbepu ba tebhaq

hfr gbepu gb trg guvatl sebz fxryyrgba

hfr gbepu ba qbbe

</comment></comment><comment><USER43> Looks quite buggy, depending how I move I can see through walls, get bad textures etc.

<comment><AUTHOR> Oh... if you are referring to the second level (sewers) that's actually on purpose, i have set max draw distance (geometry culling) to improve performance on mobile. It is configurable.

<comment><USER43> No, just in the first level. I'm running on Firefox on Linux.

By coincidence I read up on WebRender on Firefox today and decided to force it turned on - suddenly the game looks nice (only glitch when looking down below the candle one of the wall segments still vanishes).

But it runs a lot better with WebRender (which uses the Graphics card to composite) than without on my machine.

</comment></comment></comment><comment><USER44> ITT: a super positive and open OP :-)

<comment><USER44> People seem to think I was being sarcastic. I was not.

</comment></comment><comment><USER45> The typing speed is driving me nuts.

I'd enjoy it a whole lot more if the descriptive text simply appeared and didn't halt the gameplay.

<comment><AUTHOR> you can click on the textbox, and it will immediately fill the whole sentence and move on to the next one! Might be frustrating to click so much, but I wanted to recreate old timey videogame pacing

<comment><USER45> I played loads of old dungeon crawlers; I still have Dungeon Hack, Lands of Lore et al installed and in my regular play list. Still feels like your demo interrupts too often.</comment></comment></comment>


Is everything we eat associated with cancer? A systematic cookbook review - <AUTHOR> https://academic.oup.com/ajcn/article/97/1/127/4576988 <comment><USER2> See also _Kill or Cure_ , a comprehensive index of every Daily Mail article claiming that something causes or prevents cancer.

[https://kill-or-cure.herokuapp.com/](https://kill-or-cure.herokuapp.com/)

<comment><USER3> Looks like it does subject/verb plurality agreement based on the presence of an 's' at the end of the subject. Thus: "Asbestos prevent cancer". Heh. Software.

<comment><USER4> I looked at the site again to see that it actually says "asbestos _cause_ cancer", because I was really curious how it could ever prevent cancer...

No mention of Cheetos or Doritos though.

</comment></comment></comment><comment><USER5> Wow, that was quite a read. What does seem to stand out is the danger of negative results not being published. 99 studies look at an ingredient, find nothing, don't publish. Through pure chance, the hundredth study finds a correlation, and everyone is immediately convinced that yet another ingredient is unhealthy.

<comment><USER6> The study will fail to replicate.

<comment><USER7> Doesn't matter; before anyone even thinks of replicating it, it's already all over the fitness & lifestyle magazines and news columns regular people read.

</comment></comment></comment><comment> open-source-ux Cancer Research UK (a medical charity) has a good summary of some common food controversies - foods that are claimed to either cause or curtail cancer.

The entry on 'super foods' states:

> "...the term 'superfood' is really just a marketing tool, with little > scientific basis. It's certainly true that a healthy, balanced and varied > diet can help to reduce the risk of cancer but it is unlikely that any > single food will make a major difference on its own."

[https://www.cancerresearchuk.org/about-cancer/causes-of- canc...](https://www.cancerresearchuk.org/about-cancer/causes-of-cancer/diet- and-cancer/food-controversies)

Also worth a read:

 _Bacon, salami and sausages: how does processed meat cause cancer and how much matters?_ (April 2019)

[https://scienceblog.cancerresearchuk.org/2019/04/26/bacon- sa...](https://scienceblog.cancerresearchuk.org/2019/04/26/bacon-salami-and- sausages-how-does-processed-meat-cause-cancer-and-how-much-matters/)

</comment><comment><USER8> You can basically dump all mouse studies, since the standard kibble was something high sugary/starchy. Add fat -> cancer; add more sugar -> cancer...; add more protein -> cancer Epidemiological stuff is flawed as well. Unless the people are kept in a closed ward and every meal is kept under close observation, it's probably not "clean" data.

