Ask HN: I finally ditched Windows for Ubuntu - How do I keep things secure? - <AUTHOR> I'm a Python programmer who finally got fed up enough with Windows to take the plunge.
The thing is I'm totally new to Linux, and am pretty paranoid about security (former Win user, remember.) I really feel like I'm flying blind here.
I know the standard, glib line is that you don't have to worry about security once you leave Microsoft, but I have a hard time accepting that. It seems like I should be installing Anti-virus, anti-malware, and firewall software.
Does anyone know of any basic intros to Linux/Ubuntu security, or have any tips?
Thanks in advance. <comment><USER2> This is a pretty good question - mostly because the heart of good security, good airline safety and good surgery is a checklist.

And I don't think I have a checklist thats uptodate, even the one in my head.

ShowHN: using HN as my personal todo list cos I actually look at my threads list daily...

[https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop...](https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks)

<https://help.ubuntu.com/community/Security>

<https://news.ycombinator.com/item?id=4018426>

[http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/fi...](http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html)

<http://www.freebsd.org/doc/handbook/security.html>

That site on secondary GPGkeys I keep failing to find

</comment><comment><USER3> Linux is, unfortunately just as vulnerable to cross-site scripting and other browser-based attacks. The browser is also the biggest vector for Windows, and Linux has no better immunity, unfortunately.

I would recommend using NoScript or eqiv. plugin for your browser.

In my opinion, Windows' biggest security flaw, is teaching users to install software via the browser. But for non-open-source software ecosystems, it's quite difficult to create a white-list of safe programs.

My second recommendation is to, as much as possible, only use software from your repository.

In regards to the other recommendations about firewalls, while definitely not bad advice, if you are behind a NAT router, and on a small, trusted LAN, I wouldn't worry too much about it personally.

</comment><comment><USER4> <https://help.ubuntu.com/community/Security>

</comment><comment><USER5> Start with (as root)

        apt-get install openssh-server
        apt-get install fail2ban
        ufw allow OpenSSH
        ufw enable

I use the following suffix to the /etc/ssh/sshd_config file:

        …
        72	#
        73	# local tweaks
        74	#
        75	Protocol 2
        76	PermitRootLogin no
        77	Banner /etc/ssh/banner
        78	UseDNS yes
        79	MaxStartups 1
        80	LoginGraceTime 15
        81	PubkeyAuthentication yes
        82	PasswordAuthentication no
        83	ChallengeResponseAuthentication no
        84	X11Forwarding yes
        85	AllowTcpForwarding yes
        86	DebianBanner no

        87	Match Address 192.168.0.0/24,127.0.0.1,192.168.1.0/24
        88	PasswordAuthentication yes

Line 82 should be commented out until you have generated an SSH key pair and placed the public key in ~/.ssh/authorized_keys, as it prevents logins using just a password. Lines 87-88 remove this restriction for local nets. Line 77 references a banner that you can provide which is presented upon SSH connection.

fail2ban with its default configuration will essentially just block objectionable SSH traffic. If you decide to extend it, create a /etc/fail2ban/jail.local file to supplement the default /etc/fail2ban/jail.conf file (the former augments the latter).

As others have mentioned, there are a number of resources available. Do not make all suggestions blindly: some are of questionable efficacy and complexity.

ufw will allow precise tuning of iptables. Watch /var/log/ufw.log for entries indicating traffic being dropped, either appropriately or not. Once more services are added (and secured), introduce related rules into ufw one by one. If your system is exposed to the general Internet, be particularly careful with such services' configurations.

The above minimal ufw commands will prevent many commonly used network services on the local network, such as CIFS. Some packages install custom ufw application definitions which can be listed with the ufw app list command (e.g., Postfix, Apache). Such applications usually open the services to all, as opposed to the just the local network.

</comment><comment><USER6> I am not sophisticated enough to critically assess these documents, but here are two sources:

For a basic overview of Linux security: Red Hat Enterprise Linux 6 Security Guide

[https://access.redhat.com/site/documentation/en- US/Red_Hat_E...](https://access.redhat.com/site/documentation/en- US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/)

Here is a blog post by someone who is protecting his laptop, for each security measure he says what and why:

[https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop...](https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks)

HN Discussion:

<https://news.ycombinator.com/item?id=4018426>

</comment><comment><USER7> My 02 cents, you need to worry about security, but it's more like wearing seatbelts on a sunny day. The odds you'll need them are remote, as long as you exercise care and diligence.

When you're running an MS system, I guess the analogy would be you're driving in a demolition derby. It's not 'if' you'll get hit but when ...

\- Turn services off you don't need or use.

\- Delete services you will never use.

\- Firewall with iptables.

\- Setup SSH to disallow login for root. Or turn SSH off if you won't login into it from another host. You can always _start_ SSH again if you need it.

</comment><comment><USER8> Iptables to block most ports. In general you don't have anything to worry about. Malware makers simply aren't targeting linux.

<comment><USER9> Ubuntu also has an 'easy' tool called UFW (uncomplicated firewall?) to configure basic firewall rules and such. It's probably a lot easier to use than Iptables if you just want to make some basic rules.

Unless you're hosting an SSH server or something I don't think there's much to do out of the box for desktop Ubuntu.

</comment></comment><comment><USER10> I found this article to be of some help: [http://www.andrewault.net/2010/05/17/securing-an-ubuntu- serv...](http://www.andrewault.net/2010/05/17/securing-an-ubuntu-server/)

To start, you will just need to set up IPTables and Fail2Ban.

<comment><USER11> That sort of stuff is really only necessary if on your home network you're doing port passthroughs or if this machine is directly connected to the internet with a public IP. For most users behind a router, you don't really need fail2ban and iptables.

<comment><USER12> Caveat: I haven't read the article linked in the GP, yet. (I will.) But the comments here immediately elicit this thought:

How many users have a laptop that they are connecting to one or another undefined (to them) form of "public" wifi? (And/or to someone else's internal network that may be compromised.)</comment></comment></comment>


Show HN: My ML applications book, which HN helped me write (sample chapter) [pdf] - <AUTHOR> https://mlpowered.com/pdf/BMLPA_Chapter_1.pdf <comment><AUTHOR> I recently published my first book! Writing a book has been a personal goal for the longest time, and Hacker News is the main reason I got to do so.

Reading interesting posts on HN daily eventually inspired me to write my own, and posting my own writing to HN showed me there was an audience for the topics I wanted to write about.

I started blogging about Machine Learning in 2017, and posted some of my writing to HN. Many posts did not do well, but some made it to the front page, sometimes even to the top spot (see [https://news.ycombinator.com/item?id=18147710](https://news.ycombinator.com/item?id=18147710) , [https://news.ycombinator.com/item?id=16224346](https://news.ycombinator.com/item?id=16224346) and [https://news.ycombinator.com/item?id=17257143](https://news.ycombinator.com/item?id=17257143)).

As a consequence, my posts ended up getting over half a million reads, which was enough to put me on O'Reilly's radar. They reached out and asked me to write a book for them. I decided to write something that follows the theme of my blog posts, and focus on practical Machine Learning advice that isn't often covered in ML classes. The book took 18 months to write, and is now out. I couldn't have done it without HN.

You can find a longer description of the contents at [https://www.mlpowered.com/book/](https://www.mlpowered.com/book/).

Thank you HN!

<comment><USER2> That's great! I don't believe it's ever occurred to me that a publisher might reach out to a blogger.

One good use for web analytics eh.

I have a text file I've kept for 16 years that contains quotes from many sources and some of my own musings. I dream to one day use it to inspire myself to spout something.

<comment><USER3> Perhaps publish it on Github? Maybe someone will find a gem in there.

I have some musings [1] on Github too. Thoughts that I want to get out there but are too incoherent to become blog posts ...

[1] [https://github.com/Rainymood/musings](https://github.com/Rainymood/musings)

<comment><USER4> Great riddles.

</comment></comment></comment></comment><comment><USER5> Congrats on writing the book! As I'm a student of GeorgiaTech, I have access to Oreilly's Safari. I just found the book over there and am looking forward to reading it.

<comment><USER6> GATech student here! I've added it to my playlist, I've got a couple more shiny reads if you want to check it out.

[https://learning.oreilly.com/playlists/0c80dca0-2137-4cae-98...](https://learning.oreilly.com/playlists/0c80dca0-2137-4cae-9877-8ad215e3e582)

<comment><USER7> Another GATech student here. I'm taking the ML class this semester... thanks for this!

</comment></comment></comment><comment><USER8> First of all, congratulation for finishing your book!

I've read the TOC and looks really interesting. Is the content accessible for your average software engineer who never touched ML in his career? (like me)

<comment><AUTHOR> It should be! The book mostly focuses on how to apply ML in practical concepts, and less about the internal workings of ML methods.

I tried to explain the vast majority of ML concepts that I mention in the book. If you'd like to dive deeper into ML theory, I have a list of recommended books in the preface (included in the PDF preview).

</comment></comment><comment><USER9> Congratulations to the release.

I am a little bit skeptic about your running example, the "ML Editor". A model that helps you asking "good" questions, e.g. on StackOverflow.

Isn't that like an extremely complicated problem, I would even say AI hard? How do you want to evaluate if a question is "good" (and sure thing, it's _not_ the number of upvotes it gets)? Is there a working example of such an editor in action, because I highly doubt that this is currently possible.

<comment><USER10> Didn't read the book yet, but from your description absolutely agree on the trickiness of the problem - it almost requires solving the "proper artificial intelligence" problem first, like you say.

However, I imagine it could be applied to refine an existing question? There certainly exist "obviously poor" questions on SO, and it's a good first step to make otherwise poor question "look" like a good question - trivial things like formatting and misuse of the language. It won't get other, high-level attributes of a genuinely good question however, but some poor questions are poor in just that - formatting and language, the "requires editing" queue.

Regarding "intrinsically poor" questions, on the other hand, if everyone used the described model, readers would now have an increased cognitive load to distinguish between good and poor questions. Over time, the described model would drop in performance, as the "typical good question attributes" are used in poor questions which wouldn't have those otherwise.

