Announcing OSS-Fuzz: Continuous Fuzzing for Open Source Software - <AUTHOR> https://testing.googleblog.com/2016/12/announcing-oss-fuzz-continuous-fuzzing.html <comment><USER2> Awesome, it's found a few bugs with Sqlite3 already: [https://bugs.chromium.org/p/oss- fuzz/issues/list?can=1&q=typ...](https://bugs.chromium.org/p/oss- fuzz/issues/list?can=1&q=type%3DBug- Security%2CBug+-component%3AInfra+status%3AFixed%2CVerified+sqlite3&sort=-id&colspec=ID+Type+Component+Status+Library+Reported+Owner+Summary&cells=ids)

</comment><comment><USER3> On the topic of fuzz testing, Python has an excellent library for property- based testing called Hypothesis [0] [1]. I don't think it does guided testing like AFL or libFuzzer (which OSS-Fuzz uses), but it's very powerful nonetheless.

[0] [http://hypothesis.works/](http://hypothesis.works/)

[1] [https://github.com/HypothesisWorks/hypothesis- python](https://github.com/HypothesisWorks/hypothesis-python)

<comment><USER4> I developed a fuzzer that generates random values based on ABNF rules, such as often appear in IETF RFCs. So it can be used for testing RFC implementations. It's written in Java but can be called from other tools.

[https://github.com/nradov/abnffuzzer](https://github.com/nradov/abnffuzzer)

</comment></comment><comment><USER5> I'd like to see openssh added to the list of fuzzed projects.

<comment><USER6> Adding a new project doesn't seem too tough. Guide: [https://github.com/google/oss- fuzz/blob/master/docs/new_proj...](https://github.com/google/oss- fuzz/blob/master/docs/new_project_guide.md)

<comment><USER5> I'm not against doing the work to create the pull (unless someone else wants to) but looking at [https://www.openssh.com/report.html](https://www.openssh.com/report.html), it's not clear to me if openssh[at]openssh.com or openssh-unix- dev[at]mindrot.org should be used for something like this.

<comment><USER7> Try firing it at yourself to start with, then ask the openssh community once you've got some useful data?

Edit: Thanks for the downvote! Every time I consider sending in a pile of automated bug-reports to a project where I'm not already part of the community, I look at them myself first. If that's bad, I'm happy to be bad.

</comment></comment></comment></comment><comment><USER8> > Recent security stories confirm that errors like buffer overflow and use- > after-free can have serious, widespread consequences when they occur in > critical open source software.

This project is awesome and incredibly valuable but what alternatives are there to making the libraries it checks more secure besides rewriting them in another language? When languages exist where buffer overflows and use-after- free are essentially impossible it's a bit depressing that we have to rely on fuzzing unless fuzzing can find these kinds of bugs with high reliability?

<comment><AUTHOR> > what alternatives are there to making the libraries it checks more secure > besides rewriting them in another language?

I'm not sure what you mean by rewriting a library.

For example, if a library is written in Ruby, fuzzing might not be suitable. you shouldn't rewrite it in C, so that you can fuzz it. (I thinkI misunderstand your point here. Please correct me.)

If we want to discover vulnerabilities in Ruby, we should fuzz the Ruby VM directly. We shouldn't fuzz a Ruby library.

</comment></comment><comment><USER9> > _In order for a project to be accepted to OSS-Fuzz, it needs to have a large > user base and /or be critical to Global IT infrastructure_

Let's see - Firefox and/or the Tor browser? I imagine Google wouldn't be too happy about doing free security research for Firefox, but it seems to fit the bill quite well for the goals and mission of the Core Infrastructure Initiative organization.

<comment><USER10> I think that represents a fundamental misunderstanding of Google's incentives. (disclaimer: I'm typing this from Google, but it's purely my own opinion.) (And wishing my experiment would finish running faster.)

Google's biggest revenue stream is ads. It has many others, but that's the big one. Ads are seen by people who use Google search, and who browse many ad- supported websites. Google also has a lot of users of its services, e.g., gmail, who have accounts. Some also entrust valuable data to Google.

Google therefore has a great deal of incentive to make sure that: (a) Nobody messes with the ability of general users to browse the Internet safely (preserving ad revenue); and (b) It's very hard to compromise users computers and gain access to their Google/gmail/whatever accounts (reducing support costs and keeping users happy), or destroy their data, or exfiltrate it. Even if the compromise was the user's computer, it's still a very bad experience.

Project zero is a pretty good example of this incentive structure in action. (such as fuzzing for windows font bugs: [https://googleprojectzero.blogspot.com/2016/07/a-year-of- win...](https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows- kernel-font-fuzzing-2.html) ).

With fuzzing itself, as DannyBee alluded to below, one of the leads of a lot of this infrastructure, Kostya Serebryany, is also personally passionate about seeing it be taken up to make the software of the world better. I've seen this in action - he convinced me to use libFuzzer to improve TensorFlow's robustness, and mentioned that he was doing so in part so I'd take that experience back to Carnegie Mellon and spread the word. :) (and it worked - [https://github.com/tensorflow/tensorflow/commit/7231d01fcb2c...](https://github.com/tensorflow/tensorflow/commit/7231d01fcb2cd9ef9ffbfea03b724892c8a4026e) for example).

<comment><USER11> One could argue, especially considering some of the disclosure situations surrounding Project Zero that have occurred, that it exists more to shame competitors than improve the world. :) To my knowledge, only like once have I heard the words "Project Zero" in relation to a flaw in Google software.

But as Google definitely does do security testing on competitors' products such as Windows, it definitely goes to show that Google would be more than happy to test for security flaws in Firefox. And regardless of Google's motives, finding security flaws does, in the end, make a more secure Internet for everybody.

<comment><USER12> Project Zero has reported plenty of bugs in Google software: [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=vendor%3AGoogle)

<comment><USER13> That's encouraging -- I had cynically assumed it was just a naive PR play -- but have they screwed over other Google projects by publishing 0-days at the end of their arbitrary time window? For example, do they publish zero-days on widely-deployed versions of Android?

<comment><USER10> I believe they follow the same reporting process regardless of vendor, Google included. Here's one that Google fixed in Chrome about 15 days before the 90 day public release threshold: [https://bugs.chromium.org/p/project- zero/issues/detail?id=16...](https://bugs.chromium.org/p/project- zero/issues/detail?id=162&can=1&q=&start=100)

(You'll note the explicit discussion in there about the deadline:

"Chromium issues should be treated the same as any others. So there's a 90-day deadline (which was not exceeded in this case), ...

Same disclosure warning to the Chrome team was in this bug: [https://bugs.chromium.org/p/project- zero/issues/detail?id=51...](https://bugs.chromium.org/p/project- zero/issues/detail?id=513&can=1&q=&start=400)

And project zero explicitly warned the Android team about the 90 day disclosure policy in the one bug report I checked:

[https://code.google.com/p/android/issues/detail?id=182510](https://code.google.com/p/android/issues/detail?id=182510)

Edited to add:

Here's one where they disclosed prior to Android fixing the bug: [https://bugs.chromium.org/p/project- zero/issues/detail?id=86...](https://bugs.chromium.org/p/project- zero/issues/detail?id=860&q=)

with the note "deadline exceeded". Unfortunately, the link to the Android bug is still protected, so we can't learn why AOSP hasn't fixed it yet.</comment></comment></comment></comment></comment></comment>


Microsoft Shifting To ODBC for SQL Server - <AUTHOR> http://redmondmag.com/articles/2011/09/01/microsoft-shifting-to-open-database-connectivity-for-sql-server.aspx

<comment><USER2> Spolsky once specifically used this stuff as an example of "cover fire" in one of the best insights I read about the industry. I guess this means nobody's following them closely enough anymore to duck when they shoot.

<http://www.joelonsoftware.com/articles/fog0000000339.html>

</comment><comment><USER3> It's worth noting that SQL server has a separate network path for ODBC (I believe). The announcement doesn't really say anything one way or the other about native drivers like SqlConnection in ADO.NET. Tbh, hardly anyone uses ADO, ADO.NET only really shares a name.

I'm slightly curious about what they're going to do with the OLAP connectivity, though. ADO has always been the recommended approach.

</comment><comment><USER4> Does anybody know how this affects ado.net? Would it make it slower / faster / no change? Would we have to change any of the code? Any features gained / lost? Thanks.

<comment><USER5> Doesn't affect it. ADO.NET's SqlClient uses neither OLEDb nor ODBC. Uses direct TDS to the server.

<comment><USER6> I was under the impression that ODBC, OLEDB and ADO.NET all spoke TDS on the wire.

</comment></comment></comment><comment><USER7> The good news is that this shouldn't affect too many decently-written SQL Server-backed .Net applications at least (where you program against the base ADO.Net interfaces and factories). If I were using OleDB in a native/COM based application I might be a bit scared though!