There is hope though... annecdotal evidence seems to point towards unprocessed food as a good tool to fight cancer. Even better when it's low carb.

[http://www.diagnosisdiet.com/meat-and- cancer/](http://www.diagnosisdiet.com/meat-and-cancer/) source for the mouse model studies

[http://meatheals.com/category/cancer/](http://meatheals.com/category/cancer/) anecdotal evidence, you'll prolly find some vegans as well if you go looking.

[https://www.youtube.com/watch?v=1tteYZfMat4](https://www.youtube.com/watch?v=1tteYZfMat4) some interesting talk about the efficiency of treatment in some cancers. Might help to make a better informed decision if it ever hits you.

<comment><AUTHOR> I'm surprised to see your comment in good health. Everytime I link to Georgia Ede or meatheals I get downvoted to oblivion lol, just as this comment too will (as if there is a vegan bot on HN targeting my comments?).

<comment><USER8> don't go down the path of conspiracy theory xD that's unhealthy, but I don't care much about upvotes here

<comment><AUTHOR> Ask the mods. They have flagged my account so that new comments in some threads begin with 0 points.

Agree on the upvotes thing; it is a health sign of skepticism.

<comment><USER9> HN software has no such flagging mechanism.

</comment></comment></comment></comment></comment><comment><USER10> I think we as humans are just associated with cancer. Regardless of what we eat.

My soul mate exercised, ate well and natural but still got breast cancer. Because it was in her family. Cancer hits so many people that it seems like it's just a natural way of population control to me.

Or perhaps a side effect from being multi-celled creatures in a universe with background radiation.

<comment><USER11> Sorry to hear about your partner :-( The first part of the last paragraph makes sense. Multi-cellular -> more cells dividing -> more chances of mutations -> more chances of cancer. The second half of your last para implies that cosmic radiation / something similar causes cancer. I'm genuinely curious : is there some link between cosmic microwave radiation and cancer ? Any sources ?

<comment><USER12> There's no known link between cosmic microwave background and cancer. Would do for one hell of a difficult thing to study, too.

There's perfectly ample evidence for cosmic rays (ie. high energy radiation from astronomical sources) increasing risk of cancer as does any ionizing radiation. Maybe GP conflated the two?

</comment></comment></comment><comment><USER13> Everything we do on a daily bases has a chance to increase or decrease the chances of each part of our body of getting it. Even if you do nothing

</comment><comment><USER14> This is the inevitable result of clueless reporting on bad epidemiological studies.

Look at any study behind one of these headlines and there will be a raft of confounding factors that were never controlled for. The data is close to meaningless at a certain point.

</comment><comment><USER15> A subtle way to suggest fasting ?

<comment><USER16> If you stop eating for a few weeks it probably does lower your chances of getting cancer significantly.

<comment><USER15> that's what I meant, since it seems all types of food are linked to cancer, fasting is the best of them

<comment><USER17> I remember reading a few studies where malnourished individuals and with certain nutritional deficiencies had lower cancer incidence. There could be some truth to it. Time to dig into PubMed.

</comment></comment></comment></comment><comment><USER18> I heard coffee is still good

<comment><USER19> Tell that to the state of California

</comment></comment><comment><USER20> From the abstract:

"Statistically significant results were more likely than nonsignificant findings to be published in the study abstract than in only the full text (P < 0.0001)."

</comment><comment><USER21> It's probabilistic, the best you can do is minimize your chances but _everything_ causes harm to some degree until you're dead.

</comment><comment><USER22> If you live long enough you will eventually die of cancer. It's inevitable.

<comment><USER23> Do the oldest people predominantly die of cancer?

<comment><USER24> The parent's comment is tautologically true: if nothing kills you first, cancer will eventually kill you.

<comment><USER25> That is, given that humans eventually die.

