Voting is a Sham Mathematically Speaking - <AUTHOR> http://haacked.com/archive/2012/11/27/condorcet-paradox.aspx?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+haacked+%28you%27ve+been+HAACKED%29 <comment><USER2> This is off. Voting is not a system for selecting the best candidate. Voting, in whatever forms it exists, is a system to avoid violence and conflict.

Each side feels it had a fair shot, regardless of outcome. The purpose of voting is to leave you with that feeling, to avoid unpleasant behavior from the losing party. The best person for the job almost never gets it. That's why we don't vote people in when hiring somebody at a company.

<comment><USER3> Yes, and in addition it's also a system to ensure that elected officials and their parties have accountability. If you win an election and then "betray" your voters, you won't be reelected. If you can't be reelected, you could damage the chances of your party. In essence, democracy in its current form is not so much about choosing the right/best candidate. It's more about making sure the winner cannot become a despot.

<comment><USER4> _"If you win an election and then "betray" your voters, you won't be reelected."_

That ain't accountability, that's a joke. If you pay me 5000$ to do a job, and I don't lift a finger, and your "punishment" is that we won't do that a second time, then I have free money and you're a fool. It doesn't hurt the party one bit either; that's the whole point of corporatism, you can swap out individuals while the "brand" rolls on, saying "whoops, bad apple" every 5 seconds, with people forgetting after 2.

 _"It's more about making sure the winner cannot become a despot."_

Correction: it replaces a single despotic individual with a tag team of people who basically can do whatever they want - within boundaries, sure, they at least have to be somewhat slick about it, and know how to make a puppy face, too; but certainly not within boundaries defined by the actual will of the people who handed their power as souvereigns over to their representatives. Having despotic entities control you is not one iota better than despotic humans, not in the long run.

Despotism is marked by the control going only down, accountability going only up -- period. Not by angry men on podiums necessarily, and not by bloodshed. (Not that there isn't plenty bloodshed, but that's besides the point) If you seriously see a huge difference or improvement there, you've fallen for it I'm afraid.

<comment><USER2> You know, it's pretty easy to poke holes in something. It's another thing entirely to come up with something better.

There hasn't been a single political system that hasn't been corrupted.

<comment><USER4> _"You know, it's pretty easy to poke holes in something. It's another thing entirely to come up with something better."_

I have no problems with coming up with something better. More like 3 a day before breakfast; I'd just have problems making people actually go along with whatever I would come up with. But you know what? If people are so fucked that even I can't magically solve it, that doesn't mean I can't say they're fucked. It just means they're gonna pout and roll their eyes, none of which is news or unexpected.

 _"There hasn't been a single political system that hasn't been corrupted."_

What's your point? That therefore criticism isn't allowed? That naive believe in cynical manipulation is not an issue?

Also, was I talking about a "system"? No, I was talking about specific circumstances, an actual situation, and individuals and their responsibilitie.

But of course, it's easier to just throw some mud into a completely different direction, not hitting anything, and then deluding oneself into having dealt with the issue just nicely, than to actually address any of it.

<comment><USER2> > I have no problems with coming up with something better. More like 3 a day > before breakfast; I'd just have problems making people actually go along > with whatever I would come up with.

Perhaps because you don't actually share your "something better"?

Two posts in, lots of words, still no alternatives.

</comment></comment></comment></comment></comment></comment><comment><USER5> Approval Voting mostly solves the "strategic voting" part that almost forces you to choose the "most likely to win" candidate, or if you hate that one, the one closest to him, while eliminating the spoiler effect, and giving 3rd party candidates a much higher chance of winning than with current traditional voting systems.

<http://www.electology.org/approval-voting>

<http://en.wikipedia.org/wiki/Approval_voting>

<comment><USER6> Plus it doesn't run into trouble with Arrow's theorem, since it's not a "rank- order voting system," unlike plurality, instant runoff, and various others.

Range voting has the same advantage. In computer simulations measuring how well the election result matches voter preferences, either range or approval is as much an improvement over plurality as plurality is over picking someone at random (or, if you like, monarchy). <http://rangevoting.org/BayRegsFig.html>

<comment><USER7> I'm not sure about the definitions, but if the Arrow theorem doesn't apply to the Approval Voting sistem them I think that it must not be applicable to the "majority rules" criterion.

In this two system the idea is that you get very little information from the voters (best candidate / a set of candidates) and don't know all the information about the order of preference and the relative strength. So I don't understand why having less information is better (theoreticaly).

<comment><USER8> > I don't understand why having less information is better (theoreticaly).

A ranked-choice ballot only encodes the orders the candidates against one another, whereas approval and score votes also encode the candidates' positions within the voter's range of subjective preferences. That is, if we have 3 candidates (A, B, C) and a few voters which each voters has a range from love to hate for each candidate, like so:

      Love                       Hate
       |-A--B</comment></comment></comment></comment><comment></comment><comment></comment><comment>-C-|
       |-A</comment><comment></comment><comment>-B-----C----|
       |</comment><comment></comment><comment></comment><comment>-A-B-C--|
       |-A-B---C</comment><comment></comment><comment></comment><comment>|

Under ranked choice voting, every one of these voters' ballots would look the same:

       1)A, 2)B, 3)C

Ranked choice voting encodes the ordering of the preferences, but the intensity of those preferences is lost when the ballot is cast. Whereas under approval and score voting, every one of these voters represents their preferences differently, because they're reflecting their personal response to each candidate:

         Approval | Disapproval
       |-A--B-----|</comment><comment></comment><comment>-C-|
       |-A</comment><comment>--|----B-----C----|
       |</comment><comment>----|</comment><comment>--A-B-C--|
       |-A-B---C--|</comment><comment></comment><comment>---|

Of course, some information is lost in the fact that we only have 2 values approval/disapproval to encode positional preferences. But I would argue this information is already more meaningful than a fully-expressed ranked ballot. And if necessary, score voting can capture more of that information by offering > 2 levels to divide the candidates into.

<comment><USER7> OK, this method recollect some information that the ranked choice voting ignores. But I still don't understand why the Arrow's theorem doesn't apply.

If in a hypothetic population everyone loves/hates each candidate equally spaced, then in that population it is possible to apply the Arrow's theorem and prove that for that population this method doesn't work. But the method should be useful for every population, even the pathological ones.

</comment></comment><comment><USER9> I found this article quite frustrating.

>Condorcet formalized the idea that group preferences are also non-transitive. If people prefer Hanselman to me. And they prefer me to Guthrie. It does not necessarily mean they will prefer Hanselman to Guthrie. It could be that Guthrie would pull a surprise upset when faced head to head with Hanselman.

I found this by far the most interesting assertion, but the examples under "Historical Examples" don't demonstrate this phenomenon at all.

For instance, the author asserts that the Nader spoiler effect demonstrates nontransitive preference relationships. But from my reading, it wasn't the case that that group as a whole preferred (Gore over Nader) and (Nader over Bush) but (Bush over Gore). It was simply that due to the structure of the election, they happened to elect Bush. While this ties into the author's point about the "unfairness" of elections, it doesn't demonstrate nontransitive relationships in group preferences.

Could someone post an example of a group preference configuration in which the group prefers (A over B) and (B over C) but (C over A)?

I understand the concept of nontransitive relationships in general, but in the specific domain of fitness for office, I can't work out how this would come to be.

<comment><USER10> _Could someone post an example of a group preference configuration in which the group prefers (A over B) and (B over C) but (C over A)?_

Sure, that's easy to construct.

        Peter's preferences: A, B, C
        Paul's: B, C, A
        Mary's: C, A, B

The group prefers A over B, by a 2-1 vote. Likewise B over C, and C over A.

</comment></comment><comment><USER11> > Voting is a method that a group of people use to pick the "best choice" out > of a set of candidates. It's pretty obvious, right?

And like many other pieces of "common sense", this isn't correct.

Wikipedia says, "Voting is a method for a group such as a meeting or an electorate to make a decision or express an opinion—often following discussions, debates, or election campaigns. Democracies elect holders of high office by voting." This is _very_ different from "picking the best choice".

I realize that the American public has been indoctrinated for the past few decades that voting is the only way you make yourself heard, but this isn't true and never has been. I recently learned about Wellstone Action ( <http://en.wikipedia.org/wiki/Wellstone_Action> ); I encourage everyone to look into enrolling. (I haven't done so myself yet. I probably will at some point, though.)

> On one hand, this seems to be an endorsement of the two-party political > system we have in the United States.

Actually, what it's an endorsement of is all of our other voting systems where the choice is between APPROVE and REJECT. You have to endorse the existence of political parties in the first place before you can endorse a two-party system, and Arrow's theorem goes nowhere near that.

<comment><USER12> > _Wikipedia says, "Voting is a method for a group such as a meeting or an > electorate to make a decision or express an opinion—often following > discussions, debates, or election campaigns. Democracies elect holders of > high office by voting." This is very different from "picking the best > choice"._

I don't see how they are different. The author never said that candidates have to be people. Substitute the word "alternatives" if you prefer.

<comment><USER11> > I don't see how they are different.

"I think this is the way we should proceed" is qualitatively different from "I think this is the best choice".

> The author never said that candidates have to be people. Substitute the word > "alternatives" if you prefer.

Substitute it in place of what? Where did I require that the candidates must be people?

</comment></comment></comment><comment><USER13> Learning about Arrow's theorem definitely changed the way I think about elections in the US. It also changed the way I think about election news coverage. I used to be an ardent "horse race news" hater. I still am, in terms of how utterly it dominates election news, but now I see some utility in it as well.

Arrow and these others have focused how I look at the game-theoretic underpinnings of elections and the importance of being up to speed on exactly how candidates and interested parties are crafting strategies around the complexities built into the game. When people conflate the "message" of the candidate with the strategy (which is always) I still get irritated. I have a tendency toward partisanship and that kind of thing clouds my judgment. But the day-in day-out workings of the campaigns and PACs are more interesting to me now, because they shed light on what's fundamentally "broken" (from my point of view) in the underlying system, as opposed to what I simply find distasteful or disappointing.

Math!

<comment><USER11> Social choice theory is One Of Those Things which everyone (myself included) needs to spend more time learning about.