<comment><USER8>
      > There will be a seven-year phase-out period

They definitely have time though...

</comment></comment><comment><USER9> At one point I worked with a MS SQL Server cluster and it required a special driver. This driver would do things like automatically switch ports/hosts depending on which box was the hot and which was the spare. I'm pretty sure we couldn't use the ODBC one because that was only driver that we could get (Java on AIX) and it didn't work well with the cluster.

</comment><comment><USER10> But what about TDS?

<comment><USER11> Judging by stack traces ado.net is talking tds directly. Mono's implementation is based off freetds. Ruby has tinytds and of course existing c and c++ programmers can use the freetds library which works on Unix and Windows. The freetds community might be small but it is very active.</comment></comment>


Show HN: Airspace – async communication for remote teams - <AUTHOR> Hi HN,
I've been working on Airspace: https://tryairspace.com
It emails your team once each day (at the start of their working day, in their timezone) to ask what they're working on. Then it keeps all the answers in one place for everyone on the team to see.
Team members can also discuss work (organised by projects), and all of these discussions are async. Real-time chat has its place, but I personally find it quite interruptive and can pull my focus away from deep work. I built Airspace to help remote teams work on their schedule, and to give them the freedom that comes with having long stretches of uninterrupted, focused time.
I'd love to know what you think. <comment><USER2> Great minimalist logo! I use a weekly process with Basecamp and see the value.

<comment><AUTHOR> Thank you!</comment></comment>


Robust Programming - <AUTHOR> http://nob.cs.ucdavis.edu/bishop/secprog/robust.html

<comment><USER2> _Assume that the caller or user is an idiot_

I think this is not helpful at all, probably harmful. There might be use cases for my code I did not even _think_ about and third-party programmers should well be able to use it as they wish. And if they feel like modifying internal state (which the author deems fragile in his article) -- oh well! _We are all adults here._

NB. I agree that the library he's examining is sub-par quality and is well worth a look.

</comment><comment><USER3> At my last company, I had to code in this style, and it sucks. You get into ridiculous situations where you have to somehow fail gracefully with absolutely no context or information about how to do so.

Exceptions are a much better solution - I pity anyone who isn't able to use them.

\-- Ayjay on Fedang #coding

<comment><USER4> [http://blogs.msdn.com/b/oldnewthing/archive/2004/04/22/11816...](http://blogs.msdn.com/b/oldnewthing/archive/2004/04/22/118161.aspx)

</comment></comment><comment><USER5> Mostly about C programming, but many of the comments apply equally well when you're writing a library in a higher-level language or a web API.

Still, I'm glad not to have to worry about malloc fails, pointer craziness and array overflows anymore, for the most part =)

<comment><USER6> I'll grant you pointer craziness and give array overflows a pass, but I ran into a MemoryError exception in Python just a few hours ago. I loves me some higher-level languages, but they still run on a machine with lower-level limitations.

</comment></comment><comment><USER7> one other useful thing to point out. It can often be harder to implement robustness at the bottom of your call chain. You may need to step up a layer.

user_method() call_to_get_info_from_remote_system()

Just because call_to_get_info_from_remote_system fails doesn't mean you have to be done.

user_method(tries) while i < tries if call_to_get_info_from_remote_system() == FAIL # log error if check_remote_system_reachable() # fatal error be done i++

granted this makes all kinds of assumptions like you can afford to retry this operation up to N times. It also may break the rule of "Stupidity"

</comment><comment><USER8> Appropriate for exported APIs; maybe not for internal objects used once by your own code.</comment>


Why I built a new app for practicing keyboard shortcuts - <AUTHOR> https://tkainrad.dev/posts/why-i-built-a-new-app-for-practicing-keyboard-shortcuts/ <comment><USER2> [https://mediaatelier.com/CheatSheet/](https://mediaatelier.com/CheatSheet/)

I used this for a while when I got my first mac. It was pretty useful, but now I have most shortcuts memorized. Knowing keyboard shortcuts makes life much easier/efficient.

<comment><AUTHOR> I do like CheatSheet, but KeyCombiner is quite different.

It is not just a utility for looking up keyboard shortcuts. KeyCombiner enables you to create collections of keyboard shortcuts and practice them. You might know how many words you can type per minute but do you know how many of your keyboard shortcuts you can type in this time?</comment></comment>


Ubuntu and Debian AMIs for Amazon EC2 - <AUTHOR> http://alestic.com/

<comment><USER2> I just deployed to a large instance on one of these and it was fantastic.

I'd been on RedHat before, so I had a slight learning curve to the Ubuntu/Debian ways, but it's a great AMI. Add in a Sprinkle script* to deploy a full Rails/MySql/Passenger stack and I moved a well trafficked production server from Nginx/Mongrel in just a few hours.

*[http://www.rubyinside.com/passenger-stack-quickly-install-a-...](http://www.rubyinside.com/passenger-stack-quickly-install-a-full-ruby-and-passenger-stack-1533.html)

</comment><comment><USER3> Beware the Lenny XFS issue:

"This AMI defaults to Amazon's 2.6.21fc8 kernel. There appears to be an incompatibility between this kernel and the Debian Lenny XFS kernel module and xfs.mkfs program. Because of this, the use of XFS with this AMI is not advised. The Debian Etch and Ubuntu 8.04 Hardy AMIs do not appear to have the same issues."</comment>


Earthquakes from niceone.org - <AUTHOR> http://www.niceone.org/lab/quakes/ <comment><AUTHOR> I figured this might be interesting to some people, especially given the comparative number of quakes in the last couple of days</comment>


Dealing with China Isn't Worth the Moral Cost - <AUTHOR> https://www.nytimes.com/2019/10/09/opinion/china-houston-rockets.html <comment><USER2> In this light of recent heat up of issues with China, I want to share a positive story to contrast: I had a daily driver in Chengdu for over 1 month who spoke no English, zero, none at all - not even "yes" or "no". We communicated via Google translate (on VPN). He would play Chinese music and then some days I would play some American rock and roll. We bonded in inexplicable ways. I had always commented on how I love the carved wooden letter that hangs on the taxi's rear-view mirror. The ride was almost 1 hour in the morning and 2 hours in the evening back to the Hotel. We became friends. On the last day, he took the wooden ornament off, cupped it in his palm, held it against his chest, gave it to me with a glimmer in his eyes. Fuck, that was the most amazing human connection I've ever made.

I've worked in China in the semiconductor business, stayed there and absorbed some of the things the west does not even know. I recommend reading "Poorly Made in China (2011)" by Paul Midler. It is _surprisingly_ good - factual, objective look of deep issues with China's way of doing things. I resonate with the book with my personal experience.

Diplomacy is about being able to negotiate well, build trust and foster long term relationships, acknowledge mutual interests, differences and work towards solutions to problems. China has lost the brand image, probably forever. Despite a few positive experiences on the individual level, I hate working with Chinese businesses and would never want to go there. Fuck the Chinese government and its tentacles (Chinese corporations). The Chinese leadership does not understand that leadership is about inspiring others, taking care of the weak, keeping your promises and being able to independently think, innovate and set an example for other nations to follow. The way it is going, I can guarantee with certainty that they can have all the financial leverage, moral leverage is what you need in the long term; they can never become a superpower.

Edit: grammar

<comment><USER3> > moral leverage is what you need in the long term; they can never become a > superpower.

I do not understand what you mean by this, and what long term is to you. I want to be convinced, but I fail to see this as true.

What would be a superpower in your eyes, and which of the past examples of morally problematic powers (USSR, British/Spanish/Portuguese/French empires,for example) do you consider not to meet the definition, or not to have been "long term"?

<comment><USER4> I guess one thing that is obvious, is that an oppressive country like China can never win the race to attract the brightest, most creative minds. Nowadays people have options on where to live and from what I can see, these kind of people mostly prefer to live in more liberal societies.

<comment><USER5> Would they even need to attract foreigners? They have more people than all of North America and Europe combined.

<comment><USER6> In fact they did attract foreigners, how many businesses want to cozy up to them? Some countries would very much like to deal with their citizens the Chinese way too.

They do not need anyone to migrate, which is entirely different.

</comment></comment></comment></comment></comment><comment><USER7> One of the surprising things to me is how much China seems to have played their hand too early (and too strongly). People have been sounding alarms about China for a while but if they had played it cool everything likely would've ticked along as it was. Everyone would still ignore the human rights abuses, and IP theft, and creeping influence in our institutions around the world, etc. Instead China has managed to really put it right in front of every average persons face and now there's a real chance things could shift away from China. And what for? Ego? On the one hand I think the CCP bought a dud with Chairman Xi. But maybe that's good for the rest of us.

<comment><USER8> > _One of the surprising things to me is how much China seems to have played > their hand too early (and too strongly)_

China is a dictatorship, Xi a leader for life. That dramatically changed Beijing's political profile.

