Show HN: Smart CSS viewer  tailored for Designers - csspeeper
https://csspeeper.com/
======
23andwalnut
It's well designed. It would be nice if the export functionality generated a
css file with typography + colors.

------
egfx
Home site seems to have CSS layout issues on my Nexus 6p.


I've never felt less in control of my own hardware - mildbyte
https://kimonote.com/@mildbyte/ive-never-felt-less-in-control-of-my-own-hardware-14804/
======
jimmies
>In 2016, when I got a new phone, the default setting changed and I would just
wake up to my device stating, "Tinder has been updated. Deal with it".

I turned off auto-updates on my phone.

So this happened. Last year or so I traveled to SF and tried to call an Uber
home after a long day of walking around. My phone had 5% battery left. I
opened the app and there it was... The maps and everything showed up, but then
it blocked the UI with the message: "You haven't updated the app in a month.
Uber won't work if you don't update it right now." It really rustled my
jimmies. In the next 15 minutes, 3 of us (2 are foreigners with no cell
connection) had to stand in the freezing rain when the damn thing was updating
with my 2.5G connection. When the Uber arrived, I had 1% left and not long
after I got in the car, my phone shut down. I was so worried the phone would
die before the car arrived.

The other day I talked about how backward-compatible Google Maps is and
unfortunately it made the news on Slashdot. Some people were like, oh yeah,
Windows is backward compatible with 30 years old apps. Are you a millennial/a
shill for praising them for supporting their API for 10 years? Yeah, keep
talking about Windows, until you fucking use some of the apps nowadays that
wouldn't work when you haven't updated them in a month.

~~~
radarsat1
I agree with you. But..

> "Tinder has been updated. Deal with it".

is an interesting choice of example. The anger at updates only really makes
sense for apps that are entirely local to your hardware. As soon as you have
an app where part of it runs on a server that you don't control, that logic
goes out the window. They can stop your non-updated app from working with no
effort, just by making the server API incompatible. As long as you are
depending on someone else's server to be up and responding and not changing,
you give up your rights to be in control of local updates.

It sucks, but that's the reality of SaaS. I'm a fan of using local apps
whenever possible. For instance, Google Docs is just too damn useful not to
use sometimes. But I still, majority of the time, will choose to use a local
word processor whenever I can get away with it. And when I'm done working on a
Google Docs project, I download it in several formats and put it in the
drawer.

In the meantime I'd really like to see more take-up of open source, federated
hosted solutions based on open document standards and open protocols. But so
far the big corporations are winning that game.

~~~
ryandrake
The anger is still valid because at the end of the day, the software (that
used to work) no longer works due to a choice made by the company that makes
the software. To the end user there is no difference between "making a
breaking API change on the server" and "pushing a native update that disables
the app".

This may be the current sucky reality of SaaS, but it could be fixed if the
market demanded it.

~~~
Analemma_
> but it could be fixed if the market demanded it.

Meaning, effectively, that it will not be fixed.

I understand the frustration. I work on a mobile application that, like Uber,
relies on a lot of server-side communication and deliberately stops working if
the client is out of date. And I do know that this sucks.

But the reality is, our API is non-public, and so there is no pressure from
anyone to maintain backward compatibility. And I have a thousand features that
need to ship, with not enough time as it is, or I will start getting heat from
management. Abandoning the cadence of "constant breaking changes bundled with
client updates" would slow development considerably, for no gain except the
one-hundredth-of-one-percent of HN weirdos who care about this stuff. It's
just not going to happen.

~~~
yousir
> but it could be fixed if the market demanded it.

The market (my mom for example) is unaware there is a fix.

> there is no pressure from anyone to maintain backward compatibility.

You and your manager are both part of the problem. And the phone makers,
because they invented a market place for shit companies that wants to ship
unfinished software and push daily updates to their users to eventually reach
a point where their API is stable.

There used to exist software developers who took great pride in (API)
backwards compatibility. These days, where are they? My guess is they have
been overrun by the a huge crowd of new people who have never maintained a
backwards compatible API and who don't know how to. Management love fast-
moving people who say "yes sir" and "not a problem sir".

~~~
ryandrake
This is a good point too. There are people unaware of the better way! The
world is coming, where one day there won't be anyone left alive who remembers
things like:

1\. Software that would work, un-modified, for decades.

2\. Software that worked without access to some back-end.

3\. Software that didn't require permission from a third party to run.

4\. Software that didn't collect personal data from users.

5\. Having root/admin access to your own computer/devices.

We can still prevent this from coming true, but it's going to happen if nobody
pushes back on these practices.