</comment></comment><comment><USER14> > A voting system can only, at times, choose the most preferred of the options > given. But it doesn't necessarily present us with the best candidates to > choose from in the first place.

Reminds me of HHGTTG: "Anyone who is capable of getting themselves made President should on no account be allowed to do the job."

</comment><comment><USER15> The article confuses two issues, one illustrated by Arrow's Theorem which is more relevant to parliamentary procedures (where any set of more than two choices has to be resolved as a series of binary choices, and the voting population is small and its preferences well understood) and first past the post electoral systems which are completely hopeless, especially when tiered, as in the US.

Most of the article is essentially discussing an example of Arrow's Theorem where if you know people's preferences and can present them with binary options in an order of your choosing you can obtain any outcome except the least popular option. This is very artificial and not a real flaw of preferential and proportional electoral systems where (a) individual preferences are not known and (b) the entire vote is done in one step, not in a carefully chosen series of binary options. Great for gaming a committee, lousy for elections.

As others have observed, the chief purpose of voting is allowing government transitions without violence and with the appearance of procedural fairness, but the fact remains voting works just fine when the population has a clear cut preference ("throw the bastards out").

Well, modulo corrupt redistricting.

Americans who want to talk about voting really need to understand that there are other voting systems than the horse and buggy system used in the US and UK.

</comment><comment><USER16> _In this case, Hanselman is the clear winner with three votes, whereas the other two candidates each have two votes. This is how our elections are held today._

This is dependent on the exact election taking place. With the US presidential elections, my understanding is that a plurality of electoral college votes is not enough to win, you need an actual majority. In the event of a simple plurality win with no majority, the result is decided by the House of Representatives (which may itself be tied).

<comment><USER17> is it? the actual candidates already get preselected.

even if youre right, which is likely, it doesn't matter, because any majority was previously generated by pluarility.

</comment></comment><comment><USER18> Mixed Member Proportional (MMP) Representation solves some of the problems. [http://www.youtube.com/watch?v=QT0I-sdoSXU&feature=relmf...](http://www.youtube.com/watch?v=QT0I-sdoSXU&feature=relmfu)

The problem with MMP is when the parties choose the ranking of their list of representatives. I think it would be even better if rather than use a party generated list, instead the representatives are determined by people's votes.

</comment><comment><USER19> Also, there's this: <http://papers.nber.org/papers/w15220>

</comment><comment><USER20> I find it interesting that in all those discussions about voting systems, which are mostly focused on USA president elections, nobody mentions two-round voting, also known as run-off voting.

This is what we have in Slovenia for electing our president. In the first round, there are many candidates, and each voter can vote for one. If any candidate gets at least 50% of votes, he automatically wins.

If, on the other hand, there is no majority winner, the two best candidates compete head-to-head in the second round.

Such a system allows you to always vote for your favourite candidate in the first round, and if your candidate doesn't make it into the second round, you can vote for the fallback one.

Details: <https://en.wikipedia.org/wiki/Two-round_system>

<comment><USER21> I don't believe this satisfies the Condercet criterion either. Consider these rankings of preferences:

        20% A ...
        20% B ...
        15% C ...
        15% D C ...
        15% E C ...
        15% F C ...

In a two-round run-off, one of A or B will be elected, despite the fact that 60% of voters prefer C over either A or B.

<comment><USER22> And in the real world, people would second guess this, and enough people would tactic vote for C that it would't be a problem.

"But then they can't vote for their prefered candidate which was the whole point"

Well, _some_ people can. D, E, F could still get a few percentage points. More importantly, I don't think we would see convergence to a 2-party system.

Unless I am missing something, it looks like at least 3 parties could be sustained.

</comment></comment></comment><comment><USER23> Preferential voting solves all these problems. You vote by ranking the candidates on order of preference. If your top candidate does not win the vote goes to next guy down the line until eventually it ends up for one of two candidates.

<comment><USER24> Preferential voting does not satisfy the Condorcet criterion.

[http://en.wikipedia.org/wiki/Instant- runoff_voting#Voting_sy...](http://en.wikipedia.org/wiki/Instant- runoff_voting#Voting_system_criteria)

<comment><USER25> To demonstrate this, consider the following.

80 people: A, C, B

50 people: B, C, A

35 people: C, B, A

IRV eliminates C (as it has the fewest first-place votes) and elects B. But voters on the whole prefer C over B (115 to 50). This is the failure that Pinckney refers to.

</comment></comment></comment><comment><USER26> If you look at Brazil, which has multiple parties and plurality voting, the problems are pretty clear.

In this year's elections, the candidate with 28% of the votes was elected mayor in my city.

</comment><comment><USER27> I've always thought New Zealand's mixed-member proportional (MMP) voting system [1] is the least bad solution currently in use.

I'm not from NZ so I'd be interested to hear what the locals think.

[1] [http://en.wikipedia.org/wiki/New_Zealand_voting_system_refer...](http://en.wikipedia.org/wiki/New_Zealand_voting_system_referendum,_2011)

<comment><USER28> Not a local, but... Proportional voting systems suffer from the problem that voting "power" is not proportional to representation.

Consider a parliament with 100 members and 3 parties. Suppose the breakdown is: A has 49 members, B has 48 members, and C has 3 members. Guess what... A, B, and C all have equal voting power! Any two parties are enough to reach a majority of 51 votes, and any one party is not. Despite A having, in theory, over 16 times the representation of C, it does not have any voting advantage.

Keep in mind that any voting system based on parties will tend to have very partisan voting blocs. Representatives in the US are more independent and likely to break with the party because they are elected in geographically isolated elections. Representatives elected directly by a party generally have about as much independence as the Electors in the Electoral College.

<comment><USER29> I'm from NZ...

To form a government, the party with the most votes, or a coalition of parties which collectively holds a majority petition the governor general.

For a single party this is quite straightforward.

To form a coalition the member parties agree on a 'Confidence and supply agreement" This is basically a statement that in the event of a vote of no- confidence, all of the coalitions members will support the coalition, and also a broad agreement on the budget. Getting an agreement on confidence usually involves a certain amount of horse trading about ministerial and vice ministerial positions. Likewise, the agreement on supply will probably involve some intense budget and joint-policy negotiations.

If you had a parliament of 101 seats, split into an opposition of 50 seats, and a government of 51, itself made up of a large party (48 seats) and a small party (3 seats) what you will probably see is the small party only has the tiniest influence on the coalition agreement. They probably traded everything else to get their senior member a ministerial position.

</comment></comment></comment><comment><USER30> Wasn't this issue addressed rather well in a recent hackernews-linked item which mathematically showed both that voting is not a sham, but that the Electoral College system is more fair than it has been represented? (sorry can't find the link!)

</comment><comment><USER31> Winner-take-all elections, no matter how they operate, leave many people without the representation they prefer. Proportional representation is much less likely to do this.

Proportional representation can used in the executive branch too. Switzerland does it.

</comment><comment><USER12> This is a very nice summary of/intro to the classic/standard mathematical approach to voting and Arrow's Theorem.

</comment><comment><USER32> This is why we have a 2 party system :-)

</comment><comment><USER33> Some of you are forgetting something; that even if you had some form of "stadistical fairness" (whatever that may be); you still have the biggest problem of most democracies: Uneducated people; people who think an atheist shouldn't be president, people who like to reinforce their biases more than they like to have deep discussions about the nation's issues, people who were never taught to do critical thinking... and without doing exceptions for their government, their parents, their religion and the law.

<comment><USER34> That's not really in scope for choosing a voting system that best represents the people. But yes, point taken.</comment></comment>


US risks national blackout from small-scale attack - <AUTHOR> http://online.wsj.com/news/articles/SB10001424052702304020104579433670284061220

<comment><USER2> Blackouts cause people a lot of trouble. But building physical protection against attacks like the Metcalf transformer shooting would be expensive, and people already complain their electricity bills are too high. Given the choice between a 10% higher bill and a 1% greater annual chance of a blackout, which would most people choose?

The article focuses on solutions involving physical security. Perhaps it would be more cost-effective to bolster deterrents? For example, life in prison for anyone convicted of sabotaging a major facility of any kind (in the Metcalf case, this could include both the shooting and the cutting of telecom fiber beforehand).

There also seems to be less focus on improving the resilience of the system as a whole--given that the threats are being modeled to determine minimum amounts of sabotage required, why not emphasize increasing that minimum, rather than reinforcing the few critical points of failure? Computing has moved in the direction of resilient systems made of less reliable components, and so could the grid.

As an aside, a blackout in summertime can be pretty interesting. The one in 2003 brought people together in new ways--I experienced a sense of community which was quite unusual, "old fashioned" you might say.

<comment><USER3> With regards to your first paragraph, we have plenty of money to spend on defense. The USA is expected to spend around 1.2 trillion dollars on defense in 2014 [0]. The problem, is that most of that spending is overseas "defense", and very little of it is used to secure critical domestic infrastructure. Like our energy grids, our roads and highways, etc.

\---

[0]: [https://en.wikipedia.org/wiki/Military_budget_of_the_United_...](https://en.wikipedia.org/wiki/Military_budget_of_the_United_States#Audit_of_implementation_of_budget_for_2010)

<comment><USER2> In the US, isn't electricity supplied and managed by corporations rather than the government? This complicates things somewhat, as it exposes the system to market forces ("I want a choice of providers and I will choose the cheapest") and may reduce the government's ability to "intrude" by adding safety measures.

Perhaps more critically, since the US grid seems to be operated by a number of competing companies, it may be less likely that the system itself will be made resilient, because there is limited cooperation.

If the people of the US decided to spend money on hardening power delivery, would the money come from tax dollars, or electricity bills?

<comment><USER4> It is supplied by corporations, but it is a HIGHLY regulated industry, and almost all corporations have a government granted local monopoly. Very little choice in where you get your electricity from.

</comment></comment></comment></comment><comment><USER5> About the limited number of manufacturers of transformers: Would it be possible and inexpensive to eliminate this problem by keeping a government stockpile of spares somewhere protected with limited access? Do we have planes big enough that in a crisis we could deploy them in hours, or would it involve trucking them to their destination over the course of days? In the latter case, surely the military has secure facilities well distributed over the country and it should be possible to pre-position them.