Pre-Xi, one could argue China had long-term planning capacities. The rotation of leaders and intraparty competition limited corruption and promoted political fitness. Dictatorships have neither. They're cronyist, corrupt and focussed on short-term political survival.

A strategic China would have waited until 2050 to deal with Hong Kong. Instead, Xi got insecure about Winnie the Pooh or whatever. A strategic China would have slowly accumulated technology, capital and soft power. Instead, they're pivoting into a wall.

> _On the one hand I think the CCP bought a dud with Chairman Xi. But maybe > that's good for the rest of us._

In the short term, sure. In the medium term, it's a security nightmare. In the long term, we're going to watch billions of peoples' humanity and productivity get squandered. That's a loss to everyone.

<comment><USER9> Good points made above. Out of curiosity, is there a route to a return of rotating leaders without a voluntary abdication by Xi?

<comment><USER8> > _is there a route to a return of rotating leaders without a voluntary > abdication by Xi?_

History has limited examples of such peaceful ( _i.e._ no civil war) transitions of power. (Most are from the modern era.)

My guess is the CCP's senior guard would need to orchestrate his "illness." But Xi has done a good job of purging the Politburo of able competition.

If I were giving this question serious study, I'd look at the PLA.

<comment><USER10> There has to be a faction within the Politburo, or at least within the Central Committee, that is becoming increasingly skeptical of Xi's hardline policies, even if all those with pre-existing loyalties were politically purged before. I suppose the question is whether they all find themselves suddenly facing corruption charges one day before they have a chance to consolidate any power.

</comment></comment></comment></comment></comment><comment><USER11> Everyone is only talking about the issue from a moral standpoint (which is of course important), but there are real financial risks as well. The government controls every aspect of business in the country. Deals can be altered or nullified at any time without recourse. No contracts can be enforced since the government will always be on the Chinese business's side. There is zero IP protection.

You could invest a billion dollars in the country and be kicked out for no reason without seeing any returns, as the NBA just found out. Yes there is a lot of opportunity in China, but relying on the goodwill of an authoritarian government is always a mistake in the long term.

<comment><USER12> Tesla is doing just this right now. It looks scary actually that they got so much freedom in theory. It will probably bite back some time.

</comment></comment><comment><USER13> Hindsight 20/20? Xi has only been a leader for 7 years. The trajectory that China was on previously was markedly different - more openness, more freedoms. Xi's turnaround hasn't been immediate either. The fact that businesses went into China a decade ago shouldn't be taken for shortsightedness — the future did look very different back then.

<comment><USER14> The trajectory changed under Hu in 2009 just after the olympics. Xi accelerated the trend, but didn't start it.

</comment></comment><comment><USER15> It's scary how effective the US and China are at propaganda warfare. It seems like only yesterday everyone was on friendly terms, now we hate each other.

As someone with family all across Asia and the West I really hope the US and China can resolve their disputes soon. This is really not a nice position for us to be in.

<comment><USER16> Hopefully, the west doesn't budge until China stops commuting human rights violations (won't happen but would be nice)

<comment><USER15> Maybe I'm a cynic but I don't believe that's the real issue. We're friendly with plenty of countries that do far worse. I think it's about economics and strategic interests.

<comment><USER17> What other countries USA is friend with has concentration camps? Turkey and Saudi Arabia have problems but I believe human rights situation is better there than in China. What else?

<comment><USER18> Australia has one on Nauru despite repeated condemnation from various international bodies.

<comment><USER19> Nauru isn't anywhere close to that. According to a close friend who visited, it's not really that bad of a place. I think that there has been a lot of political play around it to drum it up as worse than it is.

<comment><USER20> Interesting perspective. Do you also have a close friend who visited Chinese concentration camps for comparison? Why do you think one is drummed up by political play while the other is not?

<comment><USER16> At least we can view the detention centers on AU without a satellite....that says more than enough

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> If China paid the CEOs of these companies to stay quiet we'd call that bribery and corruption. Add in some market separation in the transaction and people just say that China is too big to ignore. CEOs get a free pass.

</comment><comment><USER22> Thanks to South Park. I really credit them with changing minds.

<comment><USER23> What episode? Sorry, I have not kept up with it for a while now.

<comment><USER24> Band in China: [https://southpark.cc.com/full-episodes/s23e02-band-in- china](https://southpark.cc.com/full-episodes/s23e02-band-in-china)

The one before that was pretty good too, that one was critical of the US

<comment><USER25> Damn, cannot watch it in Taipei. Copyright issues.

<comment><USER26> It was discussed extensively at the links below, where some users have also posted links to other sources for those that don't mind bypassing the copyright restrictions.

 _After 'South Park' Censorship Episode, China Deleted the Show from the Web_

[https://news.ycombinator.com/item?id=21189899](https://news.ycombinator.com/item?id=21189899)

 _South Park Responds to Being Banned in China for "Band in China"_

[https://news.ycombinator.com/item?id=21186916](https://news.ycombinator.com/item?id=21186916)

 _' We good now China?' South Park creators issue mock apology_

[https://news.ycombinator.com/item?id=21189967](https://news.ycombinator.com/item?id=21189967)

</comment></comment></comment></comment></comment><comment><USER27> Surfacing one of the comments from the article here since HN commenters (being primarily US/European) seems to exhibit similar views --

The thesis here bespeaks of the very arrogance we have regarding "dealing" with China. China is a major world power. Its existence and growing economic prowess are not dependent upon our acceptance, investment or "good will".

We continue to deal with China in an extremely condescending manner. To "deal" with China means we have to accept China for what it is; including that its political system is different from ours. It is not going to bend to our system of liberty and individual civil rights because we think that's the natural order of things. And in all frankness, our current political morass is hardly a paragon of virtue to which other should strive.

We can choose to ignore China and attempt to isolate it. But that didn't work out so well when we tried it after 1949 did it?

All these tariffs are accomplishing is incentivizing Chinese corporations to rapidly expand their production capabilities in facilities located in other nations. So in fact, we are financing China's increasing power and influence over both its neighbors and within the global economy.

We're now at a point where China doesn't "need" us. So we simply have to decide whether we want to interrelate with another major world power as it is or move towards confrontation and chaos.

<comment><USER28> Issue is, China is attempting to to force its viewpoints on other nations, eg. by denying prize money to the winner of a tournament for speaking about Hong Kong, and something about NBA I didn't follow.

<comment><USER24> To be fair the US throws its weight around quite a bit on exporting its morality (human rights, democracy, freedom of speech, etc), and sometimes not to the best of results.

I don't know if there's been any large political organization that wasn't super pushy about its world view.

I think the issue is that its viewpoint is so different from America's. It's sort of like US politics, depending on who's in the white house the government can have a very different idea of reproductive rights, climate change, and religion/secularism.

Those are big changes but China's morality is even more different. Suddenly criticizing the government is treated like hate speech.

<comment><USER29> I 100% prefer the US pushing it's agenda over China.

</comment></comment></comment></comment><comment><USER30> My grandfather ran a company that designed sawmills. During the 70s and 80s, he did a lot of business in the USSR and he has told many stories from that crazy time. I don't know if he ever was involved in bribery (he has alzheimer's now so even if I asked him I don't know if I'd get an answer that makes sense, and my grandmother has no idea) but he did however experience the corruption of the communist party first hand. Some of the people he did business with became the oligarchs of modern day Russia, leveraging the power and influence they gained from the forest industry to move in on the energy industry.

I'm a bit conflicted about what my grandfather did. As a child and teenager, I always heard the stories as bringing propserity to a poor country, one sawmill could supply tens of thousands of jobs. However, the people he did business with was some of the most dishonest and bad people ever, and my grandfather went into great lengths to make sure that they were never too dependent on the Soviet market and always travelled to Moscow with a lawyer. He never trusted them, and in the 90s and 00s when it surfaced that some of his old clients had become wealthy off the breakup of the Soviet Union, and was now using that wealth to suppress and gouge working people, my grandfather just reacted with "yeah, that sounds like something a shifty guy like him would do".

I still don't know how I should view my grandfather's role in this. The deals he made supplied the USSR with jobs which helped the people, but it also empowered really bad people. I think the same way about business in China, on the one hand the billions of Chinese deserve global abundance just like the rest of us, on the other hand fuck the CCP.

</comment><comment><USER31> just another propaganda brought up by trade war

<comment><USER32> I would say it cannot be categorized as propaganda. NYTimes editors seem to be decent people. However, that's very dangerous because its more deceptive to spread fake information(i.e. the civilized internatinal communtity is fighting against a evil regime abusing human rights) unintentionally that eventually will cause more conflicts.

It's quite insteresting that while most English speaking community blame Chinese censorship, there's an invisible censorship of political correctness that prohibit the other side of the story which might be truth. The same invisible "censorship" makes me use current throw way id because my opinion based on what I know seems very evil motivated or might take money from CPP.