</comment></comment></comment></comment><comment><USER26> At this point I almost expect an article titled "All oxygen-breathing organisms are a fatally flawed design and are doomed to never live healthy no matter what".

:(

<comment><USER27> [https://lowres.cartooncollections.com/doctors-medical- parano...](https://lowres.cartooncollections.com/doctors-medical-paranoia- hypochondria-hypochondriacs-medical-CC41339_low.jpg)

The SENS people say, if you live long enough, you will eventually have cancer.

<comment><USER28> I was under the impression that everyone has cancer all the time at about the same rate the body can fight it before it becomes an actual, detectable problem.

<comment><USER29> Yup. So shoukd we should worry about our ability to fight it, rather than what 'causes' it, outside agressive carcenogens?

</comment></comment></comment></comment><comment><USER30> There are scientists who argue that what the mitochondria does is fundamentally cancerigenic on a long enough timeline, so in a sense, yes, everything we eat is associated with cancer.

[https://www.nature.com/articles/cr2017155](https://www.nature.com/articles/cr2017155)

<comment><USER31> Metabolism is a process with chemical and energetic exhaust that can damage machinery critical to cellular processes. And at some point it becomes evolutionarily favorable to just accept that damage and expend effort starting over again (offspring) as opposed to attempting complete repair of all the damaged systems.

In that way, all metabolic processes will logically lead to cancer (damage to dna). The world is on fire.

<comment><USER32> Seems that nature favors the 'big rewrite'

</comment></comment></comment><comment><AUTHOR> Related - meat & cancer: [https://news.ycombinator.com/item?id=20029519](https://news.ycombinator.com/item?id=20029519)

(Ctrl+F "cancer" in that thread for amusement)</comment>


Ask HN: Advice on when it is acceptable to simply "hack something together"? - <AUTHOR>

Firstly apologies for the possibly open ended question.  Like, I assume, most people who will read this I have a ton of ideas and experiments I want to undertake.  The problem is of course that between my day job and my family there isn't a great deal of time.  So obviously I prioritise and tackle things when I can.  When I start a new project I start doing it with quality and "doing it right" foremost in my mind which leads to the next problem. With limited time I find it incresingly difficult to maintain momentum when I hit a "boring" spot (usually writing some authentication module - but that is oly one example).  I am then suddenly drawn to the next shiny idea and the current one ends up in the great pile of TODOs that only ever grows.<p>So my question is - are there any recommended books, articles or techniques that outline how to stay focused and push on through or know when to cut your losses or more importantly deciding when it is best just to ditch "the right approach" and just hack something out? <comment><USER2> Do you want to do this for fun or business? If purely for fun, then I don't see any major flaws in your current approach. Sure, you end up with unfinished projects but you're hopefully learning tons and having a blast.

But if you're thinking about structuring things so you can better go from ideas to businesses, you need to reevaluate your entire approach. You need tools that can practically guide you through the stages of creating a software business, not just a general philosophy of getting things done.

Currently in the startup world, there's an interesting convergence between customer development and lean as applied to tech startups. Customer development is described in Steven Blank's "The Four Steps to the Epiphany" and Eric Ries' "The lean startup" is the book on lean startups. Both Blank and Ries have contributed to this convergence that I talk about at their respective sites [1] [2] but there's also overviews available [3] [4]. But why am I even recommending these two approaches? Because they cover business development from start to finish from as applied to software startups, so you know the advice is specific to our industry and very practical in nature. If you're serious about the business of software, customer development and lean startup will help you create a business with better certainty of execution and outcome. Together they provide a very potent combination of roadmap and compass, and principles and philosophy.