Or are these transformers so large that they basically have to be built on- site? Or so expensive that keeping ~10 spares would cost too much (say ~$200 million or more)?

Any electricity experts want to chime in?

<comment><USER6> [http://www.tjpottertrucking.com/trucking-oversized- loads/hea...](http://www.tjpottertrucking.com/trucking-oversized-loads/heavy- haul-trucking-1.jpg) ... if a plane can carry that, then transport by air is possible. The Antonov An-225 Mriya could probably carry a large transformer.

IEEE (or the manufacturers?) have commissioning procedures. Typically the larger transformers are manufactured elsewhere, then reassembled on-site and commissioned (figure a week to a month).

Your ballpark estimate on the cost is close enough.

One point to remember is that 'if it bleeds it leads', news stories are often sensationalized to achieve more viewers/readers. Typically for power applications, the sizing of equipment is based on peak demand such that the equipment is only fully utilized in a short time period (people get upset when power isn't available or a fire is started). While this report is probably correct in essence, without knowing the exact scenario that was modeled it is difficult to determine a solution.

</comment></comment><comment><AUTHOR> BTW if you're not a subscriber, then you can circumvent the paywall by searching for the article title on Google and visiting it from there.

<comment><USER7> You should probably resubmit this without the paywall. It is frontpage worthy, but if I've learned anything, HN does not like paywalls at all. :P

This link works [http://online.wsj.com/news/articles/SB1000142405270230402010...](http://online.wsj.com/news/articles/SB10001424052702304020104579433670284061220?mg=reno64-wsj&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052702304020104579433670284061220.html)

<comment><USER2> Your link does not work for me. What works is what your parent suggested: searching for the title and clicking on the result.

<comment><USER7> Ahaha, oops.

</comment></comment></comment></comment><comment><USER8> While I can't read the article (paywall, and I'm not going to break the law by circumventing it), it would take many small scale attacks to cause a "national blackout". We have 3 grids, East, West and most of Texas (which is big enough to have a stable grid and avoids a _lot_ of hassle by not crossing state lines).

And these grids aren't like you probably envision, a good description I came across is that they're a number of ponds with small streams between them. So it would take some cleverness to affect more than one "pond", it all depends on how the grid, or a subset of it is set up. E.g. taking out a lot of California, since at least as I gather it imports so much power, would be easier than many other areas.

Or take San Francisco (please! :-). I remember after one nasty blackout then Mayor Willie Brown, who's a bit more grounded, you might say ^_^, than many area politicians, saying, well, maybe we shouldn't shut down the last power plant in the city....

<comment><AUTHOR> The disturbing takeaway from the article is that it would in fact only take 9 attacks at strategic points to bring down the entire grid, per the FERC report - hence the relative urgency on display in asking utilities to submit plans for improvements by June, and the unavailability of the report to the public (as far as I am aware, after spending a few minutes searching for it).

</comment></comment><comment><USER9> BTW, "American Blackout" was a recent National Geographic program about a hypothetical nationwide blackout [http://channel.nationalgeographic.com/channel/american- black...](http://channel.nationalgeographic.com/channel/american-blackout/)

There's a British version too. Probably worth watching one or the other, if only to prompt you to make some basic disaster preparations.</comment>


Lowering Your Standards: DRM and the Future of the W3C  - <AUTHOR> https://www.eff.org/deeplinks/2013/10/lowering-your-standards <comment><USER2> Making DRM a web standard is bad enough on its own, but what worries is that these content companies will now think they can directly influence the web standards, and start having bigger expectations of what they can ask from W3C.

It worries me that this is just the _beginning_ , and just like they relentlessly keep asking Google for more and more concessions in their search engine to "stop piracy", without ever being satisfied, they'll do the same to W3C and all browser vendors in the future.</comment>


The CIA's former chief of disguise drops her mask - <AUTHOR> https://www.wsj.com/articles/the-cias-former-chief-of-disguise-drops-her-mask-11576168327 <comment><AUTHOR> [http://archive.is/Sloc5](http://archive.is/Sloc5)</comment>


Any Colour Will Do - <AUTHOR> http://philcalcado.com/2014/05/03/any_colour_will_do.html <comment><USER2> In a team setting, everybody has a common goal, and I agree that the role of of a good team lead is to steer people towards that goal.

Open-source is a different world, because people who only have an interest in, say, syntax will show up. They're not interested in talking about the rest of the proposal, because it's hard or beyond their expertise. It's hard to tell people not to talk about the only thing they care about, because you have to tell them to quit contributing to the things they care about.

</comment><comment><USER3> It's unfortunate, but bikeshedding will always be with us so long as there is no model-presentation separation of source code. That lapse allows all these pointless[1] arguments to continue.

Take an online store. In its database, you wouldn't refer to an individual product by English name; you'd use a UUID. No one's going to argue over what the UUID hex value should be. But in plaintext source code, human names and delimiters _do_ matter, even though they are just one way to prettify an AST.

[1] Arguing over syntax is pointless in most contexts, but the ergonomics of syntax _do_ matter socially! Which makes the arguments all the more infuriating.

</comment><comment><USER4> "bike shedding," AKA "Parkinson's law of triviality":

[http://en.wikipedia.org/wiki/Parkinson%27s_law_of_triviality](http://en.wikipedia.org/wiki/Parkinson%27s_law_of_triviality)

"Parkinson observed and illustrated that a committee whose job is to approve plans for a nuclear power plant spent the majority of its time with pointless discussions on relatively trivial and unimportant but easy-to-grasp issues, such as what materials to use for the staff bike-shed, while neglecting the less-trivial proposed design of the nuclear power plant itself, which is far more important but also a far more difficult and complex task to criticize constructively."</comment>


OpenMac - $399 Leopard-capable PC - <AUTHOR> http://www.psystar.com/index.php?&page=shop.product_details&flypage=flypage_images.tpl&product_id=1&category_id=3&manufacturer_id=4&option=com_virtuemart&Itemid=72 <comment><USER2> Is this legal? I was under the impression that all licenses for Leopard (the store bought version) are upgrade licenses only (ie. you need to own a previous version).

<comment><USER3> No, the license for OSX only allows it to be installed on Apple hardware. The consensus on reddit (and here) is that these guys will be shut down on Monday.

<comment><USER4> "Apple-branded" hardware.

</comment></comment></comment><comment><USER4> Nice find. We should start a pool for how many hours it will be before Apple shuts them down. I'm gonna guess 16.

<comment><USER5> That is very generous, even considering this is a Sunday night. I think it'll be gone by 9am.

<comment><USER6> 8:50 p.m. eastern time and they're gone. Nice call, guys.

<comment><USER5> They're still up. I think they just got overloaded with traffic for a minute.

<comment><USER2> The Hacker News effect (we don't generate that much traffic, do we?)

<comment><USER4> Reddit got it first, then News.YC and Digg.

</comment></comment></comment></comment></comment></comment><comment><USER7> So basically: If you buy the hardware Apple used in the iMac's from last year and combine it with the GMA's that were used in the original Macbook's Apple released with the switch to Intel, you can get a cheap computer that works? Is this really surprising?

/edit: Not to mention it's not really unmodified/vanilla. There's some modifications going on. So you're stuck with the version of Leopard shipped unless you're involved in osx86 hacking.

<comment><USER8> I think they're using the EFI V8 emulator, which runs stock Apple kernels with zero modifications, and allows you to use Software Update without any mucking about before or afterwards.

You still need kernel extensions for hardware OS X won't recognize (often just modified Apple drivers to recognize different device IDs for sound/ethernet/graphics), but those can be maintained between OS updates, and so aren't affected by OS X updates.

</comment></comment><comment><USER9> I buy Apple hardware. You've been able to install OS X onto other machines, with compatible internals, for some time. The reason I buy Apple hardware is partly because of the design - it really is much more thought out - but also because this is where Apple makes its money (I know, I know - ipods make the most!) and therefore the hardware sales allow Apple to create the great software. They're really a software company and their OS is lovely.

</comment><comment><USER10> I find it funny how Apple is quick to prevent stuff like this when it occurs yet promotes Bootcamp and uses the point that we can run Windows on our Mac if we want to. If OS X is so great, why not let anyone run OS X on any computer they wish to?

This isn't a jab at Apple, by the way -- I've been using a MBP for about two years now as my only machine and love it.

<comment><USER11> that's like saying "if OSX is so great, why doesn't apple give it away for free?" in other words, "does not compute."

part of the reason the apple experience is better than windows is because the hardware involved is much less diverse. windows users and programmers get killed trying to keep up with drivers for every hardware device under the sun. much of that hardware is complete crap, produced by fly-by-night companies that couldn't care less whether it works or not. an environment like that is not amenable to a good user experience.

also, apple is primarily a hardware company, not a software company. they are very possibly losing money on every sale of OSX. they are willing to do that because they know every copy will be run on a piece of hardware they sold.

apple's margins on their own hardware is ncredible, usually cited as around 40 percent. meanwhile, pc manufacturers have been competing on nothing but price for years, so they've driven their own margins into the ground. one main reason dell is in so much trouble right now.

</comment></comment><comment><USER12> I'm very interested in something like this because I create interactive artwork for events (just got back from yuri's night) and would like to be able to customize the form factor of my hardware. Cutting apart a mac pro just seems so wrong...

Do any HN people know of a good resource for figuring out how to install leopard on alternate hardware?

<comment><USER3> <http://www.osx86project.org/>

</comment></comment><comment><USER13> This isn't worth there time. If a person can afford $399 plus shipping they can probably afford a few more hundred for a real mac.

<comment><USER14> If you max out the machine on their store, the result is $1045 plus shipping. Add in a 24" LCD with the same resolution as Apple's 24" for ~$360 with free shipping (found on pricewatch.com) for a total of ~$1450.

If you price out the equivalent iMac (except slightly worse (320 GB instead of 400GB; 256MB graphics instead of the max of 512MB graphics at Psystar) the result is $2299. That's about $800 extra for slightly less. Of course, Apple's will be nicer in design, fit, and finish, and you'll get Apple support (and I don't know whether Psystar will provide equivalent support). Is that worth $800? I dunno.