(Forgive me for trivialising the concept of the quality of a question)

It's still a very interesting problem for a book. It's just as suitable for demonstrating the model development process, and it's likely very relevant to the vast majority of the readers (I imagine).

<comment><AUTHOR> Yes, this is the approach in the book. The concept of question quality is nuanced, and does not have a clear definition. It can be easy to feel like you've solved the problem by just throwing in ML and calling it a day, but producing something useful is a real challenge.

The book covers multiple aspect of that process, from choosing an ML approach that isn't too simple or ambitious, to iterating on a model within the context of its final use case (i.e rather than only optimizing for a metric, testing how the model helps with its end goal).

In my experience, I've found that it is often those challenges that make or break the quality of an ML product, so the book focuses on tools to make complex problems more tractable, and less risky.

</comment></comment></comment><comment><USER11> For what I've been reading recently, there will be some big consolidation in the sector this decade, with a handful of industries faring much better than others because of diminished return on investments, incoming regulations and marginal tech improvements?

</comment><comment><USER12> I found installing everything to get up and running with this to be effectively impossible; I think using tensorflow 1.15(and therefore requiring everyone to download Python <= 3.6) to have been a mistake. I've tried quite hard to get the environment running but eventually it always fails. A shame, this looked quite interesting.

<comment><AUTHOR> Sorry to hear that! Has tensorflow been your main issue? It is only used in one of the example notebooks, so you can skip that requirement without too much of an impact.

If I can help with troubleshooting, send me an email at firstname.lastname@example.com

In the meantime I'll bump up the version in requirements.txt to solve the conflict.

<comment><USER12> Yes, it has - I didn't have any other problems, but I did notice you recommending the usage of `pip install -r requirements.txt`. I am by no means an expert in Python, but it is my understanding that using pip this way isn't recommended and you should instead invoke `python -m install -r requirements.txt` where python could be python36, python38, or just python. The same with virtualenv, `python -m venv ml_editor` appears to be the new way of doing this.

<comment><AUTHOR> Interesting. I wasn't aware of that issue. It seems like after running activate, `pip` does point to the right location (`which pip` points to the virtualenv pip), but I'll look into it.

<comment><USER12> Unfortunately the changes you did didn't improve my problem, pip insisted again that a correct tensorflow version wasn't available. I was, however, able to download tb-nightly so I do at least have a version. Quite shocked tensorflow thrashes so intensely on installation - is that normal?

<comment><AUTHOR> I'm glad you have found a workaround. Again, this is for an example script outside of the main narrative of the book, so the impact should be minimal.

If pip struggles to find a specific version, I'll usually remove the specific version requirement, and give whichever version pip finds a try by running `pip install tensorflow`

</comment></comment></comment></comment></comment></comment><comment><USER13> Congratulations on sticking with it and getting it done!

I am going to purchase the book because I have never done any ML and I started working at a company that I think may benefit from applying ML to some of its products. I hope to use the book as a starting point for diving deeper into specifics of ML.

Does it matter to you where the book is purchased?

<comment><AUTHOR> Not at all, choose whichever platform and medium will give you the best reading experience.

I hope you find the book helpful, please reach out if you have any questions or feedback.

</comment></comment><comment><USER6> Congratulations!

Do you have a slack or some other place to group together readers of this book to discuss? I'd love to poke other readers' (and yours) brains as I go through this.

<comment><AUTHOR> I do not have a slack room, but that does sound like a good idea.

For now I do have an email address provided for any questions in the book, and am reachable on Twitter (mlpowered) and GitHub.

</comment></comment><comment><USER14> I read this book on the O'Reilly website using their trial period and have also pre-ordered a physical copy. It is excellent and I recommend it to anyone into practical ML.

<comment><AUTHOR> I'm so glad to hear you have been enjoying it!

<comment><USER14> I am glad you wrote it! ;)

</comment></comment></comment><comment><USER15> Looks great, I think I will pick this up. Can I ask a strange question, what font is used for the text in the book? It's very pleasant to look at!

<comment><AUTHOR> That's a great question, and I'm not sure. Googling around led me to an HN thread where a commenter claims that it is TheSans (lucasfonts.com/fonts/the- sans) but I do not have a good enough eye to confirm!</comment></comment>


Ask HN: What resources do you use when trying to explain security topics? - <AUTHOR> For example, whenever I need to explain the problems with failing-open, I use the Wikipedia article on the Three-Mile Island accident.<p>There, a valve failed-open and vented necessary coolant. It's not exactly the same scenario, but it gets the point across. <comment><USER2> There's a lot of different types of security topics. I love quoting Kevin Mitnick's books on social engineering.</comment>


Dokkodo by Miyamoto Musashi  - <AUTHOR> http://www.stepanp.com/?p=372 <comment><USER2> An interesting story about Musashi, and what may have influenced some of what he wrote prior to his death, was his encounter with the monk Takuan. Musashi saw a snake approaching the monk in mediation, and witnessed the snake simply crawl over Takuan without any fear. But as the snake approached Musashi, it recoiled to strike, then ran away. Musashi was grieved because he felt that what he had cultivated was lacking -- he had developed his fighting skill so much that nothing would approach him. In contrast, Takuan demonstrated a deep peacefulness and naturalness that led to all, even a snake, accepting him.

As to how much of this is legendary or not, I'm not certain, but it's something to contemplate.

<comment><USER2> Oops, that should be meditation, not mediation!

</comment></comment><comment><USER3> When I worked as a dating coach, one of the most common mental tics we had to work to get out of students was an obsession about being "in the right".

This manifested in all sorts of ways that would totally kill social interactions: correcting a girl on some factual detail in some story she was telling; saying hateful things to girls to "reject them first" at the first sense that she might not be totally interested; not being willing to take chances in social interactions; a complete unwillingness to touch girls, ever, for any reason; and most importantly, an inability to HAVE FUN.

The above is fact; my conjecture about /why/ (which possibly isn't) was that often these guys had been battered about mentally and socially by people, and their mental refuge for their self image was the "correctness high-ground".

Anyway:

\- If you want to live a life full of "being right" and not having much fun, these rules look excellent.

\- If you are unable to discern between eating great food from time to time and total all-out gluttony, if you follow these rules you will avoid gluttony. The same applies to most of the others (avoid pleasure for pleasure's sake?! Get a grip)

\- If you get a geek boner at the idea of being a samurai, print these out and put these above your bed

There are many, many great spiritual books encapsulating the small amount of good advice in this list, but really the above is a recipe for navel-gazing piety.

Going to excesses of gluttony or austerity are for the mentally weak, rather than winning life philosophies.

<comment><AUTHOR> Take don't seek pleasure for pleasure's sake.

Which guy do you think does better with women:

The one that goes up to a girl looking for sex?

Or the one who is confident in himself, and goes up to the girl for the experience of it, to make friends, and depending on if the girl is cool or not, pursue something deeper?

\</comment></comment><comment></comment><comment>-

I'm not sure how any of these principles prevent you from being an awesome confident guy that gets women.

Maybe these rules that you're talking about are just made by guys to prevent themselves from doing what they're scared of.

But, don't these principles suggest to do exactly what you're scared of?

<comment><USER3> Please understand that I am answering this from experience - four years working as a full-time dating coach - rather than as what "should happen":

The answer is the first, and also, the second guy is kidding himself.

If you want to be an awesome confident guy that gets women, be an awesome confident guy that gets women. If you're seeking to define yourself by Living Like A Samurai, you have a weak model of self, and need to learn that life happens in shades of grey, rather than in absolutes.

<comment><AUTHOR> I think I get where you're coming from. A lot of this can be interpreted as a way to shun yourself from the world and not face reality. But can't anyone do that with anything helpful?

I lived in Colombia for a while, and partied a lot. Met tons of girls, along with guys who tried using what a lot of dating coaches teach, but it only restricted them...they defined themeselves absolutely by what they did.

Then again I met a ton of guys who used what a lot of dating coaches teach to be awesome confident guys that get women.

Maybe it all comes down to striving to be awesome confident guys, and defining yourself by anything--especially in absolutes--goes against that. That's why anyone that says they're a samurai, or a pick up artist, might not go very far.

Hence the idea that philosophy or dating lessons are not at fault, it's the people who interpret them.

<comment><USER3> > A lot of this can be interpreted as a way to shun yourself from the world > and not face reality. But can't anyone do that with anything helpful?

There are lots of texts on rising above worldly pleasures, and some are very good. I'm a particular fan of Ekhart Tolle's work, and I enjoyed the Tibetan Book of Living and Dying... The Tao of Pooh, and the Te of Piglet got me through a difficult adolescence.

As with any idea, though, simplifying it too far tends to lose important subtleties. The mental austerity mentioned in the original post is likely to strike a resonant chord with many men who wished they had better self-control, and who wished they were acting with more general agency in their life. Men are complete suckers for certain ideals of manhood, certain archetypes that are well presented. If this is something that interests you, I can strongly recommend the books Iron John by Robert Bly, King Warrior Magician Lover by Robert Moore, and the excellent Way of The Superior Man by David Deida.

I find this quote by Alan Watts particularly poignant, and perhaps an antidote to the original post:

"We thought of life by analogy with a journey, a pilgrimage, which had a serious purpose at the end and the thing was to get to that end, success or whatever it is, maybe heaven after you're dead. But we missed the point the whole way along. It was a musical thing and you were supposed to sing or to dance while the music was being played." (<https://www.youtube.com/watch?v=ERbvKrH-GC4>)

</comment></comment></comment></comment><comment><USER4> I've never been sure whether I'm someone who genuinely takes something from these things or whether I just like the idea that I might be able to. The only passage I have really ever had stick with me is from the Hagakure and I've felt applies nicely to how I see efficient dev:

 _Among the maxims on Lord Naoshige's wall there was this one: ''Matters of' great concern should be treated lightly.'' Master lttei commented, "Matters of small concern should be treated seriously." Among one's affairs there should not be more than two or three matters of what one could call great concern. If these are deliberated upon during ordinary times, they can be understood. Thinking about things previously and then handling them lightly when the time comes is what this is all about. To face an event anew solve it lightly is difficult if you are not resolved beforehand, and there will always be uncertainty in hitting your mark. However, if the foundation is laid previously, you can think of the saying, "Matters of great concern should be treated lightly," as your own basis for action._

tl;dr You should be prepared for issues that are of great significance so that the actual decision process becomes easy. It is the small issues that arise day to day that you should put great attention to.