Chinese speaking media have different stories which lead majority of Chinese having different oppinions than Westners' naive human rights view based on their moral superiority. To them the the narrative of HK events is another lie just like WMD. The response to Morey is an angry response to defamation , not bully to freedome of speech that US politicians and journalist love to describ about Chinese government.

Ironically it's also NY Time disclose some information about the other side of story[0].But thats a very small piece. There are much more than that. Westeners just don't know because of invisible collective censorship. The people under visible censorship some times know 2 sides stories while the other side are easily fooled by the "independent" journalists who distort the reality based on own their values and invisible censorship. I'm also using the opportunity to see how many downvotes I can collect as an observation of invisible censorship.

[0][https://www.nytimes.com/2019/10/07/world/asia/hong-kong- prot...](https://www.nytimes.com/2019/10/07/world/asia/hong-kong-protesters- masks-violence.html)

</comment></comment><comment><USER33> Is dealing with the US worth the moral cost?

</comment><comment><USER34> Is depending heavily on China for critical business functions such as manufacturing seen as a risk by big companies?

</comment><comment><USER35> It's interesting to see the zeitgeist of this evolve. Just 6 months ago much of the public was very blasé about China, but experts in many realms were sounding alarm bells. A few months later, now look at it.

<comment><USER8> > _It 's interesting to see the zeitgeist of this evolve_

This is how systems exhibiting punctuated equilibria evolve.

The physical analogy is a pile of sand, accruing by one grain at a time. It will eventually collapse, that is known. And it will do so suddenly, anyone who made sandcastles knows this. But knowing _when_ it will collapse is strikingly tough.

With sand, the correlation comes from friction between grains. With people, the correlation comes from social pressure. Once the friction is overcome, the social pressure breached, the system changes rapidly.

<comment><USER36> I wish I could recolor the usernames of the smartest people on HN like you, so I'd be able to quickly discern in future articles whether a bright and smart person like you is commenting.

</comment></comment></comment><comment><USER37> Should China split into smaller localized manageable regions?

<comment><USER38> Should the United States be split into smaller localized manageable regions?

I would argue yes, personally.

<comment><USER39> ...

it is?

<comment><USER38> It is, but on a federal level I think it still needs to be split up into multiple regions. I.e. the north-east, south-west, etc. Choosing to subdivide further at a state level would be optional.

</comment></comment></comment></comment><comment><USER40> In a perhaps humorous way to look at a difficult situation, this was all started because of some memes about Pro Basketball. It's sort of snowballed from there, but maybe this is a good cultural touchstone to comment on. American culture permeates _a lot_ of world culture. It dominates pretty much everything. China thought it could import some of it, and then export some of theirs back when the taste of what they'd brought in started to sour. Not so, it seems. Americans like their crass free speech and their memes.

...

I'm actually fairly amenable to arguments about national sovereignty and am willing to hear ones about how we (read: the West) need to back off about Hong Kong because, well, we made that deal and China wants to follow through with integrating them into the Mainland. That has been the plan since 1990s. But is _this_ the price I have to pay? Importing Chinese cultural norms to _my_ country? _My_ pro sports stars literally kowtowing to insistence that we "respect" the wishes of an authoritarian Communist government? Fans at games getting kicked out for waving Hong Kong flags? Well fuck that, and fuck anyone who thinks that's just "the cost of doing business". We've let this charade go on long enough. Since the 1990s we've pretended that the more their economy "liberalized" the more they'd become "open" to "democracy". This is a rhetorical ploy, used by elites to mostly just enrich themselves in the process of selling out the rest of us - via IP theft or moving the manufacturing base elsewhere to save some basis points. Free Trade Maximalism is what got us here, and yeah you get cheap goods from China ... but is it really worth it. No really. Is it worth _this_?

Here's what this is really about, and what people who are upset about this are really getting at: we're pretty dissatisfied with how US corporations (and our own government, frankly) have behaved for the last ~30 years or so. It's manifesting with the NBA and video games in China because that pulls in a lot of cash right now and it's run by a lot of characters we don't really like (video games more so than the NBA, if I'm being fair). So, yes, people should be mad at the behavior of Chinese corporations and the Chinese government (but I repeat myself) ... who they should _also_ be mad at is leaders of US corporations who haven't had anything else as a goal but maximizing shareholder returns on a time horizon that matters for no one but themselves.

</comment><comment><USER41> Nobody cares about wonk trade policy

Nobody cares about economic spreadsheets.

People do care about the NBA, like in a real way. The average American will not allow a beloved American institution to cowtow to ChiComms.

China has overplayed and has done it with the wrong President in the office. Trump is looking for anything to move the needle for him on China and they just gifted him something amazing.

</comment><comment><USER42> I'm having a hard time reconciling this uproar when everyone is fine with the sanctions on Cuba, Iran, and Venezuela.

I do find it interesting that all of this is happening during thr president's possible impeachment along with the recent ruling that Americans were illegally spied on.

</comment><comment><USER43> > Clinton began his term believing that trade sanctions could pressure China > to improve human rights conditions. But after a year of debilitating debate, > he was forced to reverse his policy of link- ing trade to human rights. >He > was right to do so. By continuing to grant MFN to China, Clinton will help > advance the $38 billion trading relationship which the U.S. now enjoys with > the world's fastest growing economy. Moreover, by increasing prosperity in > China through greater trade, the U.S. can help to create the economic > freedoms that are the foundation upon which political freedom will someday > emerge.

>Clinton began to end this spectacle of confusion last week when he decided to renew MFN almost with- out condition. Perhaps the most important aspect of his decision is philosophical; the President has now adopted the view that trade relations must be separated from U.S. political goals with China. Moreover, he has endorsed the view that increased U.S.-China trade can promote economic freedoms, which in the long run will spur the growth of political freedoms in China.

>This step alone will help to reassure Asian friends and adversaries that Clinton plans to get a better grip on foreign policy.

>Now that Clinton has reversed his policy, he should move quickly to exact a price-of Beijing's cooperation in two areas of critical concern to the U.S. They are:

* Ending North Korea's nuclear threat...

* Better treatment for Hong Kong and Taiwan... -

[https://www.heritage.org/report/the-collapse-clintons- china-...](https://www.heritage.org/report/the-collapse-clintons-china-..). June 3, 1994

</comment><comment><USER44> The communist is using profit to control the capitalist, the irony is painful.

<comment><USER45> I heard a cute phrase a long time ago. "We will hang the capitalist with the rope he sells us"

<comment><USER46> By Lenin.

</comment></comment></comment><comment><USER47> It only took 3 paragraphs for capitalism to end up under the bus. Which - sure. There's much to dislike in the inhumanity of extreme consumerism. But that same consumerism has transformed that nation. Even the NYT has extolled the virtues of China's rise.

"The world thought it would change China, but China's success has been so spectacular that it has changed the world."

[https://www.nytimes.com/interactive/2018/11/18/world/asia/ch...](https://www.nytimes.com/interactive/2018/11/18/world/asia/china- rules.html)

Yes. We should stop giving them a pass. Who is going to be first to give up their iPhone?

<comment><USER48> The New York Times must have a policy that it will not publish an article if it doesn't have at least a couple snarky digs at "capitalism" and Trump, no matter how tangential to the subject matter.

<comment><USER47> It does seem that way. Which, I get it. That's an easy target. I just think that kind of thing undermines the legitimate point this guy is making.

</comment></comment></comment><comment><USER49> Wow. Now that's a heavy worded article. I recommend watching _The Coming War with China_ documentary on Al Jazeera for a more balanced perspective.

</comment><comment><USER50> It's not a bad thing that American citizens are heavily armed. If everyone in HK owned a firearm I think the situation would be far different - or at least give the government a second thought before acting.

<comment><USER2> Don't you think the Military would step in with all these guys look like they're toys shooting 8 inch thick steel armor?

In my personal view, violence is the last resort for protesting and even then, sometimes I disagree with HK approach (beating officers with pies) despite of the fact that I support the HK's cause.

<comment><USER51> Yeah, violence should be a last resort. I think his point was deterrence, though. If the British had allowed HKers arms under colonial rule, would things be different now? I'm guessing China would have attempted disarmament as soon as Hong Kong returned under their control, and today's situation would be the same.

<comment><USER52> This was how the British handled the last HK riot [https://m.facebook.com/WeNewsHK/videos/2622449657812763](https://m.facebook.com/WeNewsHK/videos/2622449657812763)

</comment></comment></comment></comment><comment><USER53> Morality is a complicated thing.

More people die of murders by gun in the united states then in china.

Is it moral to deprive man of his right to own a gun in order to allow another man to keep his right to life?

There's hatred raging against China due to hong kong, but the truth is far more complex. A hundred times more complex than even the example I gave.

Centralized control has a cost, but it also has a benefit.

<comment><USER54> FWIW, I grew up in a city on the Pacific rim (San Francisco) and Chinese people have always been a part of my culture. Our first Chinese New Year Festival and Parade was in held in 1858. (California was still part of Mexico only twelve years earlier.)