~~~
RcouF1uZ4gsC
There is no money in selling software apart from a service these days. Part of
it is due to the open source movement and expectation that the software is
free while you pay for support/services. Software as an entity that you buy
apart from a service has been devalued.

------
therealmarv
Auto Updates without user interaction is the biggest security benefit I can
think of for a normal user. Yes you read that right. It's f*cking great that
my parents can use an always up to date browser and OS and I don't need to
worry if they have updated all their stuff. Update mechanisms like for Java
and other stuff which pop-up and require user interaction are a thing most
people will not get right. Actually I really like the Chrome OS approach where
it's done continuesly in the background. Not all people want to know what's
going on under the hood and how the motor of their car works exactly. Some
people just want to drive securely from A to B.

~~~
robotsonic
I agree that there are certainly benefits to auto-updates, but where I tend to
dislike them (especially on the phone), is where I have infrequently used
apps.

To stick with the Uber example, I don't live in a city with Uber, but have it
on my phone for when I am. Why do I need to be burdened with using my data to
constantly update an app I use once a year. This applies to a lot of apps
(airlines, games, etc.). Games are really the worst offender as they tend to
be quite large. Where release notes are provided in the app store, I will
update if it is related to a critical security vulnerability, or something
legitimate, but find it hard to rationalize constantly downloading 100+MB apps
doing this for minor bug fixes that impact 0.001% of an apps user base.

~~~
afterburner
> burdened with using my data

There's usually a setting that forces updates to only download over a Wifi
connection.

~~~
robotsonic
I do only do updates on wifi, however, internet is both expensive and data
caps are quite low where I live. I'd rather watch one more Netflix show than
download an app I don't often use four times a month.

I agree with the comment below about this being an argument for delta updates.

------
ohazi
You know, you could have even stopped at the car analogy, because modern cars
are actually doing this and it's fucking terrifying.

[https://news.ycombinator.com/item?id=16374464](https://news.ycombinator.com/item?id=16374464)

~~~
gnode
I can certainly imagine the dashboard becoming real estate for ads.

~~~
samfriedman
When your car is fully self-driving, I'm sure you will be able to get a
discount on the sticker/rental price by agreeing to view some ads on the in-
car screens while you ride.

~~~
ryandrake
Sure, it will start that way. But we all know how that feature will progress:

1\. ads play by default, with an option to pay to remove

then to:

2\. forced ads with no option to remove, and the car won't run unless they're
playing

~~~
tokai
3\. dynamic rerouting our your drive to maximize utility of cityscape ads

------
PascLeRasc
I've been thinking about this a lot lately. I just reactivated my old Android
phone yesterday for fun and as soon as I put the sim card in the phone started
blowing up with notifications about old voicemails, ones I never saw on my
iPhone I had just had it in. There were about a dozen voicemails from the past
six months from jobs I had applied to and heard nothing back from, or had a
preliminary phone interview with, asking me to call them back to schedule
something. I mentioned it to my sister, who moved from Android to iPhone the
same time I did, and she did the same thing and found a bunch of voicemails
from a college she's recently applied to asking if she can send them some
piece of paperwork. It's so frustrating that we didn't know that these
voicemails existed.

I think the fundamental problem is that to make these technical products like
mobile OS's and email apps you need to be so far into tech that you can't
really imagine what it's like to be a casual user. This is why I don't
consider software engineering to be on the same tier as other disciplines of
engineering. Yes, civil engineers make bridges, but they use them in daily
life exactly the same as regular people do - the same goes for electrical
engineers and power in the home, and mechanical engineers and vacuums/air
conditioners/bicycles. When you make software, you look at all software
differently and you lose the perspective of a regular person.

------
amelius
And the worst part, for me, is that we engineers are inflicting this upon
eachother, driven by money and business-types with lock-in business-models.

We desperately need a code of conduct for engineers.

And/or we need certain types of businessmodel to become outlawed.

------
zanny
This is why I go out of my way to only buy phones that are going to be very
well supported by LineageOS for a long time.

You can go Google-less on such devices if you want.

The only real limitation is that you cannot do anything about the super-
privileged proprietary modem that simultaneously can spy on you at any time
that also prevents you from running newer kernels on your hardware because of
how evil every Android vendor is with their proprietary bits.

At least there is finally momentum to kill the ME / SP backdoors on desktops.
Its going to be much harder to do that on mobile since the only way to use
cellular networks is through these proprietary black box modems.

------
bhnmmhmd
We were afraid that AI will take over and take away our freedom, but I think
some companies have done a great job at ruining their products, and our lives
as well.