<comment><USER15> _...Apple's will be nicer in design, fit, and finish..._

I'm a little mystified when I read this stuff. On my new iMac, both the keyboard and mouse are very unimpressive. Although I'll admit that the keyboard looks nice and the little mouse scroll ball is clever, neither the keyboard nor the mouse is comfortable to use.

The pretty aluminum monitor/box stand only allows up/down pivoting - where's my height and side-to-side swivel adjustment?

Based on my experience with the hardware (i.e., mouse and keyboard need to be immediately replaced due to bad design and monitor would be if it were practical), I conclude that the premium is almost entirely based on the software.

And I also was very disappointed that it is basically impossible to use iPhoto to conveniently access photos on a NAS drive.

<comment><USER14> Hm. In some ways, I agree. I use an iMac from 2005 as my main computer, and I don't use the Mighty Mouse that came with it. I, too, would like height adjustment on the iMac panel, but side to side seems inherent in how light it is: even my cat can spin the whole iMac around by brushing against it.

I haven't had any problems with the keyboard, and I've grown very used to its idiosyncrasies, like the always-on numpad, etc.

Eh. Enough rambling. :)

</comment></comment></comment></comment><comment><USER16> Looks like it can handle dual monitors!</comment>


Chromium's Impact on Root DNS Traffic - <AUTHOR> https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-dns-traffic/ <comment><USER2> Couldn't the traffic be somewhat reduced by changing the time and order of operations?

Currently, Chrome does the following:

(1) on each network change, send three DNS requests with random hostnames.

(1a) If at least two of the queries resolve to the same IP, store the IP as the "fake redirect address".

(2) on a user search, query the first search term as DNS.

(2a) If the query result is NXDOMAIN or matches the fake redirect address, do nothing. Otherwise, show the "local domain" hint.

Instead, it could do:

(1) on a user search, query the first search term as DNS.

(1a) if the query comes back with NXDOMAIN, don't show the hint and stop. We're done.

(2) otherwise, make two more DNS queries with random domain names to check for fake redirects.

(2a) if the two queries resolve to the same IP as the first one, we have a fake redirect. Don't do anything. Otherwise, show the "local domain" hint.

Results of step (2) could be cached until a network change.

This would only require 2 instead of 3 probe queries and only if the user actually searched for something _and_ if the search term actually caused a DNS match (fake or genuine).

<comment><USER3> > (1a) If at least two of the queries resolve to the same IP, store the IP as > the "fake redirect address".

From reading the source, it actually does a HTTP HEAD chasing redirects, and records the origin of the final page, and uses that as the redirect address. So even if two hostnames yield different IPs, if they end up redirecting to same hostname, it will be detected

> (2a) if the two queries resolve to the same IP as the first one, we have a > fake redirect. Don't do anything. Otherwise, show the "local domain" hint.

What if an ISP uses multiple IPs in the fake redirect, and alternates over those IPs in each successive response?

<comment><USER2> > _What if an ISP uses multiple IPs in the fake redirect, and alternates over > those IPs in each successive response?_

Good point. I was wondering how they'd deal with that in the actual implementation.

I think you got the answer though: They match HTTP origins instead of IP addresses - so I imagine, you could do the same in step 2: Do a HTTP HEAD query to the search word and two additional ones to random hostnames, following redirects. If the final origins are the same, there is fakery going on.

A problem with this could be unexpected HEAD requests to actual internal hosts: There is no guarantee an internal host that was never meant to receive HEAD requests would react gracefully or in any way predictable to one.

I'm not sure how they solve this currently. Maybe this could at least be mitigated by only sending the HEAD request to the search word host if there is reasonable suspicion requests are being redirected - e.g. only if the two random hosts resolved and were both redirected to the same origin.

Finally, you could cut all of this short by also connecting to (search word):443 and trying to initiate a TLS session handshake. If the host answers, you know it's probably a genuine internal host that talks HTTPS and you don't need to do any additional probes. (And you can also abort the handshake and don't ever need to send an actual HTTP request to the host)

<comment><USER3> > A problem with this could be unexpected HEAD requests to actual internal > hosts: There is no guarantee an internal host that was never meant to > receive HEAD requests would react gracefully or in any way predictable to > one. I'm not sure how they solve this currently

A perfectly legitimate answer is to not even try. Per the HTTP spec, sending HEAD is supposed to be harmless. If it causes harm, that's a violation of the spec. I'm sure some legacy server out there segfaults on HEAD, but that's not a browser vendor's problem, and it isn't up to the browser vendor to do anything to try to prevent it. Browsers (not just Chrome) send HTTP HEAD in other scenarios as well. And I think this problem is relatively rare in practice, since one hears few reports of it actually occurring

<comment><USER2> I disagree. In this case, it would be Google who is changing the status quo.

I think it's legitimate for a fully internal server on an internal network that only handles internal clients to only implement the parts of the HTTP spec that are relevant to the exchange.

If Google worms its way into that network and starts to talk to random servers, they'd be at fault for causing problems.

I think this holds particularly strong for this case as the requests are not tied to an obvious user action: If I typed "[http://dumbo/"](http://dumbo/") into the address bar and the browser's GET request broke the server, I'd be more inclined to view the server's team at fault than if I just searched for "dumbo" and found out the browser broke a server that I didn't even know existed.

Independent of that, it's of course good advice to always build your services as robust as possible - internal or not - and to follow the spec wherever you're able to.

<comment><USER3> > I disagree. In this case, it would be Google who is changing the status quo.

This code has been in Chrome since 2010. When you've been doing something for the last ten years, you aren't changing the status quo, now you are part of the status quo.

> I think it's legitimate for a fully internal server on an internal network > that only handles internal clients to only implement the parts of the HTTP > spec that are relevant to the exchange.

So, there are two ways of "not implementing HEAD": (1) ways that don't harm the availability of the service or other connections to it (return a HTTP error, abruptly close the connection, etc) (2) ways which do (e.g. crash the whole service upon HTTP HEAD on a single connection)

If a service isn't implementing HTTP HEAD in way (1), then Chrome isn't going to hurt it. If a service isn't implementing HTTP HEAD in way (2), then it is buggy, poorly written, and also insecure (HTTP HEAD becomes a denial of service attack), and that's not Google's problem, that's the problem of whoever maintains that service

In practice, few services which don't implement HEAD in way (2) are even going to exist, because browsers (both Chrome and others) regularly send HTTP HEAD in other circumstances as well (e.g. CORS checks). If HTTP HEAD makes your service crash, your service is going to be crashing a lot even if Google had never implemented this particular feature

</comment></comment></comment></comment></comment></comment><comment><USER4> The first question I asked to myself: Is there a way to disable it? Networks i'm attached to, don't do any hijacking.

And yes, luckily there is a policy to disable it: [https://cloud.google.com/docs/chrome- enterprise/policies/?po...](https://cloud.google.com/docs/chrome- enterprise/policies/?policy=DNSInterceptionChecksEnabled)

Registry key: Software\Policies\Google\Chrome\DNSInterceptionChecksEnabled

PowerShell: Set-ItemProperty HKLM:\SOFTWARE\Policies\Google\Chrome -Name DNSInterceptionChecksEnabled -Value 0 -Type DWord

If you are managing Chrome via GPO, you should do it via GPO. Templates can be downloaded here: [https://chromeenterprise.google/browser/download/](https://chromeenterprise.google/browser/download/)

<comment><USER5> I wouldn't apply this policy to road warriors even if they spend most of the time in a location you have under control.

</comment></comment><comment><USER6> Wait, so Chrome leaks the first word of my searches to my ISP? That doesn't sound like something I want to happen

<comment><USER7> Your local nameserver should be configured to not forward unqualified names upstream.

<comment><USER8> There is no such thing as unqualified names at this level. All domain names are fully qualified, and comprise one or more labels.

<comment><USER7> I'm referring not to a recursive nameserver, but to a caching one that simply forwards queries to an upstream resolver. Like the one in every consumer router. Usually that's dnsmasq, with this option:

           -D, --domain-needed
                  Tells dnsmasq to never forward A or AAAA queries for plain names,  without  dots
                  or  domain  parts,  to  upstream  nameservers.  If  the  name  is not known from
                  /etc/hosts or DHCP then a "not found" answer is returned.

<comment><USER8> That is not an unqualified domain name, and notice that it does not say that it is.

* [http://jdebp.uk./FGA/dns-name-qualification.html](http://jdebp.uk./FGA/dns-name-qualification.html)

And the words that you are looking for are "resolving" and "forwarding". A proxy DNS server either does query resolution itself or forwards to another proxy DNS server that does. Both sorts can cache, so whether something is a caching server is not the distinction. dnsmasq is choosing whether to forward the query or to do query resolution itself (using a local data source) according to the number of labels in the domain name. As I said, at this level the idea of domain name qualification does not apply.

You are also mis-using "resolver", incidentally. The actual meaning of "resolver" per RFC 1034 is not what people sometimes think it to be. Avoid using "resolver". The mis-use creates confusion.

See [https://news.ycombinator.com/item?id=15232208](https://news.ycombinator.com/item?id=15232208) .

</comment></comment></comment></comment></comment><comment><USER9> Verisign has nobody but themselves to blame, for "inventing" this with its SiteFinder fiasco in 2003.

<comment><USER10> Right! Around 2010, when this feature was implemented in Chrome, hijacking was a business model that was discussed in regular meetings. I recall one hijacker trying to sell themselves to the company that was 'complaining' about the hijacks.

"Buy us out and we'll stop, and you can use the tech on your customers?!?"

One of the boldest business proposals I've been party to. After a few deep breaths and some laughter, the offer was not taken. But that wasn't a one-off event. Spent a lot of time in early 2010's directly trying to protect customers from this stuff. Still do, but it's getting much harder with TLS- everywhere, HSTS, DOH, and many other things. Not impossible though, we can never let up on the pressure to keep the ROI too low for hijacking. The various network operators and ISPs that let these companies put racks in their data-centers to inspect user traffic should be <<insert_your_own_horrible_idea_here>>.