</comment><comment><USER5> > For anyone that's striking out, or wants to make change, I think his life > holds a lot of lessons. Eji Yoshikawa's "Musashi" might be the best start > for you, if you want to read one Japan's classical novels, and get a bunch > of resolve.

Alternatively, anyone looking for something easier to digest should check out _Vagabond_ , an award-winning manga by Inoue Takehito that chronicles Musashi's life.

<comment><USER6> The problem with Vagabond is that it's not finished. I read Musashi after reading Vagabond because I didn't want to wait for the chapters anymore. Both are great and you should know there are mayor differences specially in Sasaki Kojirō character.

[http://en.wikipedia.org/wiki/Vagabond_(manga)#Differences_wi...](http://en.wikipedia.org/wiki/Vagabond_\(manga\)#Differences_with_the_novel)

</comment></comment><comment><USER7> <http://en.wikipedia.org/wiki/Dokk%C5%8Dd%C5%8D>

</comment><comment><USER8> What Miyamoto Musashi seems to be the fluffy inspirational type, rather than a serious reflection on how to achieve things.

<comment><USER9> Given musashi's unparalleled swordsmanship, fluffy seems like a poor description. His life was a very direct reflection of his philosophy.

<comment><USER8> I meant what he wrote seems fluffy.</comment></comment></comment>


What the Hell Is a Deno? - <AUTHOR> https://breadth.substack.com/p/what-the-hell-is-a-deno <comment><USER2> > Javascript is great. But... in saying that it has a few quirks and can work > in some unexpected ways.

Typescript has just as many[1] (in fact more, as it's a superset) quirks than Javascript. I like using it (and it makes JS type-safe-ish), but it's not really some kind of paradigm shift.

Not sure how I feel about import maps. They are quite literally the same thing as package.json. In fact, converting between the two takes about 20 lines of code[2]. I'd bet my bottom dollar that everyone's going to use them, which is going to lead to exactly the same types of problems as Node.

[1] [https://blog.asana.com/2020/01/typescript- quirks/](https://blog.asana.com/2020/01/typescript-quirks/)

[2] [https://github.com/WICG/import- maps/issues/60](https://github.com/WICG/import-maps/issues/60)

<comment> torb-xyz Frankly I find TypeScript with strict mode turned on to be a safer and saner than C# and Java because of explicitly nullable types alone. I _never_ get null pointer exceptions in my own TypeScript code. Combined with fairly strict ESLint you get something that catches a lot of problems at compile time.

Of course it's still far cry from being as safe as for example Rust.

And yeah the inconsistency of JavaScript/TypeScript can be frustrating for sure. I think my dream language is one that is simply TypeScript cleaned up to be made consistent and sheds a lot the features and retains a simple core.

<comment><USER3> C# 8 has support for non nullable references.

For lower C# versions and Java you can get your strict mode turned on via static analysis tools.

I have been using Sonar on CI/CD builds since 2008. Static analysis errors break the build, plain and simple.

Also quite convenient for writing sane C and C++ code by the way.

</comment></comment></comment><comment><USER4> For me this is a case of "too little, too late". I've been burned too much over the years by the Node ecosystem to risk investing any further interest in it now, even if it has marginally improved.

I have worked extensively with Typescript, which I consider to be the minimum viable solution within the Node ecosystem. Typescript shouldn't even be seen as a 'nice-to-have. It should be seen as a required remedy for some of the mistakes of a terribly engineered language. Javascript should never have been considered a serious language for back-end development. Node.js to me seems like someone's 'Frankenstein's monster'-esque experiment that escaped its captivity and wreaked wide-scale havoc on the surrounding world.

<comment><USER5> This doesn't make sense to me.

Javascript is a breath of fresh air after writing async code in almost every other ecosystem from Go to Java to Python to Swift. Pretty much any async code snippet in those languages can be improved by porting it to Javascript.

Async/await + the ubiquitous Promise make it my go-to choice for writing anything networked. Especially over the other popular dynamically typed languages.

<comment><USER6> If you think async/await is the holy grail of networking, you're up for a surprise in the next few years.

The problem with async/await: [http://journal.stuffwithstuff.com/2015/02/01/what-color- is-y...](http://journal.stuffwithstuff.com/2015/02/01/what-color-is-your- function/)

A solution proposed by none other than Java (available as an experimental feature in JDK 15): [http://cr.openjdk.java.net/~rpressler/loom/loom/sol1_part1.h...](http://cr.openjdk.java.net/~rpressler/loom/loom/sol1_part1.html)

This seems to me to obsolete async/await, quite honestly.

<comment><USER5> Don't fall into the trap of thinking that just because you've found a blog post that could enumerate the downsides of something that the alternatives don't have the same trade-offs.

I've responded to that ancient blog post many times on HN by now. Since you must think that blog post is pretty good criticism of async/await, here's a little challenge for you: which language do you think doesn't have an equivalent of the "red vs blue" problem? :)

<comment><USER6> > Don't fall into the trap of thinking that just because you've found a blog > post that could enumerate the downsides of something that the alternatives > don't have the same trade-offs.

I've been using async/await for a long time and I thought it was great, but since I started using JDK15 virtual Threads, I feel like it's way superior in every way. If you have some trade offs you would like to mention, please do.

> which language do you think doesn't have an equivalent of the "red vs blue" > problem?

Any language that distinguishes between async and non-async functions will have this problem. I believe one language that works around that is Erlang, as Erlang seems to do everything async (but it's not visible to users, but I am not sure). The proposed Java virtual Threads solve that problem as well. You should open your mind to new ways of doing things, this is by no way a solved problem as you so strongly seem to believe.

</comment></comment></comment></comment></comment><comment><USER7> I like the concept of Deno, and especially love the shift away from NPM. NPM was probably the main reason I never fully embraced node.js. I truly hated the bloat of the modules folder, and the impending fragility the dependencies would bring.

I like the idea of a standard library. This will hopefully only improve with time. It sort of brings the ease of use factor of PHP to a server side JavaScript environment.

I'll be watching Deno very closely these next few months!

<comment><USER8> The set of core libraries like express (fka connect) + dependencies _is_ the stdlib. It was developed in early node.js days as part of CommonJS, which was an initiative for a portable/modular server-side JavaScript runtime with many implementations besides node.js (RingoJS, Narwhal, Helma, TeaJs/v8cgi). The existence of a community-driven lib effort, the portable nature of JavaScript, and the existence of choice was the entire reason I even looked into node.js.

<comment><USER9> Other languages had all that, plus a better standard library, plus a type system, for years before Node was a thing.

Node got popular because it enabled frontend devs that only knew JavaScript to move easily to backend, not any technical reason.

</comment></comment></comment><comment><USER10> I am the author of Pogo, a web server framework for Deno that has friendly APIs and is secure by default. It supports React out of the box and has the best documentation of all the frameworks.

GitHub: [https://github.com/sholladay/pogo](https://github.com/sholladay/pogo)

Video tutorial: [https://www.youtube.com/watch?v=Fe4XdAiqaxI](https://www.youtube.com/watch?v=Fe4XdAiqaxI)

<comment><USER11> > _" and is secure by default"_

Extraordinary claims require extraordinary evidence.

<comment><USER10> I think you misunderstood me. I simply meant that the default configuration optimizes for security. For example, Deno and other frameworks listen on `0.0.0.0` by default, which is convenient for development but is not worth the security concerns, in my opinion. Instead, Pogo uses `localhost` unless you explicitly override that setting, meaning much less risk of accidentally exposing your server publicly. This is not some revolutionary feature, it's just attention to detail that I think you'll notice cumulatively.

Additionally, I would like to pay for a thorough security review when we have more features and users. I doubt any of the other frameworks will do that as it's extremely rare in OSS. Of course, that means very little until it actually happens. But know that my intention is to deliver the first Deno framework that I would personally feel comfortable using in production.

</comment></comment></comment><comment><USER12> Deno's sandbox security is somewhat similar to Mandatory Access Control (MAC) implemented by SELinux and AppArmor. But it looks like not as fine-grained as MAC. In the example:

deno run --allow-net myWebserver.ts

With SELinux, one can specify the port range and network interface that the application is allowed to access. It also provides audit log that can be examined by the admin. Maybe there is no need to reinvent the wheel but just use some form of MAC if you really care about security.

<comment><USER13> Am I wrong in thinking that this example specifically does _not_ protect against the threat posed immediately preceding it? As in, one is running a script that foolishly imports a nefarious package that uploads tasty environmental variables to an evil server, which it can do when network access is not controlled. Well, what if myWebserver.ts imports that package? A more fine-grained approach that limited network access by source file might be valuable.

<comment><USER14> > A more fine-grained approach that limited network access by source file > might be valuable.

This is what I think I'd like to see as well. The most common case isn't that I don't trust the _program_ I'm running, it's that the level of trust for my dependencies plus their dependencies is essentially opaque.

</comment></comment></comment><comment><USER15> Deno definitely looks interesting!

All the examples I've seen so far are using the 'deno' command to run .ts or .js scripts. Can it also package standalone binaries like go/rust—-to make a cli tool, for instance? If so, how do permissions work in that scenario? Does the user need to grant permissions on every invocation or is there some way to whitelist a script/binary?

<comment><USER16> Packaging to standalone executable is being worked on [https://github.com/denoland/deno/issues/986](https://github.com/denoland/deno/issues/986)

<comment><USER15> Nice! Will be interesting to see how permissions work in that case.

</comment></comment></comment><comment><USER17> My gripe with npm was the lack of a lock file.

\- Yarn helped solve that, but because of its backwards compatibility to node_modules, you could not have different versions sitting side-by-side.

\- Node_modules could have a different version installed vs lock file and no one would know without looking.

It seems Deno is able to solve the side-by-side versions and distributing the 'lock' to the file itself. The Deno team is trying to create a 'map' file to consolidate the 'distributed version' issue.