~~~
TAForObvReasons
We are finally facing the ramifications of short-sighted decisions years ago.
In the race to the bottom where a plurality of people opted for "free" or
"cheaper" options, not enough people cared about how money is made. Companies
like google aren't charities, so profits would have to be extracted
irrespective of the dubiousness of the approach. The current situation was
predicted by many.

------
seorphates
It's an interesting (but mostly depressing) problem. The insistence that
"others must be in control of what you own" doesn't really sit well with me,
at all. I won't drive a phone without root, for instance. Otherwise the
plethora of updates I have sitting around not being updated would do nothing
but eat data with garbage updates with naught but a new roll of advertisements
and, if you're unlucky, new garbage access requests. Update the os? Yeah, no.
Not on your watch, at least.

A firewall, for instance, is a basic necessity. Even the crude android
flavors. It includes the ability to lock out your "vendors" selectively and
accurately.

My build is, hm, approaching it's fourth year, I think. No auto updates save
for select apps. No complaints. No surprises. But I'm special, I don't do
"phone for fun" and so have a fairly limited and hardened short list of
requirements.

The most annoying thing on android is Google XXANY - by a wide, wide margin.
I'll be itching to build a google-go-around on my next handset, for certain.

Save all those apps you like, for sure, I still depend on side-loading quite a
few that have since gone by the wayside. At this juncture I have to take
absolutely every bit of control that I can get my filthy paws wrapped around.

------
tpaschalis
I understand that powers have shifted, and the majority of the people prefer
"free" email/chat/spreadsheets/storage, when "free" means "welcome to our own
special walled corner of the internet, give us your personal data and watch
these ads".

But why should in 2018 be so hard for one to be able to simply pay _once_ for
hardware or software, that puts the _user_ first? Is it impossible for such a
company to succeed at scale?

~~~
suprfnk
> But why should in 2018 be so hard for one to be able to simply pay once for
> hardware or software, that puts the user first? Is it impossible for such a
> company to succeed at scale?

Apple seems to follow that plan. For your "email/chat/spreadsheets/storage",
they have iCloud mail, iMessage, Numbers and iCloud Drive. You pay once, and
get software support quite a lot of years later. They don't seem to be selling
or gathering much data. They won't show you ads.

Now, it won't be RMS approved, but that's another debate.

~~~
CaptSpify
How is a company that gives you a locked-down device that they _drastically_
control, and refuse to provide source for "putting the user first" ?

------
kevin_b_er
And the DMCA prevents you from repairing the problem. Ostensibly to protect
copyright, but instead used to deny you ownership.

~~~
pishpash
Just like you use software by license and don't "own" it, hardware makers have
realized they can bilk with the same business model. It's no coincidence that
slime software companies are the ones making the current hardwares that have
such "features" \-- Apple and Google chiefly among them, along with the
ecosystem they created in their own image.

------
jim_dow_jones
Richard Stallman was right. We didn't listen!

~~~
acomjean
I heard Stallman talk at graduate school in the early part of this century.

I though he was a bit extreme at the time, but over time I've come to
appreciate his position. Having software be open and modifiable is really
quite an amazing thing. those open building blocks lets us do amazing things
with software quite easily.

Its time for an open source desktop os and software to go mainstream. We
realize that apple is not reliable making developer grade notebooks and their
unix underpinnings show that it is possible. Then onto phones. I feel open
source software will keep the hardware from being too weird

~~~
wvenable
All the open source software I use on daily basis auto-updates.

~~~
carapace
> “Free software” means software that respects users' freedom and community.
> Roughly, it means that the users have the freedom to run, copy, distribute,
> study, change and improve the software.

[https://www.gnu.org/philosophy/free-
sw.html](https://www.gnu.org/philosophy/free-sw.html)

Couldn't find anything specific in re: auto-updates though...

------
adreamingsoul
So, back to land lines with analog phones?

Serious question, do any phones exist that can fully owned by the user? For a
period, I was excited about the Ubuntu phone because of the fact that I could
have full control over it. Sad to see that project terminated.