</comment></comment><comment><USER11> For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

<comment><USER12> We got hit by this issue in March when our remotr users increased 5+ times and the DNS traffic going through our VPNs was causing a headache to our DNS servers. We pinpointed this to tis Chrome functionality, which includes also other chromium based browers like new Edge, and we had to deploy a relevant GPO to disable this functionality. Some background, I'm talking about ~200+k remote users. Also while in the office the load is distributed in tenths of DNS servers, when on VPN only a fraction of those are used. Furthermore if I remember correctly this "feature" in chrome was enabled in a version which was distributed to our clients maybe a month before the lockdowns so there was little time to see the effect while clients were still in the office

<comment><USER13> The last time I saw DNS throughput or performance issues was around 2003 on a network with 200K desktops and servers. That was 17 years ago, and they don't have a problem any more, despite growing in footprint to nearly half a million client machines.

I struggle to understand how DNS can possibly be a performance issue in 2020. In most corporate environments, the "working set" of a typical DNS servers will fit in the L3 cache of the CPU, or even the L2 cache.

The amount of network traffic involved is similarly miniscule. If all 200K of your client machines sent 100 requests per second, each 100 bytes in size, all of those to just _one server_ , that adds up to a paltry 2 Gbps.

If your DNS servers are struggling with that, get better servers. Or networks. Or IT engineers.

</comment></comment></comment><comment><USER14> I'm sure anyone here who has set up a PiHole ad-blocking DNS server at home has run into these random domain requests and wondered what was going on. At first I thought one of my devices had a virus on it or something until I did a few searches and discovered it was Chrome being ludicrous. (Next topic: Getting Chrome to actually use the DNS provider that you specify and nothing else...)

<comment><USER15> I recently just blocked port 53 in my firewall completely, for that exact reason. I use an internal DNS server the forwards to an DOH upstream server. No more rogue devices trying to use their own dns, at least until they all switch to DOH too

<comment><USER16> I also blocked port 53 in my firewall (except for the Pihole; no DoH there). After that, I noticed that some applications have some DNS servers hard-coded. 22.214.171.124 being pretty prominent.

My solution was to assign the Pihole the IP address 126.96.36.199 as well. Then I added a static route in at the router to route 220.127.116.11 to the Pihole. Now every request to dns.google will also be handled by pihole instead of getting timeouts.

</comment></comment></comment><comment><USER17> It would be interesting to have an estimate of the energy consumed (globally) by this Chrome/Chromium feature...

<comment><USER18> I'm curious why you think this might be significant. All global root server traffic amounts to < 1gbps. Under contrived conditions you could easily serve it all from a single laptop computer, but even if we assume that realistically it's being served by a large, distributed collection of servers each drawing ~250 W continuously and each housed in one of those ridiculous corporate datacenters with a PUE over 2.0, you're still looking at a global energy cost comparable to one tankful of motor fuel per day, or much less than the energy used by one single commercial airplane.

</comment></comment><comment><USER19> You can see the code online through the CS browser - [https://source.chromium.org/chromium/chromium/src/+/master:c...](https://source.chromium.org/chromium/chromium/src/+/master:chrome/browser/intranet_redirect_detector.cc;l=148?q=%22we%20generate%20a%20random%20hostname%22&ss=chromium)

</comment><comment><USER20> Fallout from the ISPs effort to hijack failed DNS queries.

</comment><comment><USER21> On macOS you can block these with the excellent product Little Snitch.

I've got several rules for Google Chrome in Little Snitch that seem to do the trick. Deny outgoing UDP connections, and Deny outgoing TCP connections to port 80 for the IP addresses and domain for my ISP. You can see these if you monitor traffic.

</comment><comment><USER22> It seems like they could rotate these much less frequently to let caches work. It seems that these are random to avoid DNS servers hardcoding a response for them. However they could be pseudo random based on the current day, month or release so that it would be hard enough to intercept them (unless the DNS server was really committed to doing this, but there are other ways to achieve this) while still allowing a lot of caching.

I think the only downside is that you would leak some information about your system clock.

<comment><USER23> > It seems that these are random to avoid DNS servers hardcoding a response > for them. However they could be pseudo random based on [the current date and > browser release]

That would still allow ISPs to compute the limited number of domains for which NXDOMAIN would need to be sent at any given point in time.

(Whether they'd do it is another story. The random pattern currently used by Chrome looks like it may still be easily detectable at the DNS-recursor level, so maybe the ISPs really don't bother beyond the simple NXDOMAIN -> portal domain replacement.)

<comment><USER22> As I said, if they make specific effort they will succeed. The current scheme can be broken by returning a number of different IPs instead of one or two. I think my proposal has a nice balance between making ISPs put in non-trivial effort and not putting a lot of load on the root servers.

<comment><USER10> This is a classic arms race. The hijackers back off for a while, but as is always the case in low-margin, low-regulation, low-consequence environments, bad actors will present a way to skim a tiny value out a massive amount of transactions. Give a percentage of that to the network operator, and take the rest home.

The network operators enable this behavior. It would be next to impossible for it to be useful (ROI wise) if they didn't intentionally support it with access to their networks. It doesn't need to be an arms race, but we refuse to regulate or punish anyone in this space. We waste massive amounts of resources detecting and counteracting the hijacking services. The human (developer) cost is where the big waste is here, not electricity.

and the fight goes on....

</comment></comment></comment></comment><comment><USER13> I'm curious to know how much data the root namespace servers put out in terms of gbps, but this doesn't seem to be public information.

<comment> CKN23-ARIN [https://root-servers.org/](https://root-servers.org/)

Select a root server at the bottom. Some, but not all, have a "statistics" link. Seems to be stated in qps and message size distribution, but you should be able to derive traffic volume from that.

<comment><USER24> Assuming the mean is close to the median, they are reporting ~10B requests daily with a median response size of around 1KB. 10TB daily is a little under 1Gpbs. Traffic is spiky, but this isn't particularly complex once you consider they have multiple data centers/servers. Of course, I may have misread something as daily that was hourly or something like that...

<comment><USER13> So it looks like the root namespace providers output a totally reasonable amount of traffic. Divided between the hundreds of points of presence globally, this is tens of megabits per physical host.

This FAQ is illuminating: [https://www.verisign.com/en_US/domain- names/internet-resolut...](https://www.verisign.com/en_US/domain- names/internet-resolution/node-hosting/index.xhtml)

The servers themselves are ordinary 1 RU physical rack mount servers with 1 Gbps or 10 Gbps Ethernet. Nothing special. I'm guessing that most of the load isn't from the root, e.g.: "j.root-servers.net", but from hosting the authoritative DNS servers for .com and .net (b.gtld-servers.net) on the same box. That would surely have more traffic and much more data.

<comment><USER25> Reasonable _quantity_ of traffic, but they have to be very reliable.

<comment><USER26> No need for reliability when there is 26 way failover...

</comment></comment></comment></comment></comment></comment><comment><USER27> ungoogled-chromium[1] and Bromite[2] have had a patch to disable this for a while now

[1] [https://github.com/Eloston/ungoogled- chromium/blob/14fb2b0/p...](https://github.com/Eloston/ungoogled- chromium/blob/14fb2b0/patches/extra/ungoogled-chromium/disable-intranet- redirect-detector.patch)

[2] [https://github.com/bromite/bromite/blob/410fc50/build/patche...](https://github.com/bromite/bromite/blob/410fc50/build/patches/ungoogled- chromium-Disable-intranet-redirect-detector.patch)

</comment><comment><USER28> I can't get past the `size_t i` rather than `int i` in the first loop. Why. I suppose it is some type of defensive programming.

<comment><USER29> Bit flip changes an int to a large negative value. Now you're stuck doing a signed comparison for a while.

</comment></comment><comment><USER30> Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer?

Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party.

I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DNS servers, not the root servers.

<comment><USER4> From article:

> Users on such networks might be shown the "did you mean" infobar on every > single-term search. To work around this, Chromium needs to know if it can > trust the network to provide non-intercepted DNS responses.

Don't know if this is the sole reason.

<comment><USER30> I think you are right.

Reminds me of the story behind "Google Public DNS". Back in 2008/2009, OpenDNS was hijacking "queries" (NXDOMAIN) typed in the address bar to their own search page ("OpenDNS Guide", or some such) on an opendns.com subdomain. In response, Google launched its own open resolver.^1 (OpenDNS was later acquired by Cisco)

1\. [http://umbrella.cisco.com/blog/opendns-google- dns](http://umbrella.cisco.com/blog/opendns-google-dns)

</comment></comment></comment><comment><USER31> I think I've understood the most of the article but I missed the initial part. Why is there a probe in Chrome that uses DNS to query random 7-15 character long hostnames, only to get NXDOMAIN and burden the root nameservers? What does this probe achieve?

<comment><USER11> Some DNS providers (like ISPs) will hijack NXDOMAINs and redirect you to ads or stuff like that. Chrome wants to detect that.

<comment><USER32> There was a point where, at least in the US, this was standard behaviour for virtually every single major ISP and mobile provider. Several used to hijack _all_ port 53 traffic to disallow you from using anything but their resolver.

<comment><USER33> And for those who don't understand why this is a bad thing, I will present my own use case. I run pi-hole at home and frequently work from there for another company. That company has provided me with a laptop that uses Cisco's DNS "Umbrella", which is some sort of security feature: [https://docs.umbrella.com/deployment-umbrella/docs/point- you...](https://docs.umbrella.com/deployment-umbrella/docs/point-your-dns-to- cisco) Because my company laptop doesn't pay attention to the DNS servers recommended by DHCP, and ignores the local domain search TLD, if I try to ssh into a machine on my local network (without a FQDN) from the company laptop, it replaces the local search domain with the corporate domain, then does the lookup, and gets an A record from Umbrella that is not on my local network. It makes the ssh connection and (surprisingly) reaches an ssh server, which asks me for my password. The login fails, and my password (in plain text) could very well have been harvested by the ssh server on the catchall host. Now you are going to tell me that I shouldn't use ssh passwords, and should instead be using RSA keys for ssh. Regardless of what the NSA tells you, THIS IS ALWAYS A BAD IDEA because once any account is compromised, ALL OTHER ACCOUNTS with locally stored keys ARE ALSO COMPROMISED.

Sorry for the rant, but wildcard catchall DNS is a REALLY BAD THING.