[1] <http://steveblank.com/>

[2] <http://www.startuplessonslearned.com/>

[3] [http://www.recessmobile.com/blog/my-take-on-customer- develop...](http://www.recessmobile.com/blog/my-take-on-customer-development- and-the-lean-startup/)

[4] [http://danielmckenzie.com/blog/2010/07/design-thinking- custo...](http://danielmckenzie.com/blog/2010/07/design-thinking-customer- development-and-lean-startup/)

<comment><AUTHOR> Interesting. Your answer has really made me think. I guess my problem is the feeling of never really finishing anything (to a satisfying level anyway). I suppose its not a big issue as everything is just for fun and not for business.</comment></comment>


William Gibson on Punk Rock, Internet Memes, and "Gangnam Style" - <AUTHOR> http://www.wired.com/underwire/2012/09/william-gibson-part-3-punk-memes/

<comment><USER3> I'd just like to posit that, in the UK at least, rave and the beginnings of drum and bass were the last pre-digital youth/music based counter culture. Not that I'm trying to call him out as wrong, I wouldn't expect Gibson to be a massive rave aficionado.

I think this article also shows up something about youTube I've noticed within my social group. It's half a decade old and yet it's become pervasive and it feels almost like it's always been there. Friends have said that like me they feel like they've been using it since about the turn of the century.

<comment><USER4> In Australia where in many ways it felt like we were second-hand consumers of UK rave/dnb culture, the "digital" was a big part of that experience in the early 90s.

Think of all the newsgroups, mailing lists and blogs. Think hyperreal.org and the community around all that.

The music itself may not have spread digitally as we saw from the mid-90s onwards, but discussion of the music certainly did.

<comment><USER5> Hyperreal was an integral part of a lot of the local scenes in North America, too. Ishkur, who is something of an Internet rave culture celebrity, known for his guide to electronic music, guide to rave culture, and his rave captions project, once posted an essay to the nw-raves mailing list arguing that rave culture was inherently a geek culture. Which was arguably true for the PNW and northern California.

<comment><USER6> You guys might like my friends, DJ Morgan's, site for some nostalgic and fantastic mixes.

He owned Lotek Records as well.

Http://djmorgan.com

</comment></comment></comment></comment><comment><USER7> I didn't grow up during the Punk movement but the commercial "revival" of sorts kicked off by Green Day in the mid-90s. Green Day was on a indie label, Lookout! Records, before hitting it big with "Dookie." When you bought their first two CDs/cassettes a small catalog of Lookout! Records' other albums fell out with a listing of bands I'd never heard of before. None of these bands had websites so information was really limited. You'd have to buy fanzines or know other people in your town that listened to those bands. If you were lucky maybe one of those bands came to your town and you got to see what they looked and talked like for the first time. I can't even imagine what it was like to see Black Flag touring every town in America in the early 80s introducing thousands of kids to a new subculture and form of music.

My point is, maybe I'm jaded now but music was so much more interesting then when there was mystery and not everyone had an opinion about a band before their first mp3 came out. I think the disposable quality of mp3s makes music less valuable too.

The internet also killed regionalism in music for the most part where a certain "scene" would have a certain sound as bands around an area being influenced by each other. See [1]. I'm not sure what could have been done, it's a natural by-product of the internet, but I miss it.

[1] [http://www.washingtoncitypaper.com/articles/43235/our- band-c...](http://www.washingtoncitypaper.com/articles/43235/our-band-could- be-your-band-how-the-brooklynization-of/)

<comment><USER8> I did come of age during the Punk movement, and I sympathize with your perception of what has been lost (see <https://news.ycombinator.com/item?id=4529054> below). The benefits of a somewhat slow and poorly distributed dispersal of culture are largely gone. The real question, as I see it, is what unpredictable cultural effects will the technology generate.

</comment></comment><comment><USER9> I think the following (quote from the article) is a very good observation:

 _"I suspect — and I don't think this is nostalgia — but it may have been able to become kind of a richer sauce, initially. It wasn't able to instantly go from London to Toronto at the speed of light. Somebody had to carry it back to Toronto or wherever, in their backpack and show it, physically show it to another human. Which is what happened. And compared to the way that news of something new spreads today, it was totally stone age. Totally stone age! There's something remarkable about it that's probably not going to be that evident to people looking at it in the future. That the 1977 experience was qualitatively different, in a way, than the 2007 experience, say._

<comment><USER10> On Amazon now, I have learnt not to buy a Kindle book that doesn't also come on paper, because that is the quality filter, than the author managed to get a publishing deal. I don't think that signal will be around for much longer. It's the same thing as Gibson says, a thing had to have a certain momentum behind it to make it into the outside world, that is missing now.