I'm also interested in "dumbphones" that can use CDMA or GSM networks.

~~~
snark42
> Serious question, do any phones exist that can fully owned by the user?

Many (HTC, Google, ASUS, etc. - NOT Samsung) unlocked android phone can be
loaded with a variety of bootloaders and then flashed with the ROM of your
choice where you have full root access. Of course without google apps (Google
Play Store) your phone isn't all that useful, but you can install google apps
( maybe from a questionable legal/copyright stand point, I don't remember) and
have more control over the device.

Not sure if this matches what you mean by fully owned though. Checkout XDA
Forums ([https://forum.xda-developers.com/](https://forum.xda-
developers.com/)) to see what interesting things are out there you can do.
There's also LineageOS
([https://www.lineageos.org/](https://www.lineageos.org/)) formerly
CyanogenMod.

~~~
summm
Yes, but by unlocking you lose every bit of physical security that device had.
Anybody having physical access to your phone can then dump the phone's content
to a usb drive in kinutes and without any other tool than a otg cable. The
makers of the alternative recovery don't bother (who can blame them, they are
volunteers) and the manufacurers don't care to implement a proper bootloader
that would support reliable re-locking after installing a modified recovery.
Besides that, all this alternative software is distributed binary on shady
sharehosters by more or less random people on forums. Not exactly a good basis
if you wanted to re-gain trust in your phone.

~~~
silverdrake11
You can install LineageOS without root / usb debugging enabled

------
lisper
I have an iPhone 4S running iOS 7 (jailbroken of course) and an original MBP
retina running Mavericks. I don't update them because the risk of updating is
higher than the risk of not updating. Right now everything is working, and
everything is set up the way I like it. If I don't update, things might break
some day, but there is also a greater-than-zero chance that everything will
continue to work for quite a while. If I update, those odds drop to zero. Not
even a statistical approximation of zero, but actually zero. Updating is just
trading one set of risks for a different set of risks. I choose the devil I
know.

~~~
thinkythought
As someone also still rocking the original MBPr, the peak for it software wise
is actually El Capitan

I really, really wish i had never updated from that. It was faster, smoother,
and more stable there than it was before and after. Definitely way better than
Mavericks. I push this thing hard with premiere/ableton live/etc too.

~~~
lisper
My main problem with El Cap is that iPhoto won't work any more. I have a huge
investment in iPhoto -- tons of curated albums with no way to import them to
Photos (what were they thinking?), and no obvious alternative.

Also, I absolutely despise the El Cap design. The flat look control widgets
and icons, the barely visible grey text, the secret hidden controls that only
appear when you mouse over them, it all makes me cringe. (Yes, Mav has a few
hidden controls as well, but at least now I know where they all are. If I
upgrade, I have to go on the secret control easter egg hunt all over again.
Life is too short for that kind of bullshit.)

------
superasn
Also these updates drain the battery all the time and there is no way to tell
them to please stop.

At least on Android you can install "greenify app" but for that to work
properly, you need to have root and for that you have to unlock the bootloader
(for which you have to wait 14 days and also void your warranty). I mean wtf,
it's my phone but the design is such that a shit ton of crap always needs to
run in the background (looking at you google play services) and dozens of
useless apps that are always connecting just to show me more push
notifications.

~~~
aidenn0
My android phone was configured out-of-the-box to only run autoupdates when
plugged in and on wifi. It's easy to see because if I haven't plugged my phone
in for a few days, as soon as I do it starts updating like crazy.

~~~
rhizome
I do this too, and the most annoying thing is just to arrive home at the end
of the day and my phone becoming unusable because something, somewhere has to
update ASAP on WiFi. I don't even keep that many apps installed, but as sure
as eggs, something always needs an update.

------
bonsai80
Agreed. Looking forward to when I get my new phone:
[https://puri.sm/shop/librem-5/](https://puri.sm/shop/librem-5/)

------
scarface74
I can choose whether apps auto update on iOS devices but more importantly,
when I download something on my computer, I have no control of what the app
does. On my iOS device, I can be somewhat assured that it's going to be
somewhat trapped in a sandbox and only be allowed to do what I specifically
give it permission to do.

I wish that Apple would give you an option to not allow an app to access the
internet and not just disallow the use of mobile data.

------
Blinks-
Increases in complexity up the barrier of entry to any advanced system, but
lately it seems like things are made with the intent to make that barrier
impossible to overcome within the lifetime of the hardware. The right to
repair and open hardware standards are something we need to organize and push
for if we want to see improvements. After all it's been demonstrated time and
time again that we can't trust black box hardware.