[https://en.wikipedia.org/wiki/San_Francisco_Chinese_New_Year...](https://en.wikipedia.org/wiki/San_Francisco_Chinese_New_Year_Festival_and_Parade)

I don't hate China, but I fear the CCP.

I was reading a book about China written by an American journalist who was invited to visit in the 70's, when the Middle Kingdom was still literally mysterious to the West, and it dawned on me that there is no way a barbarian like myself could ever understand China. It's too vast, too old. My culture looks like an adolescent compared to yours. I'm not ashamed to admit it.

For example, the persecution and repression of the Falun Gong seems obviously wrong. But then I read about the Taiping Rebellion...

> For over a decade, the Taiping occupied and fought across much of the mid > and lower Yangtze valley. Ultimately devolving into total war, the conflict > between the Taiping and the Qing was the largest in China since the Qing > conquest in 1644 and it involved every province of China proper except > Gansu. It ranks as one of the bloodiest wars in human history, the bloodiest > civil war, and the largest conflict of the 19th century. Estimates of the > war dead range from 10–30 million.

[https://en.wikipedia.org/wiki/Taiping_Rebellion](https://en.wikipedia.org/wiki/Taiping_Rebellion)

I still believe that what the Chinese governent is doing is wrong: Tibet, the Uighurs, the Falun Gong, the censorship and rewriting of history, and so on. But I also have to admit that I see some truth in what you said:

> the truth is far more complex. A hundred times more complex than even the > example I gave.

> Centralized control has a cost, but it also has a benefit.

My problem with the CCP is that the stability and prosperity of the Chinese people are too important to be bungled. I don't feel that I'm qualified to tell China what to do, but I do feel that I'm not too dumb to see that some things are obviously wrong.

<comment><USER53> I'm born and raised in the Bay Area. I'm what you call an ABC an American Born Chinese. Basically American, but with huge roots and connections with Chinese people from the mainland. My parents are 100% born in China. If I can understand them then anyone, including you, white devil, can too.

Don't think of China as some mystical culture that's old and wise that needs to be treated with the utmost respect like an antique vase. They are Human just like you and me and prone to the same biases, stupidity and greatness any person is. Nobody cares that China is a far older culture than the united states, don't let that cloud your judgement, China can be really stupid just like how people in the united states can elect trump as president.

Look, I'm not saying China is right. But reality is far more complex.

For Falun Gong which is basically a cult akin to scientology from the view point of the Chinese what is the correct course of action? Freedom of religion or total elimination of a cult that can harm the people?

For Hong Kong they view it as a state like California or Texas saying that they have rights and the freedom to secede from the country. What is the right course of action here? Americans once asked the question about preserving a union and went to war for such a cause when half the country wanted to leave. What is the correct course of action for China? Do the Chinese have the right to preserver their union?

Tibet is also controversial. [https://www.quora.com/Why-does-China-want- Tibet](https://www.quora.com/Why-does-China-want-Tibet) But this is not the full story. China is not some moral do-gooder out to save people from subjugation. The government is human and self interested in itself and its own people. There's economic advantages of having tibet as part of China, but Tibet will benefit overall from cultural assimilation.

Cultural assimilation has a bad connotation to the term and it deserves the bad connotation. But the complex morality comes in when you think about what Cultural assimilation is doing. In cultures that contain poverty, slavery, or even cannibalism, is the elimination of these cultures through assimilation a good thing or a bad thing? Hard to say.

For the concentration camps of the Ulghurs. Unfortunately I don't know enough to comment on it. It looks though from the little I do know that you are 100% right and that this is wrong. Again, I need more information from unbiased sources. It is obvious to me, however, that the situation is very very complex. Concentration camps are not being set up to assimilate ALL of the miscellaneous cultures that make up China, what is the reason why they only do it here? I'm going to look into it. The reasoning and moral compass of most situations like this is never clear.

We are lucky to have freedom of speech, living in the united states but we still can't talk shit about our bosses unless you want your ass fired. Living in China is similar. The government is a good boss that's interested in the economic prosperity of the country and therefore your prosperity as well, but don't talk shit about the boss of China. Makes sense right?

<comment><USER54> Dude, well met.

I don't mean that Chinese people are mysterious. I know they're human just like you and me. If anything it's the intense _humanity_ of China that makes it so fascinating (to me.)

I'm basically agreeing with you that "reality is far more complex."

I'm saying that reality is hard to grasp because of the size, duration, and intricacy. Trying to understand China is like trying to understand Europe only without all the history books. (Chinese history has been relatively sparsely known in the West until quite recently.)

I used to be like, "Damn the evil CCP!", and now I'm more like "Just stop doing the really fucked up stuff, okay?". I still believe that Communism as a world view is barren due to its denial of God, but that is a whole 'nother story. I'm willing to withhold judgement of the CCP's legitimacy as a government provided they stop oppressing people.

Really, I'd like China to put itself in a better position to criticize the USA's mistakes, so we enter a virtuous circle where we are challenging each other as nations to be better than we are. There is all of the Solar System to explore if we can stabilize things here.

(In re: Tibet, are you aware of the history of how Hawaii became a state? The Queen of Hawaii didn't exactly volunteer...)

I will say that despite the very human problems that China has had over the centuries it still encompasses tremendous wisdom, both in practical affairs-- Confucius --and metaphysics. In my opinion the wisest written document in history is the Tao Te Ching. For example, Ch 17, in a single sentence, devastates all Western ideas of political power (and most Eastern ones too.)

> With the best leaders when the work is finished the people all say, "We did > it ourselves."

G. I. Gurdjieff wrote, "The energy of the West must be guided by the wisdom of the East or the world will destroy itself." He meant more than China by "the East", but certainly included it.

</comment></comment></comment></comment><comment><USER55> While I've always respected the West's stance on their own judgment of values, and the continual holding of it, I'm saddened by any narrative that it's in the face of morality.

Morality is an entirely subjective concept, and should not be used as a weaponry. The West has developed for many years and have ascended through times from ancient religious principles to the notion of modern basic human rights. However, I'd like to address that by saying the notion of "basic human rights" isn't universal, it's a standard of the West. The East doesn't do it perfect, but neither does the West. This whole affair is an eventual reality that happened to spark in the era of our existence, due to an inherent ideological difference. This is no right or wrong here, only a side to take, but to attack the opposite side of being immoral based on one's own judgmental system is simply not constructive.

As humans, the least we can do is to be aware of the situations and stay open minded and be respectful of each other, and our differences. That's how we can together evolve to a possibly harmonious future, at least to the extent of the upper-bound of humanity. There isn't a single standard of morality, and a heavy indulgence on one single side will eventually run yourself into a corner of being seen as practicing double standard.

Let's call it for what it is, a challenger to the current supremacy and that's that. Conflicts arising due to ideological differences is hard to resolve, but to only address the other party as immoral is an extremely short-sighted strategy to addressing any differences between the two. It's a greatly sad affair to see the propaganda machine on both ends flexing their muscle. Either the challenger will be defeated and we accept a new reality, or the existing supremacy loses and accept itself as a second. Bringing in a self-righteous morality to the mix is only going to incur permanent damage to humanity as a whole by prolonging the battle between ideals.

<comment><USER56> The problem isn't that China has different values, it's that it's trying to apply those values in the west and to spread it's influence. This crosses a hard line that is unacceptable and if cutting off all relations with China is the only solution then so be it.

<comment><USER55> China never tries to spread its influence, China is in a purely defensive position and the West continues to tap into China's business and then leverage whatever reaction received as China's evil deeds.

China doesn't invade the Middle East, China doesn't preach Communism globally. It's a really good question to ask who always really tries to spread their own influence.

<comment><USER56> Then explain why pro CCP demonstrators are intimidating Honk Kong protesters the world over? Explain why their are so many new accounts astro-turfing for China? Just because they don't have the military might to do it directly doesn't mean they aren't spreading their influence. They're busy buying influence wherever they can and using their citizens and former citizens as soft influence in other places. Of course they aren't preaching communism, they abandoned communism decades ago.

<comment><USER55> You have it backwards. China has the military might but chooses not to, because what the CCP wants is a peaceful resolution within its own region. On the contrary, the West's supposedly moral support of the "peaceful" demonstration is seeing 48/58 subway stations closing due to vandalism, many banks and phone stores getting robbed. These aren't pictures that Western media would portray, but that's the closer to truth reality that's occurring in HK. My friend in HK are evading to Shenzhen for protection, and other friend is attempting to understand the immigration process better to leave the unstable HK. Is this the real meaning of liberating HK? Just because other states, AKA Middle East hasn't gotten enough soft influence to show the world what "liberating" them means (destroyed states that cannot recover in decades), China will not take the soft course and actually stands to protect its own territory.

<comment><USER56> No, they don't remotely have the military might to invade the middle east, not that this is a bad thing, but to argue they do is just silly, they can't even invade Taiwan like they've wanted to do for 60 years.