<comment><USER34> > THIS IS ALWAYS A BAD IDEA because once any account is compromised, ALL OTHER > ACCOUNTS with locally stored keys ARE ALSO COMPROMISED.

This is not universally true. If you generate separate private keys for each server-client pair, compromising one private key will limit the damage to just the one server.

<comment><USER33> That is just not true. It may be the case if the key itself is compromised, but consider that you may have many different accounts scattered on different servers. Once one of them is compromised, the attacker now has access to every other account because they are all chained together.

<comment><USER35> Can you describe the attack scenario you're imagining in a bit more detail? Because that doesn't sound possible to me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Why is the C++ code labelled to be coming from some file .c?

</comment><comment><USER37> Why on earth is there someone with shell access to the DNS root zone and running tcpdump?

<comment><USER38> how would they maintain the root servers and correct issues without shell access or tcpdump? Make blind guesses and restart the server until the problem goes away (it won't)?

No matter how high-profile the environment, eventually, the rubber will hit the road and _some_ human will be in a privileged position to be able to fix a problem.

That is true for every single service out there. Yes. Including Gmail. Including AWS. Including Twitter. Everywhere.

Depending on size and profile of the service it's more or less people in need of jumping through more or less hoops to get there, but this _must_ be true for _any_ service.

Always keep this in mind when you make the decision to move your data to a cloud service.

<comment><USER37> Why is a server with a problem still part of the root zone? And no, this is absolutely not the case for _serious_ operators. Access to production systems is highly regulated.

<comment><USER39> Yes, highly regulated access with lots of hoop jumping, that's what they said. And there exists a person who has jumped through all the hoops and has that access. And that hoop jumping person ran tcpdump on the root server.

</comment></comment></comment></comment><comment><USER40> The worst thing is, this will not even detect a well written NXDOMAIN interceptor that only hijacks requests to valid top level domains.

It's about time for DNSSEC to be available on all TLDs and for browsers to nag if it is broken.

<comment><USER41> As I wrote above: DNSSEC can't do anything about unsigned zones, and the overwhelming majority of zones in both the North American Internet and in popular domain lists like the Moz 500 are unsigned, and will remain unsigned, despite almost a decade of pleading from DNSSEC advocates to recant.

What's crazy about this is that there's a trivial solution to forged NXDOMAIN responses that people can adopt immediately: just DoH to a provider that doesn't forge NXDOMAIN responses (none of the major providers do).

I sometimes wonder whether the vehemence of the anti-DoH advocacy is rooted in concern that it will cause DNSSEC to lose yet another potential motivating use case.

<comment><USER10> I've never looked at DOH as an attack on DNSSEC, though I suppose you could. I think the resistance is more about the big corporate and the Internet level DNS operators like Google's 22.214.171.124, they want to be able to manipulate DNS responses when necessary. I know, evil corporate IT Ops hijacking my HNN connection. No, not that.

Think about a coordinated effort by top tier DNS providers globally to stop a giant bot network by simultaneously 'hijacking' DNS responses for the command and control server host-names. In classic DNS this is easy, just intercept the requests at the LDNS provider and return a dummy server IP, all good.

That falls apart with DOH and DNSSEC. With DNSSEC you cannot forge a response to a client that strictly expects signed responses for a particular zone. And with DOH, the various corporate IT shops cannot inspect and 'hijack' the responses. Though, the DOH operator can still change the response. But that moves the capability outside of local corporate IT and into a multinational company that might not agree with your request to 'fix' a problem via assisted DNS hijacking.

So all of these new, safer DNS delivery methods do legitimately impact the ability of "good"* operators to protect the Internet. Is the trade off worth it to protect users DNS traffic versus being able to respond to threats? I think that protecting users daily traffic is net-net better as it is a steady state problem and state sponsored actors have the resources to subvert a population via DNS. But I also feel the loss of a tool to protect users at the same time. Things like this are never zero-sum.

Disclaimer: I work for Microsoft and although I don't operate DNS services as part of my job, I have spent a lot of time on this particular topic over the years. These are my opinions, not the companies. I welcome challenges to my opinions, that's how I learn.

*"good" is always a situational thing.

<comment><USER42> Losing the ability to do this very specific mitigation seems a tiny price to pay for not having everybody's DNS requests have zilch for transit privacy and integrity all the time.

</comment></comment></comment></comment><comment><USER43> I don't get this feature. And I really hate that it's present in pretty much every browser these days. If I want to type an URL, I'll use the address bar. If I want to search, I'll use the search bar. Different bars with different keyboard shortcuts and different purposes. Why do so many browsers merge these two? Screens are insanely wide these days, so screen real estate can't be the reason. Are we trying to trick users into thinking that URLs aren't a thing anymore?

Maybe this "omnibox" doesn't know whether I want to enter a hostname or a search term, but _I_ do.

<comment><USER44> > Screens are insanely wide these days

This is not relevant for URL or search bars since they need to be displayed horizontally. Separate bars means less vertical screen space, which is still scarce.

<comment><USER45> > _This is not relevant for URL or search bars since they need to be displayed > horizontally_

Need? Has anyone tried?

<comment><USER46> I've seen it, back around 1999, possibly konqueror? Something that let you drag around toolbars and if you moved the address bar to the left/right side it would change the direction of writing.

Let's say that testing it briefly was enough. Editing tilted text works up to around 45 degrees, steeper than that is a strain.</comment></comment></comment></comment>


Ask HN: Leasing servers w/AWS Direct Connect? - <AUTHOR>

Last year, Amazon rolled out AWS Direct Connect, which lets you connect your physical servers via a low-latency network pipe directly to AWS. This seems a perfect solution for building a hybrid cloud - e.g. if your database server needs more horsepower than Postgres-on-EC2 can yield. But the Direct Connect marketing is (naturally) geared toward enterprises with a presence at Equinix, Level 3, etc.
It seems to me that there must be resellers with existing cages at these data centers where I could rent a single unmanaged server. But, of course, resellers don't tend to advertise which data center they're colo'd in.
How can I go about finding Direct Connect-capable, unmanaged server resellers? I'm looking specifically at US-East in Northern VA. <comment><USER3> <http://aws.amazon.com/directconnect/>

"Complete the AWS Direct Connect interest form indicating your choices. If you don't already have infrastructure at your selected AWS Direct Connect location, you may optionally indicate on the form that you would like to be contacted by an AWS Direct Connect Solution Provider."

The key point here is "If you don't already have infrastructure" and "contacted by an AWS Direct Connect Solution Provider". Now it's true that some of these companies may not want to work with someone who is only going to be hosting a server or two. In my experience, when dealing with these larger companies, you can get a referral to a reseller/affiliate if they can't (or won't) help you directly.

</comment><comment><USER4> I do not believe you will find what you want.

Here's why:

In order to connect via AWS Direct Connect, a provider needs to have a permanent connection between themselves and Amazon. These are provided by the companies listed in "AWS Direct Connect Solution Providers" ("ADSCP") for Northern VA, e.g. IX Reach, Abovenet, Equinix, etc.

So the 'middlemen' between you and AWS are:

You - Hosting Provider - ADSCP - <USER2>

Your Hosting Provider would have to have enough business, or potential business, to justify having a direct connection to ADSCP to reach AWS instances.

In order for them to multiplex the service for you, they would either have to strike a deal with AWS to allow them to dynamically connect your instance to their pipe (AWS doesn't do one-offs, and this is not a product, yet), or they'd have to dedicate the cross-connect to a connection with AWS in your name that would do this.

The cost of a cross connect from most providers is on the order of $250/mo.

So you would have to bear the cost of the cross connect to the ADSCP, in addition to your monthly hosting costs.

Most managed hosting proviers are going to figure that customers spending $250-$1k per month, are not going to be so excited to spend an extra 25-100% to connect to Amazon.

I can see why you'd want to do this, and I think we'll be able to someday.

If you want to, you can rent a cabinet for $1k/mo, put power in for $500/mo, and get a gig-e to the internet for $2k/mo and an AWS connection via an ADSCP for ~$250/mo. Then you can put your server in there for free and connect up.

Point is, for as "little" as $1750/mo, you could do this yourself by colocating with the ADSCP.

Alternatively, one could offer a multiplexed connection to AWS via an ADSCP, then route the traffic from within Amazon.

Bottom line, the fixed costs for doing this probably higher than justified for most people with a single server.

This analysis does not include the per-hour AWS Direct Connet costs, which are marginally fixed per usage without regards to infrastructure scale.

-alan

</comment><comment><USER5> Hello,

I am with the AWS Direct Connect service team and I can help you with your request. To start, please fill out the form on the product page: <http://aws.amazon.com/directconnect/>. Please include an email and phone number I can reach you at. I will call to discuss your options and refer you to the appropriate provider.

Regards, Krishna

</comment><comment><USER6> Call them and ask.

<comment><USER7> All due respect, that's missing the problem. He's trying to figure out _who_ he should call.

<comment><USER6> Find 10-30 hosting providers; call each one and ask a) where they colo and b) if they can offer direct connect.

Don't want to waste your time? Hire it out to TaskRabbit or IamExec. Most places are not going to advertise it as a feature, as the market isn't that large for people who want dedicated equipment with a provider not Amazon, but still want direct access to Amazon AWS services from that dedicated hardware.</comment></comment></comment>


xWifi Open Source Hardware Wi-Fi Module and Dock - <AUTHOR> http://www.cnx-software.com/2014/09/01/xwifi-open-source-hardware-wi-fi-and-dock-for-the-internet-of-things-crowdfunding/#ixzz3CM4jpuUw

<comment><USER2> I wasn't aware there were so many wifi enabled socs coming out recently. Compared to an Arduino, how difficult is it to program them?

</comment><comment><USER3> Would someone explain what kind of things you could do with this?

Forgive my ignorance.

<comment><USER4> Lots of stuff, you could for instance use them for sensors, say to monitor the temperature of your house and control it from anywhere on the Internet.

With some of the faster wifi modules that can run linux on them, I could see making a system of wifi enabled speakers for a house, so you could stream the same music to many rooms.