~~~
maxxxxx
I think we are going more and more into the direction of renting almost
everything. If you use ebooks like Kindle you don't accumulate a book
collection. Same for record collections. Devices become useless once the
connected cloud service shuts down. Eventually we'll probably have cars that
get obsoleted quickly. I bet the same will happen for household and other
robots once they get more powerful. You will have to pay monthly rent to use
them.

~~~
deckard1
[https://www.wired.com/2015/04/dmca-ownership-john-
deere/](https://www.wired.com/2015/04/dmca-ownership-john-deere/)

Already happening. But everyone called RMS a kook. He looks funny. He talks
funny. He's a socialist. He smells. And here we are. People are praising
Apple-- _Apple_ \--for letting people pay money for closed software that, at
the very least, lives on their own device.

That's a low bar.

------
makecheck
When obtaining new apps or devices, you can’t tell if it is a worthwhile
investment because it could break in any number of ways. For your money, are
you buying 2 weeks of functionality or 5 years of it? It’s not even enough to
have a reputable seller because good apps are sold to terrible companies that
ruin them later, or the developer just decides to add new money-making schemes
later.

It seems that we need more guarantees (legally enforceable, i.e. you said you
wouldn’t update your gizmo to do X but you did so I get compensation).

------
DannyB2
Going through a "Linux phase"?

I started my "Linux phase" in 1999 and have never finished going through that
phase.

~~~
rconti
Apparently the author went through a "Linux phase", yes.

------
m_fayer
The GDPR is going in the right direction by creating a "bill of rights" for
your data, so ownership is firmly delineated and all 3rd party use of data
revolves around clear revokable granular consent.

What we need now is a "bill of rights" defining and preserving the notion of
ownership for digital devices. Part of that should be that the device should
only do what it's explicitly asked to do. Updates should be opt-in in nearly
all cases, and mandatory updates should meet stringent requirements similar to
vaccines. That is, only to combat major threats that apply to users as a
group.

------
oblib
Yeah, I feel that too.

After pressing the "later" button every time I picked up my iPhone for a few
weeks Apple quit asking and updated the "iOS" this past month.

It has "new features" they keep telling me I need and I've been pressing
buttons to ignore their "Learn how to use the new..." prompts since then.

With the exception of security updates I'd like very much if Apple left my
phone alone but it's not really "my phone". I just have a license to use it
and it says they can make changes to it.

The way that's been working for me does not entice me to buy new phones from
Apple.

------
PricelessValue
That's exactly how I feel about software ever since I got acquainted with
windows 10. Do you best to remove all the junk. Then they keep reinstalling
their "malware" until they finally remove the option of disabling or removing
their malware.

It feels like we are losing more control and access over tech - both software
and hardware. Some companies are trying their best to turn tech into a black
box which we aren't allowed to peer into.

------
wozer
Especially nice when the updates break your computer, as it happened for a lot
of people with the Spectre mitigations.

I dread the Internet of Things.

------
Hasknewbie
> "Thankfully, running a System Restore worked and the next update didn't have
> these problems, but since then I stopped allowing automatic updates"

It is now possible to disable automatic updates in Windows 10? (Asking because
forced updates is what made me switch to Linux in the first place.)

~~~
stordoff
In Windows 10 Pro, you can with Group Policy. My machines are set to "Notify
to install" \- it's not ideal, as Windows Defender updates use the same path
so it's triggered at least once a day, but a small system tray notification of
"You need some updates" is an improvement over the more forceful notifications
and unexpected reboots.

------
true_tuna
The real issue is loss of control. “Ask me again later” is dehumanizing
because it robs the user of agency. I can’t imagine how a forced windows ten
update would have felt. Studies have shown (not to mention common sense) that
a feeling of lack of agency is depressing. I recently quit the Mac OS after 20
years of rabid fandom, over the feeling that I wasn’t the one in charge of my
Mac. Linux still lets me own my gear and I have to say that a few unpolished
areas are worth the renewed sense of agency. Unfortunately there’s no user
positive answer for mobile. Android is even worse than iOS. Maybe the black
phone will free us from this insanity and put the user first again.

------
neves
Now I fell that I can't buy a piece of hardware or install a software that
doesn't install an server and an update service. My powerful desktop machine
has dozens of services, from Adobe, Google, Microsoft, Razer, Logitech, etc.

I must turn them all off by hand.

------
jurschreuder
First you had the motherboard, processor and ram. Now they are on one board.
3x less control. Plus you want a super slim design so you cannot get a desktop
anymore. Actually you've never been more in control of your own hardware. Tiny
teams make their own computer like the Raspberry Pi now.