</comment></comment><comment><USER11> " _The recorded music industry was a huge deal for those of us who lived through it, and we took it absolutely for granted, and now it's really gone; it's not what it used to be. You can't really get super rich just doing that; you have to be able to sell merch or something to go along with it, or have concert tours._ "

Is it optimal or sustainable that a band needs to sell t-shirts and concert tickets to support themselves as musicians, let alone be super rich? The recordings and the concert tickets are the only product offered by bands that we place value in; t-shirts hold some slight social value, but little personal value. Revenues from concert tickets go mostly to the venue operator, especially for smaller venues of 100-200 people that most bands play in, and the amount going to the band is hopefully enough to pay for the cost of touring, and probably not much more than that.

So that pretty much leaves recordings as the only valuable product that bands can hope to sustain themselves with. Merch and tour ticket sales are not going to cut it for most artists, so without sales of recordings in some form, they're going to need to work a regular job, and the music is relegated to a hobby.

Making good recordings costs a lot of money and takes a lot of time in a recording studio, so hobby bands have difficulty producing them. Recordings are valuable to us because they allow us to integrate music into our lives. How can we expect musicians to invest the time and resources to make good recordings for us to enjoy if we don't recognize their value by directly rewarding the artist for making them? Buying a t-shirt does not send the message to the artist that we value their recording; only buying recordings does that.

<comment><USER12> > Making good recordings costs a lot of money

Even now?

My impression was that anyone with even a modest amount of technical savvy could put together a recording incredibly cheaply using a computer these days. Decent software, audio interfaces, and microphones aren't that expensive, and you can tweak the production and lay in new tracks to your heart's content.

It still takes a ton of time to get right, but it doesn't have to be expensive studio time anymore.

<comment><USER11> It's true that the costs for equipment and software are going down, and in some cases, such as electronic music, it's possible to get good recordings with very cheap and accessible equipment. If you've got a band with drums and other acoustic instruments, however, that means isolation rooms, sound- proofing, and other measures needed to get good recordings, not to mention the software and skills needed to mix them; these are still relatively inaccessible and costly.

My point is that regardless of the cost, if we don't reward artists for making recordings, despite their great value to us, why should they bother with the effort to make them?

<comment><USER13> You might need all that for _good_ quality, but you can get an _acceptable_ recording cheaply. (Minimum viable recording quality?)

That wasn't something trivial to do in ages past.

<comment><USER11> I guess the question would then be how many of us are content to be listening to minimally viable recordings while the artists are largely unrewarded for their efforts. I'd rather demonstrate my support for their efforts in the hopes of getting _good_ recordings.

</comment></comment></comment></comment></comment><comment><USER14> The internet has led to an arms race of exclusivity, giving rise to such phenomena as hipsterism, un-google-able band names, private (offline mediated) online communities, etc. These are merely the growing pains of a culture which has not yet acclimated itself to total, ubiquitous access to information.

<comment><USER8> While I generally agree with your assessment, I suspect the phenomena of hipsterism emerged as soon as the development of agriculture allowed the rise of specialization. As an old man, seeing the kids these days unabashedly dressing like the Small Faces brings to mind Paul Valéry's old saw: "Everything changes but the avant-garde."

While I am not personally all that nostalgic about the passing of the cultural distribution channels that Gibson mentions in the OP's link, I wonder how the reduction of meatspace contact in cultural transmission will play out. Many of my long standing friendships were formed in prehistoric book and record stores. As a kid today, I might meet those people, even more of them, no doubt... but would the tight bonds that sustained those relationships over the years have formed in the absence of non-virtual presence?