Sadly, Ruby's Bundler has solved this for years and while I love TypeScript, I'm always saddened by the state of package management in the Node space.

I'm not saying Bundler perfect, but its basis with canonical lock and ability to have side-by-side versions allows me not to think about that issue.

<comment><USER18> > \- Yarn helped solve that, but because of its backwards compatibility to > node_modules, you could not have different versions sitting side-by-side.

> \- Node_modules could have a different version installed vs lock file and no > one would know without looking.

> Sadly, Ruby's Bundler has solved this for years [...]

I don't understand your first point. Different projects can use different versions since the modules are installed locally (inside the `node_modules` directory). And nested modules can also have different dependency versions, e.g.:

        A
        => depends on B @ 1.0
        => depends on C, and C can depend on B @ 2.0

Regarding your second point, I haven't ever seen that happen in practice and IIUC it's mostly a property of the the fact that `require 'bundler/setup'` checks your dependency versions, and you could implement something similar for JS (e.g. traverse node_modules directories recursively checking if the versions declared in the package.json of dependencies match the ones in your root lockfile).

Since we're on the topic of Ruby and JS, Ruby's module system is probably one of the worst I've ever seen and JS one of the best.

In Ruby, just like in Python, everything in a file is public by default and the only way to make things private, AFAIK, is using Module#private_constant, and that only works for methods/inner classes/things in a class scope.

And, unlike Python's import, require is side-effectful! If you have file a.rb that requires b.rb, and b.rb requires c.rb, everything in c.rb will be visible in a.rb. This is terrible.

JS's module system is one of the best IMO (better than haskell, python, java, etc):

\- simple mental model: a file is a module

\- everything in a module is private by default, you have to explicitly mark things with `export` to make them public

\- You can either qualify imports or explicitly import individual functions, so it's always possible to find out where something is defined by simply looking at a file. Most languages fail here. This is useful for beginners and in places where you don't have an IDE available, like GitHub

<comment><USER17> > Different projects can use different versions since the modules are > installed locally (inside the `node_modules` directory)

I'm speaking about within the same project. It's not hard to have problems over time when node upgrades (for example[0]) or to get a different version than expected.

Any project that's lived long enough runs into some sort of version mis-match where the solution is `rm -rf node_modules`.

Deleting and reinstalling the package folder as a regular fix is symptomatic of a deeper package issue.

Deno solves parts of this by giving module versions their own explicit folder. I'm concerned if it still stores the package locally that you can still run into a deno version mismatch.

.rbenv + Bundler's folder structure has been `.rbenv/versions/2.6.5/lib/ruby/gems/2.6.0/gems/mime-types-3.3`

The version of ruby and the version of the gem are explicit allowing separation.

Again, far from perfect, but this keeps out so many problems.

> Since we're on the topic of Ruby and JS, Ruby's module system is probably > one of the worst I've ever seen and JS one of the best.

This thread is about package management. While fair criticism, it's too sideways.

[0] [https://stackoverflow.com/questions/46384591/node-was- compil...](https://stackoverflow.com/questions/46384591/node-was-compiled- against-a-different-node-js-version-using-node-module-versio)

<comment><USER18> Your original point was:

> you could not have different versions sitting side-by-side.

bundler can't do that either. You can't depend on both rails 5 and rails 6 in a single package. Most languages can't do that.

> Any project that's lived long enough runs into some sort of version mis- > match where the solution is `rm -rf node_modules`.

I agree, but that's not the only solution, as I've said you could write something similar to require "bundler/setup" in JS that does version checking.

> The version of ruby and the version of the gem are explicit allowing > separation.

You can specify the node version in your package.json.

EDIT: on the version checking point, I agree that this is a deficiency of npm. It probably should ship something similar to bundler/setup by default and encourage users to do

       require('npm/validatePackageVersions') # or import 'npm/...' in es6

in their top level code.

I was just pointing out that this is not a fundamental limitation of npm, and it should be fairly easy to implement in user-level code

<comment><USER17> > bundler can't do that either. You can't depend on both rails 5 and rails 6 > in a single package. Most languages can't do that.

You're right. Originally I was speaking about package versions which deno does solve, but then I brought in node versions w/o explicitly stating so.

That's managed/wrapped at rbenv's level which I hope deno can come up with a way to solve it. But looking at deno briefly, it appears the packages are still stored locally which leaves the deno version mismatch a possibility still.

</comment></comment></comment></comment></comment><comment><USER19> I assume that permissions are given at application level, not at module/import level?

This means that if I write an application that requires filesystem access and has external dependencies, I'm essentially giving them access to the filesystem even if they don't need it.

These dependencies could silently check whether they have permissions and do something fishy only if that is the case.

It would be nice to be able to import dependencies in a nested sandbox but I guess it is not a simple problem.

<comment><USER20> I haven't looked into it, but TFA suggests you can do it call by call.

<comment><USER19> Well I'm not sure. The doc says:

 _Access to security sensitive areas or functions requires the use of permissions to be granted to a deno process on the command line._ [1]

The only other mention of permissions in documentation is that a program may query or revoke permissions.

[1] [https://deno.land/manual/getting_started/permissions](https://deno.land/manual/getting_started/permissions) [2] [https://deno.land/manual/examples/permissions](https://deno.land/manual/examples/permissions)

EDIT: formatting

</comment></comment></comment><comment><USER21> Deno is on my list of tools to play with. It's sandboxing capabilities are the main selling point for me because it will allow executing semi-trusted/un- trusted code on private data sets. If I know that the code can't access the network or do anything fancy with the file system then I can treat the untrusted code as a pure function and know that the output will only depend on the input. This is a very desirable property and I'm looking forward to the type of code and data sharing it will enable.

<comment><USER9> Sandboxing has been possible for many years before Deno. Running untrusted code is not popular for good reasons.

<comment><USER21> I'm aware but Deno allows more programmers to take advantage of those capabilities in a way that will make sense to them which will lead to more and better applications. I think every programmer intuitively understands what network and filesystem access means. Deno has made sandboxing much more approachable and since those capabilities are front and center instead of some hidden feature more people will take advantage of them to structure their applications.

</comment></comment></comment><comment><USER22> The example on permission isn't great. It said the library you used cannot access your database password from env and send it over the internet unless you allow so.

When you're putting database password in the env, most likely you need to permit env var and network access for your database client library. Then at the same time, the library in example can do that malicious thing.

The problem here is, deno request the permission per process, not per library import

<comment><USER23> One thing you can do is explicitly _revoke_ permissions. This allows you to start the program with more permissions and then give them up as the tasks that required them are done, e.g. allowing environment variable access at the beginning and then revoking it before you start a server: [https://deno.land/manual/examples/permissions](https://deno.land/manual/examples/permissions)

It's not as fine-grained as allowing libraries specific permissions, but it gets you part of the way there.

</comment></comment><comment><USER24> > Both the browser and node.js use the same engine - the V8 engine.

RIP every other engine, I guess?

<comment><USER25> > RIP every other engine, I guess?

In practice, pretty much :(

<comment><USER26> React Native uses JavaScriptCore, the JS engine for WebKit, at runtime.

<comment><USER27> Only on iOS right? Or is it embedded everywhere?

<comment><USER28> Embedded in IOS & OSX, but one of the few that's easy to get a build of (or compile) in Linux, Windows, Android

Chakra also easily builds on osx, ios, embedded in windows.

V8 is a PITA to build & get a build of. (Wish it wasn't)

</comment></comment></comment></comment></comment><comment><USER29> do permissions in deno propagate to all dependencies recursively? like, if i grant filesystem access to a top-level script, did all its imports just inherit that permission, too?

if so, i can see this type of system being mostly worthless.

<comment><USER30> Yes... it would actually be quiet amazing to have different libraries in different sandboxes with defined communication channels.

The browser actually does something quite a bit like this with iframes. Iframes are sandboxed and can only communicate through postMessage. There's more to it but at a simple level it looks like this.

Chrome nowadays even runs iframes in a separate process! Finally... [https://www.chromium.org/developers/design-documents/oop- ifr...](https://www.chromium.org/developers/design-documents/oop-iframes)

This is actually quite impressive because it presents a decent illusion to JS that all frames are running under the same thread.

<comment><USER21> You could implement this by fine grained imports and subprocess execution. Node.js actually has a very nice sub-process communication API: [https://nodejs.org/api/child_process.html#child_process_subp...](https://nodejs.org/api/child_process.html#child_process_subprocess_channel).

At some point I remember writing some gpg wrappers with Node.js and I remember the subprocess API being one of the more pleasant ones to work with. In the case of more stringent Deno process sandboxing, the parent process would spawn another Deno process with a smaller set of capabilities.

<comment><USER31> Deno uses the web standard Worker API to implement sub processes. They are also working on fine-grained permissions for these workers [1].

[1] [https://github.com/denoland/deno/issues/4867](https://github.com/denoland/deno/issues/4867)

<comment><USER21> Good to know and even better than my proposed solution then. If the language supports it directly then there is no need to write sub-process shims for managing permissions.

</comment></comment></comment></comment></comment><comment><USER32> Some random comments: \- good to see native TS support

\- Would be nice to see a builtin maven/gradle-like standard build system, which IMHO not having it in node.js was a major let down for me. Sure, you have gulp/grunt, but having to write repetitive code (which can be buggy!) for running a compiler/test/packager? With another set of plugins? just give me some standard tool and let me call the equivalent of "mvn package", which will compile/test/package my application with sane defaults.

\- the dependencies-as-URL is going to be hit hard as soon as some big fish corporation wants to use Deno for some in-house projects. What if those corps disallow calling [https://deno.land/my/dep](https://deno.land/my/dep) and pretend to use internal repo? now all 3rd party dependencies won't work unless manually modified to use the internal corp repo.

\- I predict that the --allow-this --allow-that will evolve in a SecurityManager-like complexity, that only the early enthusiasts will understand, and the rest will simply put the equivalent of "\--allow-all" and let the ops deal with security issues

<comment> 0-O-0 Build systems are generally required for frontend code and that's a bit out of scope for a project like this. Even if it wasn't - frontend landscape is wild and everchanging - arriving at sensible, useful defaults would be very hard.