I'm planning on hopefully using something like the ESP8266 attached to a microcontroller to control/inspect my brewing hardware (so I can see what my beer is doing - admittedly rather niche ;)</comment></comment>


HN, what is your meditative practice? - <AUTHOR> http://moderndao.tumblr.com/post/68520512899/what-is

<comment><USER2> I personally like to get outside and walk around, preferably in a less than crowded space. When I have smoked cigarettes in the past this has been a very good excuse, but now I just take walks either way.</comment>


Ask PG: Do you still consider character count a good Prime Directive for an HLL? - <AUTHOR>

I was just about to code an IF and used COND instead, even with the extra parens, and thought about Arc and the principle I recall Mr. Graham stating rather unequivocally (hope I get this right, but it made a strong impression at the time) that any syntax suggestion that made code shorter was A Good Thing.
My non-trivial exercise in Arc gave me syntax anxiety, because the shortening was usually achieved by syntax cleverness requiring a pause while I reminded myself of the shortcut's usage.
Now that I think on it, I recall Mr. Graham saying another big design principle was that the language be small enough to keep in one's head, and it seems to me that would argue against cleverness as well as specification index page cont.
I am just wondering if Mr. Graham has any follow-up thoughts on language design based on his Arc experience, and specifically on the "shorter is better" rule. <comment><USER2> It still seems hard to beat the size of the parse tree as a test. (Characters would not be as good a test.)

</comment><comment><USER3> From my experience, I have seem many cases where the "let's help api users/client code developpers save some keystrokes" mentality has brought a lot of issues.

Not sure if related to the question though, but still I think shorter is better only applies as one of the principles, among "explicit is better than implicit", "do not try to guess" and "code is read ten times more often than written".

Another example would be the hello world one liners. Some languages are very proud to have a hello world in 11 characters, but if just because of the hello world you add a new special grammar like "print to screen what is between curlies if not inside another token", then you are doing it wrong.

</comment><comment><USER4> The shorter the code, the less room there is for bugs to hide. There are exceptions to that rule but they are not nearly as common as people make them out to be.</comment>


Quotes from Moral Mazes (2019) - <AUTHOR> https://thezvi.wordpress.com/2019/05/30/quotes-from-moral-mazes/ <comment><USER2> Good article, but I fear that sharing quotes without their context may do more harm than good.

As a random example, quote 163 reads in part:

> _(...) Then I went into soda ash. Without it, there wouldn't be a window > pane in the whole United States. But at the time, because of the Clean Air > Act and the Clean Water Act, suddenly I became a polluter. Children learned > in school that chemicals killed. And, of course, there was no question in > the academic community that I was perceived as an evil person doing evil > things._

The full quote presents the author as someone who is unhappy because they performed good-intentioned work and suddenly their good-intentioned work is cast a bad light (it also talks about DDT and CFC). However, quote 25 reads:

> _The logical result of alertness to expediency is the elimination of any > ethical lines at all._

which may or may not undermine the first quote's point entirely, depending on how these two quotes are related to each other.

Given that the article itself starts with " _Reading and actually paying attention to Moral Mazes is hard. (...) I effectively spent several months forcing my way through the book, because it seemed important to do that_ ", the risk of these quotes being misunderstood from small snippets seems quite high.

</comment><comment><USER3> Related and a kind of counterweight: [https://slatestarcodex.com/2020/05/12/studies-on- slack/](https://slatestarcodex.com/2020/05/12/studies-on-slack/)</comment>


Videopixie (YC S11) Launches To Create A Marketplace For Video Editors - <AUTHOR> http://techcrunch.com/2013/06/19/yc-backed-videopixie-launches-to-create-a-marketplace-for-video-editors/

<comment><USER2> If the videopixie team is listening, you should really go after the wedding photographer market. Consider the following:

\- Most DSLRs shoot video now

\- Most brides want photos + video but don't want to pay 2 separate vendors

\- Most photographers don't have video editing time/skills

Drop me an email if you want more details on the industry.

<comment><AUTHOR> Thanks Erik. You're right, and we'll be in touch :)

</comment></comment><comment><USER3> We used Videopixie for a number of our customer case studies. Their editing service was literally an order of magnitude cheaper than the studio who shot the video was bidding to edit.

The quality was great too, you can easily get multiple iterations and give feedback easily.

</comment><comment><USER4> My takeaway is that they first started with a product that challenged some of the biggest players. A video distribution platform? Up against YouTube and Vimeo?

But that wasn't the end goal - they just built something, _anything_ , to start a conversation with customers and learn of new needs in the area. After learning of new needs they pivoted and built a new product.

It's not about the idea necessarily - it's about learning and execution.

<comment><AUTHOR> Thanks Ethan - founder here. You're pretty close to the mark. As we were building out SellStage we had office hours with PG where we said (paraphrasing) "retailers have all these different video related problems, we're not sure which to solve", and he said (paraphrasing) "build a minimal solution to all of them, and see which one does best".

</comment></comment><comment><USER5> While I love the idea of connecting supply and demand for a niche skill, I worry for folks in the Motion Graphics/Post Production world who are already being paid very poorly for their work [1]. I just hope this product doesn't trivialize the amount of work that goes into video editing and post production. Great idea otherwise.

[1] [http://www.wired.com/underwire/2013/03/oscars-vfx- protest/](http://www.wired.com/underwire/2013/03/oscars-vfx-protest/)

<comment><AUTHOR> Thanks (founder here). No trivializing intended! We have a lot of very talented editors on Videopixie, and we're constantly impressed by their work. We frequently get their input on pricing, and we adjust. Being a marketplace, the theory is that the market will find the fair market price.

<comment><USER6> What sort of length are the videos generally? Is it up to the client or is there an imposed duration limit?

<comment><AUTHOR> The customer decides the length. Nearly all of them are between 30 seconds and 5 minutes. The majority are between 1 and 3 minutes. We recommend that customers keep them short, to keep their viewers happy :)

<comment><USER6> I think shorter video length makes Videopixie an exception to jianshen's concern. These editors aren't really engaging in exceptionally complex editing work, just the equivalent of TV spots.

Local news outlets often have a division of their marketing team commission freelance editors to make commercials for prospective advertisers.

Thanks for your service! I've got a film industry friend who could use the extra work.

</comment></comment></comment></comment></comment><comment><USER7> This is a great idea. Much needing this. I wonder if there's service that would let you find video-shooters in locations where your customers live. If you're across the globe, it'd be hard to travel to their office for a testimonial. Finding somebody locally to do this for you is the way to go. Any ideas?

<comment><USER8> Thanks Cristian, founder here, I think today people mostly go to craigslist or get referrals from friends, to find videographers. It's not a great experience and presents some of the same problems/risks we are trying to solve for post- production (ie: not knowing what's a fair price, not knowing what all the options are, not knowing if the fit will be good, not to mention the relative hassle of finding, communicating & paying the artist). But we get asked the question often, and I think you are absolutely right, we need a better solution to find/hire videographers.

</comment></comment><comment><USER9> I thought you guys were in business??? I met Thomas at a DC HNer meetup about a yr ago and I thought you guys were already launched... did I miss something?

<comment><USER8> It was available as an early alpha. And we've had users all along, which helped understand what people need. But today is our public announcement.

<comment><USER9> Got it. Well here's wishing you good luck. I am in the processing of quitting my job to launch a new company, will be joining you guys on the dark side very soon!:)

Btw it will be nice to do another HNer meetup in DC.</comment></comment></comment>


React Draft Wysiwyg - <AUTHOR> https://jpuri.github.io/react-draft-wysiwyg <comment><USER2> This is great! I agree that I think this kind of editor composing is the way forward for most content editing on the web.

I was deep into Draft a while back, and there are some downsides to it though. It's document model is flat, which makes it hard to model nested structures like tables, captions, etc. It also treats a lot of the built-in logic in privileged ways which makes it hard to override and add custom logic. And generally the API and docs are fairly convoluted to use and understand.

If anyone is interested in composing complex editors in React/Immutable, you might be interested in a library I've been working on called Slate:

[https://github.com/ianstormtaylor/slate](https://github.com/ianstormtaylor/slate)

Unlike most of the other editors, its goal is to not have opinions out of the box. If you're going for just basic WYSIWYG then it's probably not for you, but if you're trying for more advanced editing experiences I think that flexibility is critical.

Anyways, awesome work! I just wanted to add another perspective.

<comment><USER3> Slate looks awesome. I wish I had seen it when I was looking for a replacement for our core rich text editor library.. although I probably would still have gone with Draft merely because of the Facebook support. Should they stop updating it, I know what ship I'll be jumping to. It looks like the concepts are similar enough that porting wouldn't be too painful.

I've built and am maintaining a rich text editor that is a lot like Gmail's except it also supports dynamic variables, snippet insertion, and a few other things like that. Nested content hasn't been a concern for me, so DraftJS has been pleasant for the most part. Using Immutable for core state makes my life so much easier.

But I do agree with your assessment that Draft's API and docs are lacking, and some of the design decisions are a bit odd. Doing relatively simple operations can require quite a few more steps than you would expect, meaning I had to implement a lot of helpers (that you think would be included) myself. Slate's Transform API looks a lot more capable and straightforward out of the box.

HTML serialization, something you would expect to be part of the core library, only has a half-assed implementation that isn't customizable and that doesn't handle anything more than anchor tags.. so you have to install a third-party library to do it.

Just one question: if you can have nested blocks, do you really even need marks? Are they just there for convenience?

<comment><USER2> Thanks! I totally agree with you, those were some of the other limitations I ran into and tried to solve for.

> If you can have nested blocks, do you really even need marks? Are they just > there for convenience?

Interesting question!

It depends slightly on your use case, but I think for most of the "rich text editing" use cases, you'll probably want them.

They're beneficial in that they have separate semantics to inline nodes in the tree, since they aren't nested. Such that you can apply them in any order, and the JSON data structure is the same. This is useful because you don't have to worry about ordering when doing things like bold(italic(strikethrough(comment(TEXT)))). Which is usually simpler for users to understand, and simpler to work with in code anyways.

The inline nodes are only really useful for what you'd model in HTML as `display: inline-block`, for things that aren't really running "text" but can appear in the middle of the document, like inline images, latex, etc.

But if you're able to avoid inline nodes altogether, it's easiest to model things as blocks and marks.