~~~
jrs95
Yeah, it seems like the name is a little misleading. The _reason_ for "I've
never felt less in control of my own hardware" is the software for the most
part.

------
v1nc
First thing I thought after reading the headline was "another windows user
complaining about updates" and i think that's just how it is after reading the
whole article. The author shows up some problematic points of the development
of handling updates. But if he spend the time thinking about these problems in
actively doing something about it, there only would be a few things left to
complain about. I'm sure there are some services that are not replaceable and
use update methods like mentioned in the article. But this doesn't happens by
accident. If the developes of a service choose such update methods, either
it's likely that you can see some other problematic decisions the developers
made, or the old service you are trying to run is not safe to run and has to
be updated before it's safe to run. As i notice such problematic decisions, I
avoid these services or search for alternatives before I would complain about
it, and this never happend.

------
rafi_kamal
As a developer, it makes sense to break backward-compatibility if only a very
small percentage of your user base is using the old version. Supporting old
versions often requires extra resources that I can otherwise spend on building
new features.

------
batmanbury
Apple won't even let me delete auto-downloaded iOS updates anymore. They just
download when I'm not paying attention, in the background, and take up
anywhere from 500mb to 1gb of hard drive space, forever. Unless of course, I
update.

------
enlightenedfool
If there are enough people that don't want stuff to happen, it won't happen.
Unfortunately you are in a minority. People do have power and choice.

~~~
TheRealPomax
That is a statement I would really love for you to investigate the validity
of, because there is nothing in the real world that supports that as a
universal claim. If an industry has an established pattern and the only people
who want that pattern to change have no influence (for instance, "not buying a
cell phone" is not an option, whether you live in the US or rural Vietnam)
then it doesn't matter how many people "want" that change, they have no
leverage to effect it.

------
brwsr
I have a HP zbook laptop that cost me about 3500 euro's. Recently I changed
some trivial settings in the BIOS. After I saved and reboot the laptop hung at
the bios stage. There was no way to get back into the bios and the keyboard
was blinking a code that I had to contact HP.

They had to replace the entire motherboard due to a corrupted BIOS. So it was
caused by a bug? The repair cost were about 800 euro's..

------
nofunsir
I _thought_ something was fishy at google images today! What a shame.

------
codedokode
New version of Skype RT and Opera Browser have no option to disable automatic
updates. Probably they understand that nobody wants their updates that only
bring new bugs and more ads.

------
isaiahg
I agree wholeheartedly with everything except for pocket. I've never had a
service like that become so integrated in my life so fast. I don't even use
bookmarks anymore, it's just easier to pool it all together and tag it
relevantly. The suggested news is astoundingly fine tuned to my interests as
well, much more so than other services that claim to do the same thing. It's
become my favorite time killer now just to go through my suggested articles.

Now if only they can keep from screwing with it and mucking up the great
service with updates. They could literally do nothing else to it and I'll be a
lifelong user. I'm not optimistic though...

~~~
TheRealPomax
Do you disagree with the fact that it popped up without notice, or do you
disagree with the fact that the person who wrote this article didn't like
having it get installed without notice?

Because the most important part of this writeup is that it's almost devoid of
judgement calls on whether what the updates do are actually good or bad, it's
about the lack of control and the lack of any ability to beforehand tell
whether it's going to be good or bad.

If you love pocket, rock on, but maybe you would have also discovered that if
you had been suggested to opt in to it for a few days, to see if you'd like
it, rather than it suddenly being not just on your computer, but fully and
irrevocably integrated into your web browser. And that maybe is literally
that: maybe. We'll never know, because you were never given that option.

~~~
isaiahg
My perception is probably warped by the fact that I used pocket before I moved
to firefox. So after I downloaded firefox after years on chrome, it was a very
pleasant surprise to see pocket already there. And to me it was an added
value.

But that makes me wonder, is this just an age old gripe with change in general
or does this actually add anything new to the conversation. Will we get
articles in the next 10 years about how pocket was better and they don't feel
in control of their computers because firefox moved to a new system and
changed a menu entry?


Former Yahoo CEO Marissa Mayer Creates Tech Startup Incubator - utopcell
https://finance.yahoo.com/news/former-yahoo-ceo-marissa-mayer-010100774.html
======
hknd
I really like how this appears on the yahoo frontpage (:

~~~
utopcell
Yahoo news are not biased!