</comment></comment><comment><USER33> Node with a hat and fake moustache.

</comment><comment><USER34> One point that was not mentioned: Deno is distributed as a single binary. Combined with the security options, I think it's a great feature for small scripts in an enterprise context.

</comment><comment><USER35> The security stuff for NodeJS is really frustrating. If anything, NodeJS is more secure than something like the JVM or C++. If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In fact, in Node, I can actually read the source code and see what the package is, running is doing. In nearly every other environment, you may simply have access to a binary, with maybe some interface info.

So why do people not throw the same kind of fit about nearly every other programming environment as they do for Node/NPM? And frankly why do those other environemnts not have the ridiculous security breaches we have seen in Node/NPM land?

The real problem with Node/NPM i suspect is a lack of a standard library. Simply having a standard library would have greatly reduced dependency and package hell. Further, a standard library would mean people would be more willing to write a little more code rather than include a new dependency.

<comment><USER9> Because in those languages:

. dependencies are carefully considered by users

. dependencies are not added recursively

. dependencies try to be dependency-free themselves to assist with the previous point

. dependencies are not blindly nor automatically updated

. dependencies solve important domain problems, they are not trivial one-line- functions

. dependencies are typically developed and tested by a known team or company, which you trust, not just someone random

. binaries can be signed

. support contracts are a thing

. etc etc etc...

<comment><USER36> This is 100% true especially stupid libraries that are someone's class project. And JavaScript developers are so used to dependency hell that one of my developer imported 3rd party package for date formatting.

<comment><USER37> JS's built in date formatting/handling is terrible and often do what needs to be one.

MomentJS may be a giant import, but it _works_ an it works really well.

<comment><USER38> It's the closest thing we have to a useful standard library. Date handling in js without a library is a code smell.

<comment><USER36> I am confused, are you using MomentJS for fancy output like 3 days ago etc or for simple output like 5/31/2020? I can see how it is useful in former case but seems overkill in later case.

<comment><USER39> Safari is lacking in support (again) but we have `Intl.RelativeTimeFormat`[1]

        new Intl.RelativeTimeFormat("default").format(-3, "day")

1: [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/Intl/RelativeTimeFormat/RelativeTimeFormat)

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> Deno is the Java-fication of JS. I'm sure there will be Node-like tide of "JS is better than Java now that we have X" even though Deno brings JS closer than ever to Java. Despite being cynical, I don't think its a bad thing. Java does a lot of things right.

Deno -> Java

Runtime security options -> Security Manager.

URL based packages with simple HTTP-> Maven works same way.

Bigger standard library -> Java's is huge.

Types -> Java, yes.

Single executable -> Fatjars.

All the features mentioned in this article have been in Java over a decade. Its relieving to see a JS runtime that finally gives in to enterprise niceties. Us Java devs like to crap on JS for reasons besides being "boomers". The features Deno brings were all real reasons to use Java instead of JS up until this point.

Now if they would only fix threading, I would consider Deno/JS a real contender for backend dev

<comment><USER41> Funny, I thought it was the Go-fication of JavaScript. Look at the 'contributing' section of their stdlib: "deno_std is a loose port of Go's standard library. When in doubt, simply port Go's source code, documentation, and tests. There are many times when the nature of JavaScript, TypeScript, or Deno itself justifies diverging from Go, but if possible we want to leverage the energy that went into building Go. We generally welcome direct ports of Go's code."

<comment><USER40> For Deno this seems like a very good choice. Pick the good parts from Go and reuse them. I applaud Deno for going its own way with the module system though... That's been a hot topic in Go for a very long time

</comment></comment></comment><comment><USER42> I love how Browsers & Deno have shown how we can do dependency management using urls containing code (ESM). This is a huge step forward.

This makes me think, is file-based code-split strategy enough?

What if we'd put code (not data) behind GraphQL and request only the actual piece of code we need to use?

import { foo } from '[https://graphql/](https://graphql/){ give: { me: { foo }}}'

<comment><USER6> Just `import { foo } from '[https://graphql/'`](https://graphql/'`) is enough for that.

</comment></comment><comment><USER43> I'm interested to read the content but find the writing style and the visual layout make it difficult.

</comment><comment><USER44> Node => Deno => Done.

One can simply say, 'Deno is like Node but done right'.

<comment><USER45> Deno : Node :: Deltarune : Undertale

<comment><USER46> * This comment fills you with determination.

</comment></comment></comment><comment><USER47> Is the goal to have this also work for electron executables?

</comment><comment><USER48> > This site requires JavaScript to run correctly. Please turn on JavaScript or > unblock scripts

FYI, I read the whole article without JS fine, thanks for making the site work without it even if it says it doesn't.

</comment><comment><USER49> The author already inflicted one of the worst "worse is better" victories I can think of in the history of computing.

Now he's fighting his own monstrosity.

<comment><AUTHOR> Author of the artcile (me) or Author of Deno?

<comment><USER50> I think he means Ryan Dahl

Anecdotally, there are several languages (French, "Argentinian" Spanish to name a couple) where it's common to re arrange the syllables of the words backward-ish (More often than not for slang - argot for France, lunfardo in Argentina - uses).

<comment><USER51> What do you mean by your last sentence? The sentence makes complete sense and is not backwards translated to spanish

<comment><USER50> Hey sorry if that was not easy to understand, I was referring to the name of the thing. "Deno" is the same as "Node" with the syllables arranged backwards.

</comment></comment></comment></comment></comment><comment><USER52> This comment is a meta-critique on the blog itself. I've noticed a recent trend arising on the web of applying a text shadow to code to make it seem like it's glowing. I don't know where people started thinking this was a good idea but I hope it doesn't gain too much traction. When I saw it in this blog, I blinked and rubbed my eyes because I actually thought my vision was blurring...

Another nitpick which may be totally invalid and I'm open to being educated on this. It seems odd (i.e. inaccurate) that, at the end, the myProgram.bundle.js is being called an "executable binary." It's just minified JavaScript. Is it a binary because it has been minified and optimized, or is all JavaScript suddenly considered "binary?"

<comment><USER32> I'm guessing that "binary" can be interpreted as "blob of unreadable mess when opened in a text editor"</comment></comment>


A Philosopher Every Programmer Should Know: Susanne K. Langer - <AUTHOR> http://www.daddymodern.com/susanne-langer-theory/ <comment><USER2> To be honest, it seems very superficial to me - like most philosophy. It starts with an arbitrary premise ("the brain wants to process symbols"). Since the premise is arbitrary, it doesn't help me at all.

To me the interesting bit is "why does the brain want to process symbols". Which is probably better answered by evolution theory than by philosophy.

Another example of the shallowness of philosophy: "I think, therefore I am". Again, an arbitrary premise. What does it mean to exist? Again, philosophy does not seem to be interested.

<comment><USER3> I realize it is easy to pick on philosphy, but if you're going to write off one of our oldest disciplines it should at least come from an informed place: "I think therefore I am" is not Descartes' premise, but one of his conclusions. Even as a conclusion, it is mostly misunderstood. The point is not that it is the thinking that brings one into being, but that there is something there that must exist in order to do the thinking. Other translations I have read have it "I am deceived, therefore I am," again the point being that something must first exist in order to be deceived. His original "arbitary premise" is that he must first discard everything he thinks he already knows.

<comment><USER2> Still, he dodges the question as to what it means that something exists. But I admit I haven't really read him. It is just that whenever I pick up a philosophy book (very rarely), I tend to hit upon false premises immediately.

<comment><USER4> Whenever I pick up a maths book, I read all these symbols that have no explanation whatsoever - it's obviously self-indulgent wanking. I admit I don't actually read the book, though, I just open it. But I can tell the symbols aren't english, or any other language I learned before my mind closed, so I can tell it's dross.

<comment><USER2> Well name a philosophy book that is worth reading.

Maths books don't claim to be anything but self-indulgent.

<comment><USER5> Given your comments, I'm would recommend W.V. Quine (staunchly realist, writes wonderfully clearly, very rigorous, a logician at heart). A good collection of basic essays is _Quintessence_ , and a good first essay might be 'On What There Is'[1][2]. (Arguably his most important book-length work is _Word and Object_ , but I wouldn't recommend starting there.) Here's the first paragraph (complete) to give you a sense of how well he writes:

>> A curious thing about the ontological problem is its simplicity. It can be put in three Anglo-Saxon monosyllables: 'What is there?' It can be answered, moreover, in a word—'Everything'—and everyone will accept this answer as true. However, this is merely to say that there is what there is. There remains room for disagreement over cases; and so the issue has stayed alive down the centuries.

[1] Online: <http://en.wikisource.org/wiki/On_What_There_Is>

[2] Original source: <http://www.jstor.org/pss/20123117>

<comment><USER6> Gotta side with Tichy on this one. That sounds exactly like self-indulgent nonsense. Talk around the question, sound cute, but don't answer anything or even inform how you plan to proceed.

<comment><USER5> Don't think in terms of sides. I'm not "against" Tichy. He asked for reading recommendations, and I gave him one. I wasn't trying to prove him wrong about anything. I suggested Quine because he often appeals to mathematically minded realists, and I think he's very smart and writes well.

As for the article, try the whole thing before you judge it (it's not very long at all). Quine is not being frivolous, and he takes pains to explain exactly what he means as the piece goes on.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Very cool! I sometimes wonder what's so special about the concept of a 'symbol'. A stream of symbols make up a message. A message contains a thought or an idea which we wish to express. We definitely find it hard to communicate with symbols alone. It would be very interesting to find answers to

      1. What processes convert ideas to symbols and messages.
      2. Is there a notion of an optimal symbol set?
      3. How much are these symbols and messages created by the human brain dependent on the person's environment?

<comment><USER8> regarding n.2 <http://en.wikipedia.org/wiki/Kolmogorov_complexity> defines formally the concept of minimal encoding of a message

<comment><USER9> And as long as philosopher will refuse to dig a bit into mathematics or computer science for answers to questions they call "philosophical", I'll have a hard time being interested by philosophy.