As for peaceful, from Tienanmen square to how they deal with the Uyghurs to what is likely to be the case for Hong Kong they are anything but peaceful, even with their own citizens. If they were truly peaceful they wouldn't have to censor their own actions from their own citizens. If they wanted a peaceful solution they'd be happy keeping Hong Kongs current autonomy. Externally, they invaded Tibet, they would invade Taiwan if they could, most of their peacefulness comes from inability and not lack of desire.

</comment></comment></comment></comment></comment></comment><comment><USER57> Yet more propaganda by people itching for war.

Call me when they write an article warning of the moral hazards of dealing with a country that invaded Iraq without provocation, causing hundreds of thousands of people to die; which overthrew the government of Libya, plunging the country into chaos; which armed Sunni extremists in Syria; which has backed Israel's occupation of Palestine for decades; which ran a global kidnapping and assassination program; which operates a vast, unaccountable global surveillance network; where tens of millions of people go uninsured or under-insured because profits are paramount. Once the NY Times publishes that Op-Ed, maybe I'll consider their moral posturing as something other than propaganda.</comment>


SPAs are harder and always will be (2013) - <AUTHOR> http://wgross.net/essays/spas-are-harder <comment><USER2> These are fantastic technical reasons when considering a SPA vs. a traditional server-side app, but to me the largest consideration, outweighing other technical decisions, is the overall experience the end customer is going to need and expect.

Migrating from a desktop-based application to a web version? That desktop version was likely extremely responsive, and full page loads may feel like a step backward.

Does the application require constant, fast interaction, such as data analysis, frequent order entry, or highly dynamic UX? That's the domain of the SPA. But if the situation is more of a request/response scenario, then a traditional server-side set up works wonders.

The technical difficulties surrounding SPAs vs traditional are for the most part solved. It does require more overall work, but that gap is shrinking. Therefore, IMO the largest deciding factor should be user expectations, and that can go either way.

<comment><USER3> The problem is that most SPAs today are cargo-culting.

They break middle mouse button (or Ctrl-Click or whatever your favourite "open link in new tab" shortcut is on your Apple computer), at the same time break browser history, and at the same time make you wait for any single interaction you're doing (show spinning wheel for 6 seconds before opening a confirmation modal)

The ideal solution is a) minimize server roundtrips (<100ms) and b) reload parts of the site via AJAX where it makes sense.

No need to shovel 7MB of JavaScript to the user.

<comment><USER4> > They break middle mouse button (or Ctrl-Click or whatever your favourite > "open link in new tab" shortcut is on your Apple computer), at the same time > break browser history, and at the same time make you wait for any single > interaction you're doing (show spinning wheel for 6 seconds before opening a > confirmation modal)

I am not defending SPAs, but the points you've made are not indicative of SPAs, they're indicative of bad software. This problem existed before SPAs were a thing. Remember ASP.Net pages where the whole page is wrapped in a giant <form> and you couldn't use the back button most of the time? This problem also doesn't exist with properly built SPAs (e.g., by using <a> for links, using the history API correctly, and designing a sensible UX).

And certainly, if your app is sending 7MB of JavaScript over the wire and it's not a video game, something is very wrong--SPA or not.

<comment><USER5> I think SPAs get a bad reputation partially because they're trendy. Which means that inexperienced programmers flock to them and make them awful.

I recently re-wrote an SPA from a previous dev into a regular set of query/response web pages. The SPA was 2,143K. The new set is 78K. A big part of that savings was because javascript is verboten for this project due to client hardware constraints.

Yes, the previous dev was not the best in the world, but IME SPAs are always heavier than their response/query counterparts.

<comment><USER6> Not trying to defend inexperienced programmers but I've seen plenty of 20+ year senior programmers contribute poorly to SPAs.

They refuse to learn the best practices / new patterns because "they have 20+ years experience".

I have been caught in the middle between some younger programmers and some elder folks for the body of the past 3 years and the bottom line is this:

Learn the suggested best practices, or just don't build apps like this.

The OP's original thoughts on simplicity do ring true, but pushing for better UX is actually a reason to redo something. There are plenty of legacy systems out there with frustrated users, and the "complexity" can be simplified if effort is invested to accomplish those goals.

<comment><USER7> As a relatively junior developer, my advice would be "learn the best practices, or don't write code at all"...

But we'll see if I'm actually following my own advice 15 years from now. Hopefully I'm not on the wrong side of the Dunning-Krueger effect

<comment> at-fates-hands > But we'll see if I'm actually following my own advice 15 years from now.

The one thing I've learned after doing this for 5 years is you probably won't be needing to follow best practices in the next 3 months.

I've been in my current role about three years. Most of my 2015 was building an Angular 1.X transactional app. By the time it was released, I was told to start learning HapiJS and EmberJS because we were transitioning as a group to that. Then 8 months later and several smaller apps, I was told we're going back to AngularJS and Angular 2.0 transitional. So I had to almost completely relearn that. Then after one huge disaster trying to integrate it into our services, we gave it up and spent the rest of 2016 moving that app to ReactJS.

I then spent most of last year jumping around (because now all these apps we built needed supporting) between those three frameworks (Angular, React and Hapi). Now there's talk of moving to VueJS but there is a loud push to just stick with one (Angular or React) and be done with this.

My point here is you may _want_ to learn best practices, but how fast my org was changing, and building things quite literally on the fly, you just don't have time. Sure, in my own private projects, I learn best practices and use them myself. For our customers and "the business"? No time man, no matter if it will us time or not. Getting something shipped that's working is far more important.

<comment><USER8> Ironically, you've just provided an excellent illustration of some _real_ good practices: find tools that are good enough to do the job, only depend on things that are built to last, and concentrate on actually doing that job. The web development world's obsession with constantly moving to the next thing that does essentially the same job as the last thing but maybe 5% better (or maybe not) is a huge productivity sink and best avoided as much as possible. Getting something shipped that's working _is_ far more important than exactly how you made it, and it always has been. If "best practices" aren't helping with that, are they really best practices at all?

<comment><USER7> While this is generally true, the situation with SPAs is a bit more complicated. Each popular approach early on had a lot of serious issues and pitfalls. IMO React was the first thing to really break through this and while it's not perfect it addressed the biggest issues Angular and Ember had quite well.

However, at this point, once you've adopted React, NG2, Ember 2.x, or Vue, there's not much to be gained by switching between them. They've all sort of gotten past the initial immaturities of the SPA approach.

This is really something you ought to carefully evaluate once and be done with it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> One thing I learnt to love about SPAs is how they distribute responsibilities: obv you get 3 layers:

\- your DB which stores your data

\- your backend which access your data, retrieve it safely, and delivers it _without having to know anything about the client it serves_.

\- your frontend which handle how / when it needs data, which data it needs, how it caches it.

Separation is good, since you can test your API _without needing your client_ , you can test your client code with mock data, you can _build different clients_ (web, native apps, ..) over the same API (and even do not need to build an API if you're using things like graphql)

<comment><USER10> 1000x this. People seem to ignore this fact, that a lot of times you will need an API _anyway_ (multiple clients), so really adding in the SPA isn't any extra work at all.

</comment></comment><comment><USER11> And... nope!

1) Hard and easy are relative terms, You feel it hard because it is foreign to 'you', not because it is intrinsically hard. If it seems hard to you then get comfortable with the new pattern, or create a pattern that is more familiar to you, but please don't tell me this is hard because I have to write more code or because there is one more thing that you have to know and maintain. That is not hard, that is been laaaaazy.

2) The 2 points become irrelevant if you do SPA using server rendering. To give an example using C# and MVC: I have 1 javascript function with 0, I repeat: 0 business logic. All my MVC methods return a partial view with a tag saying where it goes. The javascript function does an AJAX call to the controller and on successful return it looks for the tag, and do a $('#' \+ tagvalue).html(partialView). All the business logic is on the server, all the drawing is on the server, all the validation is on the server. The only UI validation logic is the same one that you would write in the case of non-SPA. There is no data synchronization because the server manages the data. The browser gets reduced to a pretty HTML document display, which is all that it is.

SPAs are not harder, they never were.

<comment><USER12> Your second option seems to suggest that the way to make building SPA's easy is to stop building SPA's and go back to building web apps the way we did in 2005?

<comment><USER11> 1\. To me, it is an SPA as long as you are not updating the whole page every time. The year of the tools has nothing to do with it.

2\. I use the tools I use because they work and produce the proper and performant results. To be honest, I don't care for developer tool fashion statements, and so the year is irrelevant to me.

</comment></comment></comment><comment><USER13> Been watching this thread all day and I'm dumbfounded no one has spoken up for React with a modern router like found[0]. Once you learn to use these things, making an SPA is really nice, and you can easily introduce universal rendering which takes your SPA to the next level by rendering it on the server.