This has me thinking about whether it's possible to get rid of "inline" nodes though, that's interesting.

</comment></comment></comment><comment><USER4> I don't think the toolbar actions work as one would usually expect. That is, hit Bold, type, text should be bold but isn't. The tools only seem to apply if there's already a selection, but that's not how vanilla Draft or any editor I can think of works.

</comment><comment><USER5> [EDIT: Just for reference, the title originally was 'the right way to content manage..']

I'd maybe call this "an" approach, rather than the 'right' approach :)

Already, prosemirror has provided a solid alternative, with things like custom-schemas, which ensure we're no longer in contenteditable-copy/paste hell. There's substance.io and quilljs as well.

Any of these could be the right approach for a particular CMS problem.

<comment><USER6> I just came here to write that I think this is THE right approach for wysiwyg editor. Having a full model of the document tree rather and working from that rather than sanitizing `contenteditable`. I expect this approach to automatically solve many problems that other wysiwyg editors have.

<comment><USER7> Prosemirror still uses contenteditable under the hood though. I actually wonder why that is the case.

<comment><USER8> It handles the more complex (e.g. CJK) input methods. The alternative is a hidden text field and you have to put more effort into emulating the cursor (e.g. up arrow/down arrow). Regularly re-generating the underlying markup removes a large class of edge cases and cross-browser incompatibilities in exchange for not being able to use the browser's native undo. It's still a lot harder than you'd expect but it seems to be working for draft and prosemirror better than my attempt to normalize the cross browser differences and rely on the browser.

P.S. I also came into this thread to endorse Prosemirror.

</comment></comment></comment></comment><comment><USER9> I love these initiatives. It does, though, need thorough testing in an office environment. Things that users, not developers, will come out. For example, I tried cutting and pasting from Word. Forget about formatting, none of the line breaks carried over. That's not to discount this. It'll be great in certain settings, but it has far to mature if it's goal is to compete with tinyMCE.

<comment><AUTHOR> Totally agree to this.

</comment></comment><comment><USER10> No offense, but it feels junky, just like most web stuff that's trying to do "real" application UI.

Here's some of the problems:

\- You can accidentally "select" the text of the buttons

\- changing the style of the text causes selection to flicker

\- clicking outside a paragraph area causes the selection to flicker (instead of moving the cursor)

\- many of the menus don't collapse automatically and they overlap each other

\- the site layout just breaks when the page width is too narrow (may be more of a website problem)

All of these are very common problems with web technology, working around them makes the difference between "good" and "acceptable".

<comment><USER11> In case anyone is reading this. You can solve #1 with CSS3, using "user- select: none;".

It's something I don't often see added to buttons, but it is a huge benefit for any app-like layout.

</comment></comment><comment><USER12> I've done a some investigation into this, and I can tell you while this looks cool. It'd be difficult to use on other devices (tablets, phones). The best I've seen is [https://www.froala.com/wysiwyg- editor](https://www.froala.com/wysiwyg-editor) Killer feature is the fact that I can use it on the iPad, Android tablet, IE, and Chrome. Also, its supports tables, which was one of the requirements for our clients. Licensing is pretty affordable, and it's easy to integrate because there are plugins available for different frameworks (angular, django, ...)

<comment> rkuykendall-com Froala seems to be leading the pack, but was still very disappointing. It plays _okay_ with webpack, but _requires_ jQuery, and doesn't seem to support es6 imports.

Plus, the development speed is good, but sloppy. Their official React documentation starts with something they forgot to change when they copy- pasted it from react-highcharts:

[https://www.froala.com/wysiwyg-editor/docs/framework- plugins...](https://www.froala.com/wysiwyg-editor/docs/framework- plugins/react)

</comment></comment><comment><USER13> Please note that Draft.js lacks "inline blocks": there's no way to, for example, have an image rendered inline rather than as its own block. I lost hours to this non-obvious omission so maybe this will save someone else time :)

I've been using [https://github.com/ianstormtaylor/slate](https://github.com/ianstormtaylor/slate) instead, which uses a similar architecture but has inline blocks. It's not quite as fully-baked as Draft.js yet though.

</comment><comment><USER14> I tried it in firefox mobile. After inputting the first letter the cursor jumped behind it.

I tried to reposition the cursor to no avail (the whole edit area loses and regains focus on each tap).

Also, I can't delete stuff (backspace does nothing).

Edit: at this point I just quit trying.

</comment><comment><USER15> Doesn't seem to be working on mobile. iOS 10

</comment><comment><USER16> Looks very nice, thanks for the work.

I've been tinkering with Draft off and on for quite some time and I love how powerful it is, however documentation was rather lacking in some areas and this project would definitely help me understand some of the things about Draft.

Too bad there's still only a workaround for block styles (as in setting "style" prop on a whole block instead of using setBlockData method).

<comment><USER2> Just in case you're interested, I ran into the same issues with Draft when using it myself—having to do lots of strange workarounds for what felt like normal levels of customization. I've been working on an alternative that aims to be much less opinionated and with a much cleaner API, called Slate:

[https://github.com/ianstormtaylor/slate](https://github.com/ianstormtaylor/slate)

</comment></comment><comment><USER17> Looks nice.

Not sure if this is a bug, but if I set a specific font size, it doesn't attach any kind of unit. For example, if I select 18, it doesn't convert that to 18px or 18em...just "18":

This is some text.

I believe that's not valid css.

</comment><comment><USER18> Just a few random observations: I can't seem to toggle off bold/italic/...? Neither can it be toggled on before typing it seems. Also, setting text alignment removes bullets.

Nice idea, but functionally not quite there yet.

</comment><comment><USER19> Does anyone else notice a tiny typing lag? I can't point to it, but whenever I type with a delayed response it feels as though I'm slogging through muddy ground, an almost subliminal sensation.

<comment><USER20> Yeah, I do, slightly.

A more noticeable thing is that if you select some text and then Bold / Italics / Underscore, etc. there is a flash where the text appears to be no selected and then becomes selected again.

Given this is React, my guess of what is going on is that the rich text is redrawn when these buttons are pressed (and perhaps even on each keystroke) and the selection has to be re-applied in code.

Perhaps they can improve this, but this is why I think it's important to stay away from high level frameworks for doing low-level things like text editing. Use your high level framework for application architecture and all that good stuff, but when something has to be fast, drop down to the lowest level you have.

</comment></comment><comment><USER21> Nice! p.s. indent buttons don't work (on Firefox)

</comment><comment><USER22> This looks really good. I'm only missing an option to put in formatted code or something.

<comment><AUTHOR> Nice feedback, I just created an issue for it #71. I will prioritize it.

</comment></comment><comment> rkuykendall-com Anyone know a modern editor that can handle editing HTML implemented using an iframe so there's no CSS leak?

I want to be able to render email templates and let clients tweak them before they gets sent. Currently trying to get Froala to work with webpack.

</comment><comment><USER23> Running list of html/wysiwyg editors: [https://gist.github.com/manigandham/65543a0bc2bf7006a487](https://gist.github.com/manigandham/65543a0bc2bf7006a487)

</comment><comment><USER24> Since you can't tab or you lose focus of the editor box, I am pressing the "add indent" button but to no avail

Edit: Someone beat me to it, but being 2/6 of the early comments shows that they are important!

</comment><comment><USER7> One important thing seems to be missing though: collaborative editing.

(A requirement on the modern web, since you don't want to edit a file only to find out that your version was overwritten by another person who happened to be editing at the same time).

<comment><AUTHOR> Hi,

It can be made collaborative. Depends on how you integrate it in your application.

<comment><USER7> Ok, it was missing in the list of features.</comment></comment></comment>


Anita Sarkeesian, Video Game Critic, Cancels Speech After Threats of Massacre - <AUTHOR> http://www.nytimes.com/2014/10/16/technology/gamergate-women-video-game-threats-anita-sarkeesian.html

<comment><USER2> Main thread: [https://news.ycombinator.com/item?id=8458865](https://news.ycombinator.com/item?id=8458865)

</comment><comment><USER3> At the time I write this, one of two other responses is, "good riddance." How does this make sense to anyone? How can anyone look at this kind of thuggish behavior and celebrate its results? I often disagree with Sarkeesian's critiques, but all of the abuse she has gotten is beyond the pale.

I could understand (though not condone) when there were one or two outspoken women complaining about being harassed were dismissed as provocateurs. That has not been the situation for some time. Would anyone here want to join a community that behaves like this?

<comment><USER4> A bunch of troll accounts were created to comment on this and related threads. We've banned them.

It's good to see that their comments were all downvoted before we got to them.</comment></comment>


Ask HN: Hosting Django: Heroku, Gondor, or myself? - <AUTHOR>

Hi,
I'm a web-developer, I love working with a django stack (django/postgres/south/redis/celery/etc), and I've deployed apps myself on ec2 or hosted on dotcloud.
I'd like to be able to iterate through some product ideas so I'm very price-conscious.  Ideally I don't want to be charged 10x for hosting 10 web-apps, I want to be charged by traffic.  For example if 1 app gets sticky and 9 suck, I shouldn't be charged much more than if I had 1 good app and 1 bad one.
Hosting on EC2 or Linode seems great for this, but I'm actually not super-comfortable with the sysadmin side of things, so I'd prefer to use a Heroku/Gondor or something similar.
Does anyone have any suggestions?
Thanks! <comment><USER2> I experimented with Gondor and Epio(<http://ep.io>) at one point when I wanted to get out of hosting Django projects on my own servers - I can't speak to what it's like on Heroku, but Epio was _significantly_ easier to get up and running with than Gondor was - just about as magical and hassle-free as the first time I tried Heroku with a rails app.</comment>


Coming Soon to Yale: A Class Taught by Harvard - <AUTHOR> http://online.wsj.com/articles/coming-soon-to-yale-a-class-taught-by-harvard-1417746212?tesla=y&mod=djemGreaterNewyork&mg=reno64-wsj

<comment><AUTHOR> CS50 is coming to Yale.

[http://www.thecrimson.com/article/2014/11/9/yale-faculty- app...](http://www.thecrimson.com/article/2014/11/9/yale-faculty-approves- cs50/)</comment>