<comment><USER10> And as long as mathematicans will refuse to stop asserting that their holy science is the one and _only_ correct answer to all problems on this earth, I'll have a hard time being interested in mathematics.

This goes both ways, you see?

<comment><USER11> As soon as philosophy gets to even a fraction of the use mathematics has, then maybe it will be worth looking to for answers.

<comment><USER12> Philosophy doesn't really give answers - it only states interesting questions, and if we can answer some of them - a new science is born.

<comment><USER11> Well said.

I was about to tack on "questions on the other hand..." to my comment but was already in bed when I thought of it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Anyone mind if I promote <http://philosophy.stackexchange.com/> here?

</comment><comment><USER14> Read Wittgenstein's Tractatus logico-philosophicus if you want to read a remarkably bug-free "program". It reads like code.

<comment><USER15> Interestingly enough, there is an effort to "port" the Tractatus' logic to software engineering: <http://www.hxa.name/notes/note- hxa7241-20110219T1113Z.html>

</comment></comment><comment><USER16> She also wrote a great book called Introduction To Symbolic Logic. A must- read!

</comment><comment><USER17> Enjoyable article, probably true for many; making me further happy I just picked up a stack of James Hillman & other Archetypal Psychologies & symbol books.

</comment><comment><USER18> Regarding why we dream, I've always thought that it's got something to do with exercising our right brain. We feed our left brain when we're awake, we feed our right brain when we're asleep ...

can anyone confirm or deny this ?

<comment><USER19> We have only one brain.

<comment><USER20> what if you sever your corpus callosum?

<comment><USER21> Then we have two brains.

<comment><USER19> Two half brains. Everything has two halves.

<http://en.wikipedia.org/wiki/Split-brain>

</comment></comment></comment></comment></comment><comment><USER22> Only programmers that enjoy philosophy. Personally I feel the whole field is obsolete with the invention of neuroethology and similar.

<comment><USER23> A wise man (my advisor when I was doing my philosophy degree) once said something to the effect of:

There are two great mistakes you can make in philosophy. One is deciding there is no ultimate answer. The other is deciding you've found it.

<comment><USER22> That's rather trite, especially considering it follows that standard wise- mystic pattern of "two statements which contradict each other." Someone wrote a comic about it but unfortunately I can't find it.

<comment><USER17> There's nothing inherently contradictory about an unknowable truth. Disagree: it's merely trite, not incorrect, and in spite of being trite it still brings a grin to my lips.

</comment></comment></comment></comment><comment><USER24> I feel we love our work because we all need a worthwhile struggle and goal.

<comment><USER25> I believe some of us have an intrinsic desire to build things. Just like birds build nests and bees build hives. Some of us have a desire to build and are probably rewarded with some chemical brain fix as a result.

At this point though, we've simply changed the medium from sticks and mud to Python and Minecraft.

<comment><USER26> Humans don't have "intrinsic" desires, and we don't have instincts (except arguably as babies), like building nests and hives. Instead, our desires become shaped over time by the process of thought and past experiences we've accumulated.

I agree more with my grandparent post than my parent post. We have (as individuals) learned to value certain particular kinds of achievement, and when we do achieve those achievements, it makes us feel satisfied.

<comment><USER27> _Humans don't have "intrinsic" desires, and we don't have instincts_

Says who? Based on what?

You are seriously underestimating one of the hardest questions ever posed and for which there is no (and there may never be) definitive answer. Tabula rasa, genetic determinism, nature vs nurture, etc are all deep, hard problems.

As a matter of fact, can you even significantly define "desire" or "instinct"? A lot of smart people have tried in the last 2500 years and there is no consensus yet.

<comment><USER25> Instead of responding to your parent directly, i'll just add that this is exactly why I prefaced my post with "I believe".

That said, I'm not implying we have built in instructions to go create a townhous. Simply that there is possibly a driving force that compels us to create, then a reward for doing so.</comment></comment></comment></comment></comment>


Shell Productivity Tips and Tricks (tutorial for beginners) - <AUTHOR> http://www.datastuff.tech/programming/files-strings-bash-tutorial/ <comment><USER2> Article titled _How to Manipulate Files and Strings from the Terminal_ does not mention terminal-based text editors. Brushing that aside, it also does not feature `cp`, `rm`, `find` or `git`...

<comment><AUTHOR> Hi! I'm the writer.

I figured git deserved an article on its own, rather than mentioning it in passing in a bash article.

About cp and rm, I actually wrote about more basic commands in the previous article, also linked there: [http://www.datastuff.tech/programming/terminal- tutorial-more...](http://www.datastuff.tech/programming/terminal-tutorial- more-productive/)

Though seeing your comment makes me think I could just combine both articles into a longer one.

Thanks for the feedback!

<comment><USER2> Hi, I had a quick look at the post and it didn't seem that it was part of a canonical series of posts. That may room for improvement on the website design.

<comment><AUTHOR> Hi! I made the paragraph mentioning my previous article more prominent, do you think it's clearer now? Thanks for the feedback, this is one of the reasons why I like sharing my articles on HN.

<comment><USER2> I must admit I really only had a cursory glance. I didn't want to read the article as I already know how to use the basic commands. It's entirely possible I'm just a dummy and didn't see an obvious link. I wouldn't take my feedback too seriously, unless you receive the same feedback from others too.

I meant more that it would be nice if the website design itself clearly indicated the presence of other related posts. This is about post _metadata_ which shouldn't be communicated solely in the post itself but also in the way that post is presented.</comment></comment></comment></comment></comment>


Jane Fawcett, British Decoder Who Helped Doom the Bismarck, Dies at 95 - <AUTHOR> http://www.nytimes.com/2016/05/30/obituaries/jane-fawcett-british-decoder-who-helped-doom-the-bismarck-dies-at-95.html <comment><USER2> I had a long read on the Bismarck. At each engagement it was outnumbered. By the time it sank it took 400 hits. And it sunk not because of those torpedoes but because it's crew scuttled it. What a ship.

I feel sorrow for the loss of its and Hood's crew. Their crew's valiance and courage and ingenuity used for their own deaths.

I am grateful for many who survived the war and lived the course of their lives like the woman in this article. They built the world we live in today.

Edit: Apparently it is Memorial Day.

</comment><comment><USER3> Sounds like that poor Luftwaffe general/concerned father "doomed" the Bismarck more directly than someone who happened to transcribe a broken code. I wonder what his obituary was like.

<comment><USER4> Nah, he just made a mistake. People make the occasional mistake. Crypto has to cover that, because it happens.

Another general during WW2 made the mistake of always including the same stock paragraph in every transmission. That's bad. That's an O(n) mistake, not an O(1) mistake.

And I suppose someone made an O(n) mistake if the British knew the names of a significant number of Bismarck crew.

<comment><USER5> Another mistake, which had serious consequences to the Germans, was that a German weather ship in the North Atlantic accidentally transmitted their weather report using the Enigma key reserved for naval operations rather than the key used for routine information, noticed the mistake, and then immediately retransmitted the identical message using the routine key. Since weather forecasts have predictable content and format (and are thus easier to decrypt), this error allowed the Bletchley Park people to crack the operations key much more quickly than they otherwise could have.

This episode is described in the book _Alan Turing: The Enigma_ [1], which was the basis for "The Imitation Game" film. I highly recommend this book if you're interested in Turing, cryptography, or the early days of computing. While Turing is best known today for his work on the theoretical underpinnings of computer science (due to the Turing Machine that bears his name), he also worked on the design of one of the early general purpose computers (the ACE[2]) after the war, on voice encryption hardware, and other interesting stuff.

[1] [http://www.amazon.com/Alan-Turing-Enigma-Inspired- Imitation/...](http://www.amazon.com/Alan-Turing-Enigma-Inspired- Imitation/dp/069116472X)

[2] [https://en.wikipedia.org/wiki/Automatic_Computing_Engine](https://en.wikipedia.org/wiki/Automatic_Computing_Engine)

<comment><USER6> > Since weather forecasts have predictable content and format (and are thus > easier to decrypt),

You can't tell the format from the encrypted data though, right? Would you not have to know apriori what this message was in order to make use of this particular weakness?

<comment><USER4> Metadata. In this case, the broadcaster's general location and the timing and (I suppose) size of the messages. And perhaps known/guessed plaintext attacks: if you too have a weather ship in the same area you can guess at the content.

</comment></comment></comment></comment></comment><comment><USER7> I guess we'll never know the monumental contribution women made during WW2 at Bletchley. Respect.

<comment><USER8> Here's a BBC Radio Four programme about some women at Bletchley Park: [http://www.bbc.co.uk/programmes/b062ktlf](http://www.bbc.co.uk/programmes/b062ktlf)

(I have no idea if they geo-block this, nor what the workarounds are.)

Here's a bit of text to accompany that programme: [http://www.bbc.co.uk/programmes/articles/Q3lFn2vTv9JMgxX98bR...](http://www.bbc.co.uk/programmes/articles/Q3lFn2vTv9JMgxX98bRhL/the- bletchley-girls-cracking-women)

<comment><USER9> AFAIK, BBC Radio is not blocked outside the UK, perhaps because a TV Licence is not required for radio, and/or possibly because the BBC may control more distribution rights for the content of its radio productions than its TV output.

The link you posted is not blocked though, FWIW.

</comment></comment></comment><comment><USER10> > The message, passed instantly along the chain of command, was instrumental > in finding the Bismarck, which was first spotted from the air by a > seaplane...

My wife's great uncle, Tuck Smith, is the person who spotted the Bismarck. Since the US had not yet entered the war, his being in the air that day was, literally, and act of war.

It was years before the truth came out.

He was patrolling in the Pacific on 7 Dec 1941. Looking for the Japanese fleet.

[https://en.wikipedia.org/wiki/Leonard_B._Smith](https://en.wikipedia.org/wiki/Leonard_B._Smith)

</comment><comment><USER11> Wonderful story.

</comment><comment><USER12> No black bar?</comment>


You're a Growth Rookie, not a Growth Hacker - <AUTHOR> http://www.vlaskovits.com/2012/07/youre-a-growth-rookie-not-a-growth-hacker/

<comment><USER2> Anyone else think of someone brutally, brutally hacking away at some obscenely large tumor or mole when they read the words "growth hacker?" Sorry if you didn't until now.