I find it strange that people talk like server rendered pages with progressive enchancent a la 2013 aka Stack Overflow aka GitHub are easy to make and maintain. It's 2018 and when you close an issue on GitHub the count doesn't change until you refresh the page. It's 2018 and when you go back on Stack Overflow the alerts you just dismissed are suddenly unread again. These are companies capitalized with hundreds of millions of dollars yet they are incapable of making server rendering with progressive enchancement work. It's not their fault, it's the technology, it's busted.

Yet for some reason people are lauding server rendering as effective and desirable and capable of producing rich UI that's sane to build and maintain. It's not. It's unmanagable at any scale.

With React etc in 2018 all of these problems have been solved, and as I said above, the SPA is not even something to argue about anymore because you can render your app on the client or the server. This whole article is moot. All these problems have been solved and the solutions are free for anyone who has the interest and bandwidth to build products like it's 2018.

[0] [https://github.com/4Catalyzer/found](https://github.com/4Catalyzer/found)

<comment><USER14> > I'm dumbfounded no one has spoken up for React with a modern router like > found.

You're dumbfounded that developers aren't powering their companies' multi- million dollar websites with tools that have a bus factor of roughly one[1][2]?

A couple years ago I was handed a web app built by a team that had used tools with low bus factors. Many of these tools had been abandoned only months after the team starting using them!

[1] [https://github.com/4Catalyzer/found/graphs/contributors](https://github.com/4Catalyzer/found/graphs/contributors)

[2] [https://github.com/4Catalyzer/farce/graphs/contributors](https://github.com/4Catalyzer/farce/graphs/contributors)

<comment><USER13> You're right, of course. But that particular repo was one example. Yes that repo is brand new. But at the same time it's the product of basically one person's work. On the other hand you have these multi million dollar companies—if their tech stacks were the end all of stacks, wouldn't they be able to accomplish what this lowly repo accomplishes? But they don't. And why? Because this repo stands on the shoulders of many attempts and failures in routing with universal rendering, while GitHub and Stack Overflow are stuck in 2013, when people only rendered on the server, progressively enchanced, and back only kind of worked.

Anyway there's also react-router, which is a project with probably 10k stars. I didn't cite it because I think it's not as good as "found". But it works and will get you back functionality that works in client rendering and server rendering. So if you're looking for bus factor, react-router has got that in 2018.

</comment></comment></comment><comment><USER15> My takeaway from having worked on both traditional webapps, and SPAs (2 with homegrown frameworks built on backbone.js, and 1 with ember.js): SPAs, being more complex, demand a higher standard of coding and code review to not have eisenbugs. I have seen a lot of effort wasted on making SPAs work, when the customer would have been happier to have a more reliable traditional webapp.

In one of these companies, SPA architecture was chosen because the backend was unacceptably slow. Instead of fixing that problem, we adopted more complexity by transitioning to SPA. When I left, the backend was still slow, and the SPA was breaking all the time. It felt like a waste of effort and I would never do an SPA by choice again.

</comment><comment><USER16> This is why I'm a fan of having both - no need to limit yourself to one or the other

Data heavy pages with little or no interaction? Statically render it. Admin pages, terms of service, etc. Writing endpoints and serialization to move the data is a waste of time.

Sure, you might have to maintain two separate sets of minor components (header nav and such) but it's well worth it the lessen the development cost of non- impactive pages. Can also get away with loading HTML partials from the backend and throwing them into the dom whole - the perfect case for __dangerouslySetInnerHTML or whatever, then you can reuse your nav and such

</comment><comment><USER17> I agree that SPAs are always harder. For me, there are two main reasons to consider an SPA.

1\. It _can_ let you build a much nicer UI/UX. That said, it's probably easier to build an _okay_ UI/UX with a traditional webapp, and it's also easier to build a _terrible_ UI/UX with an SPA. But the upper limit for excellent UI/UX is higher with an SPA.

2\. If you are planning to build a REST API for your system, then the best way to do this is to build a REST API from the start and dog food it with an SPA. Otherwise you end up doing a lot of the server side work twice, once for the HTML app and again for the REST API. It's better to bite the bullet and _just_ build the REST API server side.

</comment><comment><USER18> The article had me confused until I realized this was 2013. Even then it is out of date.

Muli-Page applications have had business logic on the client-side for years as a technique to reduce the feeling of latency since at least 2005.

If by "Traditional" web apps you mean web apps from the mid to late 90's, sure it was done entirely with POST and no business logic at all client side.

At the very least data validation has been being done client side for s long as Javascript has existed. (and also server side as a second level of checks if you care about data integrity and security)

SPAs did not appear overnight. They are a logic evolution of what has been happening for years.

<comment><USER19> > sure it was done entirely with POST and no business logic at all client side

Even if you don't have business logic on the client side, you still have a state: tab position, state of controls, etc. These are not part of the data you really care to store on the server, and yet they have to be sent there at each and every page reload, as they might be needed in order to build the response.

</comment></comment><comment><USER20> I have a simple rule: If the app requires real time updates and push, then SPA it is, but you can also mix server side rendering with SPA's aka micro services, eg the "chat" can be it's own component.

The argument for SPA's is that they perform better, but I don't find that to be the case with all the bloat on real world "apps". Browsers are good at rendering static content, and a server rendered site will perform well even on low end mobile devices. With todays hardware the server can render even the most complexed site in less then a millisecond, and with todays networks the latency, often as low as a few milliseconds is imperceivable and even faster then clicking around in something using a JS framework.

</comment><comment><USER21> ...but much easier and maintainable than a "server-side" webapp that is a mess of jQuery, etc layered on top to make the experience "interactive". Not to mention the ease of unit testing user interface code in SPA.

</comment><comment><USER22> > If you need to restrict access to a field (e.g. social security number) such > that only certain users can see it, you need the authorization check twice, > once when writing the JSON and again when building the HTML.

I think the article may have some points worth considering, but in what world should security code for restricting access to display a social security number ever be in the browser? The browser should never get data that it would be dangerous for the user to have access to.

</comment><comment><USER23> My work flow for a new app is:

1\. Use whatever back end framework I know

2\. Use server side templates

3\. Slap on Turbolinks (because it works super easily with any back end framework)

4\. Sprinkle in JS as needed

This results in very fast development, very fast page loads and no duplication of things like validations / schemas. The best part is you can use whatever you want on the back end too. I've followed this pattern successfully with Rails, Flask and Phoenix.

Screw SPAs (for most document heavy web apps).

</comment><comment><USER24> Certainly though SPAs are overprescribed and old fashioned template based sites work great for many projects.

But I think for many enterprisey platforms its likely the opposite, front end design logic is likely done by a different team to back end data provider so its a natural split that is more effective than a server generated page. Not to mention most back end devs suck at design.

<comment><USER25> Nothing gives you a more cohesive design than splitting a project right in the middle and giving it to two different teams. /s

<comment><USER5> As they say, an elephant is a mouse designed by a committee.

An appropriate aphorism, considering most ASPs are full of javascript bloat.

</comment></comment></comment><comment><USER26> If people could get to a point of saying:

This system benefits from being an SPA...

This one does not...

99% of the problem goes away

<comment><USER27> Yes. So much wisdom is so simple. There are apps that benefit from being SPAs, your google maps, and the like.

Our CRUD app is not one of them, but here we are still with React, and Redux, and Mobx, and ...

</comment></comment><comment><USER28> An easier way to reason about the modern web, and port this knowledge from and to native platforms at a minimal cognitive cost, is to think about a web application as consuming from an API or database layer which already enforces authorization and provides authentication, instead of mixing all these things in a single request.

Once you do this, the idea of duplicated authorization goes away, as the only thing you are doing on the front-end is error representation (and focusing on the design).

Then, you pre-build, or run+cache this same application on the server side to pre-render pages for search engines, first page load, accessibility etc. so that you are actually delivering an application for the semantic Web.

Viewed from this angle, it does not really involve more steps, but it does create more separation of concern. This in turn allows more specialization, scaling, and is more secure.

You can apply this approach to build very simple pages (e.g. blog consuming data from Markdown files), which are not SPAs, but are very easy to turn into SPAs.

So it's not really that SPAs are this hard, it's that the "do everything in one request" thinking is still very pervasive and making it harder to reason about building modern websites in a simple manner.

</comment><comment><USER29> Well, I think that many people are not aways that SPA != SPA. Actually, SPA means that the site never does a full page reload, but apart from that there is very little defined about SPAs. You can build them with fluid 60 fps interfaces or with server side HTML rendering causing huge delays. You can add aria attributes or render everything within a big canvas. Its still a SPA.

So no wonder there is so much disagreement about SPAs.

A first step towards a more defined and reasonable term is PWA as the term requires the use of some specific technologies (HTTPS, ServiceWorker, etc.). Nevertheless, it is still very broad. For example what happens to an PWA when the server is not available anymore? Does it keep running forever? Not defined, so some do others don't.