Ask HN: Job board dedicated for employees accepting payment in Bitcoin? - noidax
I always found taking payments in bitcoin a lot easier than accepting bank transfers, etc. Is it a good idea to start a job board dedicated to employees who are willing to take payments via bitcoin. Share your thoughts please.
======
sharemywin
me personally I would stay out of the transaction part of it. pay for a
listing or for contacting. probably would be freelancers I would think.


HTML5 Security Cheatsheet - thibaut_barrere
http://html5sec.org/

======
vog
I find the title very misleading. Although this website seems to be a nice
summary about HTML5 security, I don't see anything that qualifies as "cheat
sheet". That title seems to be pure link bait.


Go implementation of Apache Arrow - throwaway894345
https://github.com/influxdata/arrow
======
arnon
I admire people who go through libraries and re-implement them, especially
because I found Arrow (and Parquet) code very annoying to understand.

The documentation doesn't cover the design decisions that the crew took, and
what the concepts are in-depth.

At least Arrow improves upon Parquet, by actually adding a type for INT_8 and
INT_16, which for some reason Parquet actually stores as (a less efficient
column of) INT_32s.


128-bit storage: are you high? - iuguy
http://blogs.sun.com/bonwick/entry/128_bit_storage_are_you
======
acabal
The most interesting thing in this article is the reference to "Ultimate
physical limits to computation." It's something I never thought about before
and honestly it kind of blew my mind a little bit...

~~~
sammcd
A proffessor once told me never to believe the physical limits. He mentioned
how a wavelength of light was the smallest we could etch silicon. He then
mentioned that today (at the time of the class) we were etching with 1/20th
the wavelength of light.

He then said that he could not explain how the new 1/20th of of a wavelength
drawing works because new physics had been learned, and it had not been in his
physics book.

~~~
jessriedel
Your sentiment is healthy, but you should distinguish between "we don't know
of a way to do X" and "X is impossible under the current laws of physics". The
former is like etching sub-wavelength silicon. The latter is like moving
faster than the speed of light.

> new physics had been learned, and it had not been in his physics book.

Again, there is a difference between learning new techniques and phenomena
running on top of known physical law, and learning new fundamental laws. When
engineers say "new physics", they refer to the former, but when physicists say
"new physics", they refer to the latter. And there hasn't been any new
physics, more or less, since the 60's.

The computational limits are thought to be encoded in the fundamental laws, in
a way very analogous to the limiting speed c.

~~~
rbanffy
> "X is impossible under the current laws of physics"

I think the keyword here is "current".

While the development of "new physics" is unlikely, those developments have
never failed to surprise us before. We have ever increasing capabilities to
both explore and observe the world around us. I find it highly unlikely that
we have cracked all there is to physics.

~~~
ithkuil
btw, even with the "current" laws of physics the energy required to boil
earth's oceans is not that big [http://pinktentacle.com/2010/09/animated-
simulation-of-aster...](http://pinktentacle.com/2010/09/animated-simulation-
of-asteroid-hitting-earth/)

While all this discussion about the actual laws of physics is very important,
I would like to underline the fact the the other half of the reasoning about
whether 128 bits are enough is centered around the fact that we are of course
not able to handle that amount of energy, it sounds so obvious for all of us
that this argument is used as a punchline.

While I cannot imagine how it could be done (or why), this is the kind of
things doesn't involve changing our knowledge about basic physical laws.