<comment><USER3> Awesome visual. I just threw up.

</comment></comment><comment><USER4> A growth hacker is also not someone who is able to increase sales from 10% of 100,000 to 20% of 100,000. He's someone who was able to get those 100,000 potential customers in the door in the first place. Anyone can be analytical, do A/B testing, and increase conversions.. when the hard part of getting prospects is done.

<comment><USER3> Not quite. A Growth Hacker can get 100K users/customers once a startup is past Product-Market Fit.

</comment></comment><comment><USER5> And we were just bemoaning the dilution-to-meaninglessness of the word "hacker" in that thread from 2 days ago. I guess we should start using the titles "Chief Executive Hacker", "Chief Operating Hacker", and (my favourite) "Chief Technology Hacker".

</comment><comment><USER6> What the fuck did I just read? Growth hacker? Give me a break, it's called Viagra. "Mommy, he stole my dolly."

<comment><USER3> Nice.</comment></comment>


Ask HN: why QR reading capability isn't integrated to smartphones - <AUTHOR>

I find it surprising that even nowadays most smartphones don't seem to come with any way to read QR codes. You'll have to install an 3rd party app on all phones I have tested (vanilla android, iPhone, N9 most lately). Why is this?<p>Some factors why I would expect it to be part of any modern smartphone:
 - Technology is easy to implement and standardized.
 - QR codes are no more just for techies, but you start to see them everywhere.
 - Integrating the functionality to the OS camera app would make it easier to read the QR codes.
 - It is easy to demo by the phone company and most customers know how to use it. <comment><USER2> Well, I'd say it's because of legal issues. A couple of months ago I was investigating QR codes.

Other than the fact most (if not up to 80%) of people either don't know what a QR code is or how to 'read' it.

It's a pretty clever design, at its core is encoding binary data to an image (largest is about 512KB if I remember correctly).

Liability comes into play when you consider that it's possible to encode a virus or other malicious code into QR readable format which people can willy- nilly scan into their phones.

</comment><comment> simba-hiiipower Windows Phone has built-in QR scanning capability. It was integrated into the OS as part of the last major update (7.5/Mango).

It's a feature of 'Bing Vision' which allows scanning of QR Codes, Microsoft Tags, Standard Barcodes, and Text. This is built-in to the general Bing (Search) feature of the OS and is avaliable on all Windows Phone devices.

<comment><USER3> I'd like to add it also allow you to scan books and CD covers, and instantly detect it and give you reviews/prices.

</comment></comment><comment><USER4> Because QR codes are a stop-gap and won't exist in a few years?

Seems like low-power Bluetooth will replace QR codes in the not-so-distant future.

<comment><AUTHOR> QR's benefit is that it is so low tech, so it will have usecases even after something else comes around (print media for example). Btw, I have been under impression that the NFC technology is coming as the next step, haven't heard about low-power BT.

<comment><USER5> I think QR codes and also any type of near field communication is just not going to catch on.

if I am in a store and I want to make a purchase on in some way connect to the store, wouldnt it just be easier to install that stores app, or visit nikemob.com and communicate and make purchased through the internet?

shouldn't the internet be the communication medium?

Apple is already doing this, you buy items on your phone, walk into a store and pick up the item and walk out. You can even purchase in the app while in store without talking to anyone. no need to scan a qr code, or connect with NFC.</comment></comment></comment>


How David Gregory Lost His Job - <AUTHOR> http://www.washingtonian.com/articles/people/how-david-gregory-lost-his-job/

<comment><USER2> I think what's missing in a lot of these shows is authenticity. The set is obviously a set. And the guests aren't there to discuss events, but to promote an agenda. Which makes them different from Late Show guests only in the topic.</comment>


New SourceTree is here - <AUTHOR> http://blog.sourcetreeapp.com/2016/02/22/sourcetree-update-atlassian-account-git-lfs-support-ui-refresh-and-more/ <comment><USER2> I usually try to be positive but these changes don't look good. It looks like some overzealous designer started making UX decisions they weren't qualified to make and now the app is unusable.

I'm a huge SourceTree fan - I use it exclusively for Git, but I won't be upgrading until these obvious UX problems have been addressed.

Edit: Also, why do the OS X and Windows versions look so different?!? The buttons aren't even in the same places!

Edit 2: I don't like how negative I was in my initial post. I'm going to give it a try, maybe I'll be surprised.

Edit 3: So I just opened it up.. I think the spacing has been improved substantially. Individual components feel more polished, certainly. The biggest problem though is that the entire app feels like it's defocused because it's all grey. The only colour in the entire application comes from the pale blue used to colour the folders. Pretty lame. The whole UI just feels very drab now. Other than the lack of colour though, it looks better.

<comment><USER3> _Also, why do the OS X and Windows versions look so different?!? The buttons aren 't even in the same places!_

Different platforms have different conventions and guidelines. Having both versions look and act the same will make it alien on either or both platforms.

<comment><USER2> I don't know about that in this case. Take a look at the collapsable menu on the left for OS X and Windows - one has icons and one doesn't. The icons at the top are ordered completely differently by the looks of it. That's not a convention. The real alienation they should worry about is alienating their own users when they're on different platforms. The program should feel familiar regardless.

<comment><USER3> Agreed, it should feel familiar. But also respect the platform conventions. Nobody ever said UX was supposed to be easy, did they? :)

</comment></comment></comment></comment><comment><USER4> > With the new versions of SourceTree, you'll be prompted to review and accept > Atlassian's Customer Agreement and Privacy Policy. To ensure that it is > really you that's accepting these changes, we're prompting every user to > enter their existing Atlassian account credentials or create an Atlassian > account.

This smells like BS to me. 99% of all installable apps with EULAs including from big companies like Microsoft, Apple, and Adobe don't require you to login to accept the EULA.

If you want people to log in, then sell them on the great features they get, don't lie to them.

<comment><USER5> You have __always __been forced to register, but previously it was with a 60 day "trial" before it demanded a key and stopped working.

</comment></comment><comment><USER6> The new update requires you to login to an Atlassian account and you will be locked out from using Sourcetree if you refuse to login.

Avoid if you don't have an Atlassian account, don't want to create one or don't want to be logged in.

[http://imgur.com/lsI2M9o](http://imgur.com/lsI2M9o)

<comment><USER7> When you first install Sourcetree (and every year thereafter) you have to register it with an email address. Is this just that or is it different? (ie. have they started requiring an always-on connection to Atlassian or something?)

<comment><USER8> No, you have to register a full Atlassian account with all of your personal details. A single email address is not enough anymore.

<comment><USER9> You always needed an Atlassian account to retrieve the license but now you can do that by just logging in to the app instead.

</comment></comment></comment></comment><comment><USER10> I don't mind SourceTree; it's a great tool to visualize git tree that scratches some itches that _gitk_ doesn't quite. Tree visualization of multiple branches and seamless integration with github/bitbucket are the reason I keep it on my Windows machine.

Granted, most of actual git activities are better done via command line, except for chunk editing.

Just one chagrin I have with sourcetree is the lack of linux integration, despite obvious demand: [https://answers.atlassian.com/questions/149631/sourcetree- fo...](https://answers.atlassian.com/questions/149631/sourcetree-for-linux)

<comment><USER11> > scratches some itches that gitk doesn't quite. Tree visualization of > multiple branches...

Just a quick PSA that gitk does support multiple branch tree visualization when started with the 'all' flag i.e 'gitk --all'.

This roughly mirrors the CLI's 'git log --graph --all'.

(not to say that either of these commands have a better UI/UX than SourceTree)

<comment><USER10> wow, TIL. I really needed to know this. thank you.

</comment></comment></comment><comment><USER12> The recent SourceTree release was dire, aside from the UI changes, it was just broken in too many places. This happens, but what really got my goat was the original tweet in this thread, [https://twitter.com/cody_watkins/status/700023288085372928](https://twitter.com/cody_watkins/status/700023288085372928).

It wasn't a beta version, it was a main release and the quality was too poor for them to admit it. This is just sleazy PR.

<comment><USER13> The quality was poor even if you could get it to work; signing into Bitbucket (also by Atlassian) repeatedly crashed the app for me, which wouldn't have been a problem if it didn't automatically attempt to (and then hang) every time I opened it.

</comment></comment><comment><USER14> I've been using SourceTree for years. It was always a little funky in how it was laid out but I got used to it.

I could have lived with this change if they didn't get rid of freaking COLORS. Seriously. All the icons look more or less the same now. Have to read to make sure I'm clicking what I think I'm clicking.

I think I'll look elsewhere finally. I just can't stand another 50 shades of gray interface.

<comment><USER15> Gitkraken is looking fairly promising. Although it currently has a font rendering issue with electron that results in a white screen :/

[http://www.gitkraken.com/](http://www.gitkraken.com/)

</comment></comment><comment><USER16> Side topic here: Anyone noticed how bad Git-LFS is?

We've been using it in production for dataset versioning and noticed that it's not even at a beta stage, perhaps pre-alpha. It gets corrupted by it's own volition at random, working seamlessly for a day then suddenly 'git clone' will fail repeatedly, until the repository is rolled back, or it magically fixes itself.

I don't understand how it got integrated into Github, and now i see sourcetree and other clients support it. gah.

<comment><USER17> Git-LFS was developed _by_ Github, presumably so they could expand their business to manage more types of content.

<comment><USER16> I mean i understand that, but they didn't seem to do much of an evaluation before launching.

</comment></comment></comment><comment><USER18> SourceTree served me well for many years. Switched to GirUp 3 months ago and haven't looked back since. Highly recommend it. It's fast.

[http://gitup.co/](http://gitup.co/)

<comment><USER19> You mean, GitUp (not GirUp) and 1.0.3 (not 3)?

<comment><USER20> "Switched to Gitup" \+ "3 months ago"

</comment></comment></comment><comment><USER21> I had to revert back to the old version with "ugly" icons as soon as I've got the new update since the new UI is so terrible and hard to look at. Not to mention it keeps on crashing.