I guess this problem, if it even is a problem (and not the distortion of my limited perspective), will sort itself. It could be that increasing arrays of relatively weak social bonds in conjunction with smaller sets of strong bonds are what the social meta-organism requires moving forward.

</comment></comment><comment><USER15> Imho a "punk" style, anti-authority counter culture has emerged. It's called anonymous and just like punk it's a reaction to the excesses of the "establishment". Only unlike punk, instead of demonstrating membership via your hair, music and clothes, this one uses the shiboleth of computer literacy and meme awareness as the group identifiers.

And unlike punk's self destructive near impotence to do anything but rage. The modern movement actually has some tools to fight back with.

<comment><USER8> Tools more effective than bodily fluids. ;)

</comment></comment><comment><USER16> Clearly a modern punk-esque counterculture would have to make radical anti- internet privacy a, or the, central tenet. The whole point would be to construct a totally invisible subdigital culture. What else would define membership is anyone's guess. (also, such a subculture, or multiple, may already exist, as by its nature we wouldn't know anything about it.)

</comment><comment><USER17> Communities still are human-powered. The only difference is now keeping people informed is easier, so building the community is easier, but it's still largely offline.

Couchsurfing, autocross, bdsm, ska, anime, hiking, slacklining... all communities i've become involved in with human beings at real places because the internet made it easier to find out. I still needed a human to show me it. But then the community was opened up to me much quicker through the 'net.

The next counterculture, to me, was 4Chan's /b/ and Anonymous. As stupid as it sounds, those retards brought a new kind of rebellion to people's lives - <USER2> if it was largely online. But it's not the method the message gets out that matters. It's the culture that develops. I think it's clear that the internet isn't holding anyone back.</comment>


Segway Made from Lego Robot Kit Using Light Sensor For Balance - <AUTHOR> http://singularityhub.com/2010/02/23/segway-made-from-lego-robot-kit-works-without-a-gyro-video/

<comment><USER2> I built a copy of the legway [0] 10+ years ago with the original Mindstorms kit. It was pretty darn cool and behaved a whole lot better (no drift) than this one. I even modified it to read a remote control so I could control its forward/backward/turning movements.

[0] <http://www.teamhassenplug.org/robots/legway/>

</comment><comment><USER3> Looks like he needs to work on his drift a little, but otherwise this is really dinky. By which I mean neat. By which I mean I'm off to buy some Lego.

<comment><USER4> The drift, I think, is because he did not start the bot perfectly balanced. It has no gyroscope, so it's not correcting towards up, it's correcting to the initial light level when the program boots.

</comment></comment><comment><USER5> Not really a segway; not even close. Just a feedback control loop in a cute demonstration model.

<comment><USER6> That's right! You can't even ride it!! And just you try playing segway polo on it!!!! Useless!!!!!! ;)

<comment><USER5> Let me clarify: Segway innovated thru dynamic control systems that kept it stable through a wide range of speed, attitude and control inputs. To label something a "Segway" and then find out its just a simple feedback control loop is something like bait-and-switch. I felt the article title over-sold the actual article. Kind of like those highway signs that claim "biggest ball of string in Minnesota". I felt cheated when I saw it.</comment></comment></comment>


Das Keyboard Kickstarter for Cloud-Connected Keyboard - <AUTHOR> https://www.kickstarter.com/projects/1229573443/das-keyboard-5q-the-cloud-connected-keyboard <comment><USER2> Not even a single mention about security or privacy on their Kickstarter page told me what I wanted to know about a cloud-connected _keyboard_.

Also found it quite cynical to offer a blinking disco as a device to improve your focus. No thanks. But looking at how much was already raised, I can only guess a lot of people like LED's a LOT.

</comment><comment><USER3> cloud-connected? what could possibly go wrong? [other than (((skynet)))]</comment>