I really like well made PWAs, but in general most of them have a too strong server dependency (in my opinion). I would like to download a PWA on day X and install it on my PC 5 years later and it should still work (as other software does). As the old server might not be available anymore, I would also like to enter a new server in the settings.

The technology behind PWAs would allow such use-cases, it is just not that simple to use nowadays.

</comment><comment><USER30> I don't want to beat up too hard on a five-year-old article. But in case anyone reading it now might not know better, I want to mention that a lot of the reasoning here is plain bogus.

You don't do complex authorization on the client. If your backend is serving SSNs to a user who isn't authorized to see them, you've already lost. Trying to hide them in the UI avails you nothing beyond a false sense of security.

Cache invalidation is trivial. HTTP provides, in entity tags, a very friendly mechanism for checking whether a resource is stale without incurring an expensive refetch unless one is needed. Use it. Resolving write conflicts is more complicated, sure - exactly as complicated as it is to do on the backend.

It's true that SPAs are _differently_ complex. You're doing work on the client that'd traditionally be done on the server, and with different tooling and not all the same paradigms. But _more_ complex? Not once you understand it.

</comment><comment><USER19> Frankly I think both reasons given for the supposed greater difficulty of building SPAs are wrong- and that SPAs have been successful exactly because they're much easier to develop.

Additional logic tier: exactly the opposite is true. A SPA allows to get rid (almost) completely of the logic on the server, leaving there only a shallow layer of services. While traditional web applications always had the problem of a complex logic layer on the backend, with in addition the need to manage complicated interactions happening only client side (because even traditional web applications couldn't afford an entire page reload for simple things like reordering a table, displaying an error message, etc.). Part of the logic had to be replicated on both sides, with all the problems that it creates.

Data synchronization- again, given the fact that the entire state of the application resides only on the client and is rendered only by the client, data synchronization becomes trivial- it's just a matter of calling some backend service to store or retrieve the full state.

In short, the problem with traditional web apps is that they've always had the need to manage a state on the client as well as on the server; and the client's state was lost at every page reload, or either had to be sent to the server with some hack to be restored after the page reload. A nightmare.

</comment><comment><USER31> I'm pretty convinced that rather than shying away from SPAs (which is totally fine), we could solve this with an extra layer of abstraction.

Consider the Unreal network architecture: [https://docs.unrealengine.com/udk/Three/NetworkingOverview.h...](https://docs.unrealengine.com/udk/Three/NetworkingOverview.html)

When Tim Sweeney needed to make an engine, he didn't simply hardcode each of the tasks: Update position, update velocity, play animation...

Instead, he created a system that allowed those things to become implicit. They synchronize themselves across the network by default. There's no special logic required.

So when I look at SPAs, I see a similar sort of situation. Rather than hardcoding each of our endpoints, why don't we come up with a system where we can synchronize some variables from the server to the client? Then adding some new data is as simple as declaring a new variable. No need to create an endpoint for every single thing.

This is vague and handwavey, but there's an underlying idea here worth examining. It seems like we could leverage abstraction in a way that unifies these systems (as opposed to simply shoveling another layer of abstraction on top of the current pile).

Has anyone been working on anything like this?

<comment><USER32> Like Firebase? [https://firebase.google.com/](https://firebase.google.com/)

<comment><USER31> I meant aimed specifically at SPAs. Firebase is nice, but it doesn't really help reduce code bloat on the front end. E.g. if you're making a react app, your instinct is to reach for redux + reducers, even though that means dozens or hundreds of lines of boilerplate code.

<comment><USER33> In my experience you can/should skip redux if you use firebase-firestore. One good reason is that if you try to use them both, you will end up writing a lot of "mee too" action and reducers that will just wrap firebase update events. It is really not necessary to always use Redux.

</comment></comment></comment></comment><comment><USER34> Yea, there's this guy telling us about the biggest SPA in the world (spoiler it's azure) here: [https://vimeo.com/156417164](https://vimeo.com/156417164)

It just so happens to be the worst UI whenever I need to use it. Just awful.

</comment><comment><USER35> The answers to the first difficulty are called "Universal Rendering" and "Isomorphic Rendering". Universal Rendering will render the page at any URL server-side, then the client will render other pages from there. Isomorphic Rendering is a special case of Universal Rendering in Node.js apps where the same JavaScript code is used to render pages in the client and the server.

Anyway, the article is right. Of course presenting users the current state of things in real time and allowing them to mutate this state in real time will always be harder than issuing requests to query the current state and requests to mutate the current state. It'll always be harder because it's way more complex and powerful from a user perspective.

</comment><comment> dane-pgp The article helpfully considers the issue of logic being duplicated across layers, and questions the choice of potentially unnecessary layers of business logic being in the architecture at all.

I wonder, though, how this changes in a modern world of web services like Amazon's, where your web host provides REST APIs to talk to your database (e.g. DynamoDB), and you can serve your SPA as static files out of an S3 bucket, not needing to worry about server-side code at all.

Taking out the server layer altogether may not work if you need a specific user auth model which your web services provider doesn't support, but this simplified serverless model has the advantage that attackers can't hack your server code if you don't have any server code.

</comment><comment><USER36> The frameworks that are popular at the moment make it harder.

I put together a simple set of frameworks, engines and libraries that let me build real-time SPAs really quickly and easily. I've built a complex production app with it in a couple of weeks and it works really well. I tried to promote it a while ago and those who tried it seemed to really like it but it never became popular.

Promoting technical solutions these days is literally impossible if you're not a rock star developer.

I don't even care about promoting it anymore. It's my own secret toolkit now.

If people want to believe that SPAs are harder to build, that's fine. But I'm going to keep building them because for me with my tooling of choice it's much much easier.

<comment><USER12> If it only took you a couple of weeks to build it isn't a complex production app.

<comment><USER36> Complexity is a relative term.

The app I built has sign up, sign in, password reset, subscription-based payment processing, usage quota tracking, email verification, GitHub integration and supports different account permission levels and it can scale out indefinitely to pretty much any number of machines. I built it from scratch. Also it has fade in and fade out transitions when navigating between pages and all data throughout the app updates in real time... So for example if you do email verification in a different tab, your main dashboard will update in real time.

And it only receives real-time updates for pages that you're actually looking out so it doesn't over-fetch.

</comment></comment></comment><comment><USER7> This whole extra logic tier comparison doesn't make much sense to me. The same logic exists on the server side anyways, you're just moving it to the client. It's not like making a site without substantial amounts of JS is really an alternative. You generally can't just do everything with form submissions.

</comment><comment><USER37> Your first point is dead on but your second point is way off and I would actually say the harder point is SEO. My clojurescript app is excellent at keeping front end and back end perfectly synchronized across many clients. However, my ability to generate pages that can be SEO'd is not as easy.

</comment><comment><USER38> Single Page Applications? Bah Humbug!

[https://wildermuth.com/2014/9/1/Single_Page_Applications_Bah...](https://wildermuth.com/2014/9/1/Single_Page_Applications_Bah_Humbug)!

</comment><comment><USER39> For webrtc apps you really need a SPA, currently I use vue2. If you leave the page you lose the session. There are other html5 APIs that are also much happier within an SPA, like webmidi and webgl. But for text based crud apps rails is still the best way to go. Or express and ejs. If you're not using advanced APIs turbolinks is often a better way to make your app spa like within incurring spa pain.

</comment><comment><USER40> It's not that there's an additional layer, the rendering of the view was always there, just tightly coupled to fetching data from the DB.

It is now a better practice to create a BFF that can serve more clients than just browsers.

<comment><USER41> It's not tightly coupled to the database, it's just not on the browser. And because they aren't tightly coupled, you can still make the renderer the client of your REST/gRPC API just as you would the browser. Or it may be more practical to have your non-browser clients talking to your API while your renderer talks directly to the database.

<comment><USER40> Your second choice is just coupling it again. I've only seen few frameworks that let you render both HTML and json (Ruby on Rails).

You still have to map a model to HTML, regardless.

<comment><USER41> Yes, that's my point. Decoupling it for the purpose of supporting multiple frontends may not be more practical than leaving it coupled and providing an API for other frontends.

</comment></comment></comment></comment><comment><USER42> considering this was written 5 years ago, these points are invalid with today's frameworks.

<comment><USER43> thats my feeling. nuxt renders a lot of these difficulties moot

</comment></comment><comment><USER44> (2013)

<comment><USER45> Thank you! We've updated the headline.

</comment></comment><comment><USER46> "But if you're building an app that honestly is only going to serve 10 people, or 100---or 1000---do you really want to incur higher development and maintenance costs just for the sake of pushing the user-experience envelope?"

Yes, because modern tooling makes it pretty much as easy.

</comment><comment><USER47> Disagree, but if you can't take the heat get out of the SPA business.

*Ah, I see this was from 2013, makes sense. I wonder if they still hold the same opinion today?</comment>