</comment><comment><USER22> In my opinion a huge strategic error not to write a cross-platform app. Now they have two separate code bases (Mac and Windows) and still no Linux support ever likely. Since I use Linux, like many other developers, this app isn't an option.

</comment><comment><USER23> I don't get why Atlassian have a source tree blog if they're not going to engage with their users. Last I checked there are 66 horribly critical comments. And no-one from Atlassian have engaged at all.

</comment><comment><USER24> Wow, people generally dislike change, but the level of negativity in the comments there suggests that these changes really _are_ bad.

<comment><USER25> Yeah, it got bad shockingly fast. Question though: does anyone really use SourceTree? I've tried using it like 5 different times and it's just so convoluted. It's very ugly, non-intuitive, and doesn't have a lot of features that people use with Git.

On Windows I usually grab Tortoise, and on Mac I use Tower. Tower has some limitations and it gets crashy every now and then, but geez they make using a UI worth it. I genuinely got as good as I am with Git on the command line because SourceTree was so effing bad and I didn't have rights to install something different on a laptop I was using for a week.

<comment><USER26> I've been using it for the last two years, since our team switched to Git. I like being able to scroll through the commits list, and the ability to easily add hunks or even individual lines by clicking is a vast improvement over `git add -p`. Also Sourcetree has a UI for doing interactive rebasing, which is GREAT for the same reason.

The biggest downside for me is the inability to easily browse the state of a repo at a given commit, like I could with TortoiseHG. I keep around GitExtensions for some of that history browsing. Also, the security software installed on my work machine insists on inspecting new processes for validation, which unfortunately doesn't play well with ST spawning multiple git.exe process trees. Always pegs my CPU and slows things down. Performance is reasonable on other machines, though.

Overall, I find it a useful and valuable tool. I just wish they'd make real improvements instead of this "replace a perfectly acceptable UI with a bunch of unreadable gray lines" nonsense they just pulled. I'm sticking with 1.6.25.

</comment></comment></comment><comment><USER27> Wow - whats up with forcing people to login - what is the catch? what is the point?

Feels like when an app wants access to your GPS, contacts and microphone and you wonder for what reason...

<comment><USER20> Atlassian is currently hellbent on getting all their products "integrated" from an account perspective -- so they can "provide a better experience", which likely translates to "will require monthly subscriptions everywhere".

Feel the cloud, baby.

</comment></comment><comment><USER28> Learn how to use the Git command line. You will never regret it. In the past, I could only use git using Git Tower, but when I was forced to use the command line, I never went back. The level of granularity is fantastic. Also you won't look ridiculously incompetent when you're pair programming with a co-worker and they don't have the SourceTree/Kraken/Tower/etc.

<comment><USER29> Command line prowess is not the be all and end all of competency. Some people like to have less of an overhead in brain cycles when doing menial/repetitive tasks (like dealing with source control) so that they can actually get on with real work.

Personally, I think git is overcomplicated. Powerful, yes, but still ridiculously complicated, but that's the price you pay for all that power and flexibility. If a GUI can make many of the simple tasks easier and quicker then I'll always opt for that; I'll drop down to the command line when I need to deal with more complicated scenarios.

</comment></comment><comment><USER30> We're planning a new beta release process for our upcoming SourceTree releases and we'll share more in a blog post in the coming days. This will allow the community to engage with the SourceTree team and provide extensive feedback on future updates. Thanks for all your feedback.

</comment><comment> mh- if you want to bypass the forced startup wizard/login crap on OSX:

      defaults write com.torusknot.SourceTreeNotMAS STWelcomeStageAtlassianAccount -int 0
      defaults write com.torusknot.SourceTreeNotMAS STWelcomeStageCloning -int 0
      defaults write com.torusknot.SourceTreeNotMAS STWelcomeStageLicense -int 0
      defaults write com.torusknot.SourceTreeNotMAS STWelcomeStageRemotes -int 0
      defaults write com.torusknot.SourceTreeNotMAS agreedToEULA2 -int 1
      defaults write com.torusknot.SourceTreeNotMAS AtlassianAccountEmail -string email@example.com
      defaults write com.torusknot.SourceTreeNotMAS completedWelcomeWizardVersion -int 3

</comment><comment><USER8> I was using the new version for about a week now and besides some bugs I really don't like the new design. After working with SourceTree for 2 years it feels like I have to learn a new application. I'm now checking out GitKraken which looks quite promising after the first hours of working with it.

</comment><comment><USER31> On Windows version big repositories are now noticeably faster than with the old version, which makes this feel like an improvement despite its glaring flaws, like the hassle for the mandatory registration with a bogus mailinator email-address, or the brand new UI bugs.

</comment><comment><USER32> I don't know why they have not pulled the new version yet.. apart from the login issue that blocked most people from using the app, there are so many regressions and new bugs it is unusable.

I'm surprised to see such a big misstep from Atlassian.

<comment><USER30> Please try the latest releases published on Mon and let us know what issues you are running into

<comment><USER32> Just tried it - few obvious ones on first open:

* Clicking on unstaged/staged files changes the diff view but the highlight on the file works on only half of the files, seems to be random when it works and doesn't work

* Highlight to show which branch is selected is gone (History is selected by default and highlighted, when you click out highlight is gone forever)

* Sometimes diffs are completely blank ([https://s3.amazonaws.com/uploads.hipchat.com/29857/194444/fU...](https://s3.amazonaws.com/uploads.hipchat.com/29857/194444/fUC6OvlmuZ9F62S/upload.png))

* UI flickers, is about 2x as slow as previous version

Don't mean to pick apart a free product, but this is a tool we have been using for years and to have a pushed update regress things this much is a surprise.

<comment><USER30> Thanks for the feedback. I have passed it on to engineering.

</comment></comment></comment></comment><comment><USER33> I always like sourcetree, mainly because is the best mercurial GUI client I have used so far, and the ability to do git with the same tool is great.

I use the command-line for basic task, but the GUI is great for visualization and do stuff like diffs, conflict merge and other things.

However, lately sourcetree crash _every time_ I open it, then re-open and it work (!). The tool is good enough to accept this so far.

But now I'm worried that this get worse...

<comment><USER34> Hey, thanks for reaching out. We're aware of the Hg related crash. A fix addressing this issue will be out soon!

</comment></comment><comment><USER29> I updated to 1.8.* (Windows) last week when the app notified me of the new version and found it hugely unstable. I've since downgraded back to 1.7.0 and will be continuing to use that until I have a real need to upgrade.

It's a huge shame that SourceTree isn't open source. I'd love to lend my WPF expertise to the project; it seems whoever's working on the Windows version is a bit clueless.

<comment><USER30> Did you try the latest release? Let us know if you see it is still unstable

<comment><USER29> Just upgraded to 126.96.36.199 - still can't stage multiple files at once like I used to be able to in 1.7.x; i.e. select multiple files and hit space. Also, there's no backup context menu option for this?

</comment></comment></comment><comment><USER35> Sad about this - just had two long-time friends complain bitterly about it - one moved to Github Desktop, the other downgraded. Used to use it myself on one machine until I started using VS Code (which has a simple and effective Git workflow).

</comment><comment><USER36> Still waiting for showing all repositories on the left hand side so I don't need to iterate through ten different windows whenever I'm looking to commit something.

Edit: Some commenters mentioned SmartGit and GitKraken. Anyone here actually use them?

<comment><USER37> >Edit: Some commenters mentioned SmartGit and GitKraken. Anyone here actually use them?

GitKraken took like 400+ mB on my Mac. That's quite insane for such a simple application.

<comment><USER38> electron app + whatever junk (tests, docs, examples) module maintainers didn't hide with an .npmignore.

</comment></comment></comment><comment><USER39> I hope they can add a higher contrast mode. It is quite hard to see some things.

</comment><comment><USER40> In Windows drag & drop for staging files is gone completely. Happy to see now my stashed content in the small sidebar after the remotes. Overall the release isn't that bad in my opinion.

</comment><comment><USER41> I've started using Git Extensions, which works really, really well.

</comment><comment><USER42> The only reason I use SourceTree is for its Mercurial support. It has always been very slow, but at least it was actively maintained, unlike the other Mercurial GUI apps I've tested.

</comment><comment><USER43> Still no Linux version. I'm disappointed.

</comment><comment><USER44> "Say goodbye to the command line" \- urgh! Should command line users stay away from this app?

</comment><comment><USER45> Still no decent Linux GUI for Git :(

</comment><comment><USER46> buggy. Wait for next versions

</comment><comment><USER47> Why make it require MacOS 10.10?

It's not compatible with OSes over a year old?

This is absurd developer laziness.</comment>


Pearl Harbor advance-knowledge conspiracy theory - <AUTHOR> https://en.wikipedia.org/wiki/Pearl_Harbor_advance-knowledge_conspiracy_theory <comment><AUTHOR> Interesting because USA had broken "Purple" the Japanse diplomatic cipher machine. I had not realized that there where 10 inquiries about this.

Also there is precedent in the form of the Zimmerman telegram- which British Intelligence got by tapping cross-Atlantic cables and by breaking the cipher used:

[https://en.wikipedia.org/wiki/Zimmermann_Telegram](https://en.wikipedia.org/wiki/Zimmermann_Telegram)</comment>


Google Hangouts - Just say no. - <AUTHOR>

I, like most of you, am an early adopter. So naturally when Google Hangouts plug in and new features in gmail came out I immediately jumped all over it and tried it out. 1 day in. I rolled Gmail Back but left my chrome plug in running. Today I just removed the Chrome plug in as it breaks the old google talk and various other google services such as analytics.
I read the details about how the new interface ditches Jabber support etc. and honestly I can live with that but the lack of google voice (phone calling) support and these issues has made the tool unusable. I hope we can generate enough awareness here to get Google to rethink their plan.
So here's your charge. Submit a feedback item and switch back to standard google talk. That ought to send the right message to google's product folks who thought this was somehow a win. <comment><USER2> There is no "sending messages" to them. There is only the futile attempt to whisper in a hurricane.

Do it if it makes you feel better, but don't expect change.

<comment><AUTHOR> Thats tough viewpoint - I figured it was worth the post at least.</comment></comment>