------
MaxMorlock
The 128-bit storage of ZFS reminds me a bit of TeX. As far as I can remember
reading the TeX book, Don Knuth also wanted to play it safe. Internally,
everything relies on integers (no floating point operations), and the smallest
internal unit of measurement is less than the wavelength of light (don't
remember the color ;-) ).

~~~
andrewf
At least one game programmer is recommending sticking with integers for
distances. " 64 bits of precision gets you to the furthest distance of Pluto
from the Sun (7.4 billion km) with sub-micrometer precision. "

[http://home.comcast.net/~tom_forsyth/blog.wiki.html#%5B%5BA%...](http://home.comcast.net/~tom_forsyth/blog.wiki.html#%5B%5BA%20matter%20of%20precision%5D%5D)

------
sedachv
Fun fact: the AS/400 virtual instruction set uses 128-bit pointers (that get
truncated when executing on a real machine). It's not excessive considering
that the AS/400 is not only a flat-memory architecture, but a single-level
store.

I think storage will eventually move to the Venti model of hash addressing. It
just makes much more sense on a network and with current archive-everything
practices (there are some really big wins to be gained from compression and
dedup there). BitTorrent is doing this already.

~~~
konad
venti rules hard :)

------
iwr
One day, aliens will use our oceans as heat sinks for their great galactic
computer. And even then, ZFS will serve them well.

~~~
rbanffy
We can use a ZFS storage system to make the moons of Saturn inhabitable.
That's Sealand taken to a whole new level.

The network latencies are terrible, however.

~~~
count
Charles Stross wrote a book loosely incorporating this concept (Accelerando, I
think).

------
vilhelm_s
I'm not sure that the computation is completely to the point -- he starts out
asking "what is the _smallest_ storage unit that could fit this many bytes",
and then goes on to consider how much energy it would take to do so. But if we
are primarily worried about energy usage, we can write it cheaper (at the
cost, I guess, of using more mass for the storage medium).

The usual limit that is mentioned for storage is Laundauer's principle
(<http://en.wikipedia.org/wiki/Landauer%27s_principle>), which states that we
need to use at least ln(2)kT Joules of energy to write one bit, where k is
Boltzmann's constant and T is the temperature of the storage system.

Assuming the best case T=Cosmic Background Temperature=2.7K (although this is
optimistic since we will also be heated up by the sun and by the Milky way),
this give 8.8e15 J to write 2^128 bits, or 3.6e19 J to write 2^128 512-byte
blocks.

That's much less than what Bonswick calculates, and less than the energy to
boil the ocean!

~~~
vilhelm_s
In fact, here's a more down-to-earth idea of a high density storage: use a
diamond crystal, with C-12 atoms for 'zero' bits and C-13 atoms for 'one'
bits. (I learned about this idea from Charles Stross' blog). While it's not
obvious how to read and write this, the concept is clearly not ruled out by
the laws of physics.

Then storing 2^64 512-byte disk blocks requires 1.5 grammes of diamond (7.5
carats), while storing 2^128 blocks requires 3e16 kg (a ball of diamond with a
radius of 12 km).

2^128 is a big number, but perhaps not big enough to last us through the
singularity.

------
TheNewAndy
It can be useful to have a large address space, even if you don't have enough
hardware to actually populate the whole thing.

For example, you might split the address space into smaller sections
(executable, read only, read/write, shared, etc) which immediately cuts down
the space you have. Or you might decide that your method for allocating space
is to pick a random part of the address space, and check if it is taken (or
perhaps something slightly cleverer). In this case, you will get better
performance if there aren't as many collisions.

~~~
celoyd
Or you might have some highly drive-abstracted representation where every
addressable thing in every _version_ of a filesystem-like dataset has its own
address. No one’s asking to do that now (as far as I know), but if we get 128
bits I bet we’ll come up with ways to use them.

------
pyre
A (2004) at the end would be nice.

      > I've had people tell me every year, for years, that Moore's Law was
      > about to end. I've said the opposite, and have yet to lose the bet.
      > Limits on spot density are fundamentally arguments about 2D storage.
      > Once we move into 3D -- and this work is already underway -- we will
      > get many more orders of magnitude to play with.

This comment was made in 2004. Where are our '3D' storage devices?

~~~
space-monkey
[http://www.electroiq.com/index/Semiconductors/sst-
blogs/chip...](http://www.electroiq.com/index/Semiconductors/sst-
blogs/chipworks-blog-display/blogs/sst-
blogs/chipworks/post987_7451506051585892995.html)

I doubt he was thinking flash memory at the time, but 3D storage is already in
use. One of the bigger limitations with this is heat, so we have people
writing papers like:

[http://scholar.google.com/scholar?q=Thermal+via+placement+in...](http://scholar.google.com/scholar?q=Thermal+via+placement+in+3D+ICs&hl=en&btnG=Search&as_sdt=2001&as_sdtp=on)

~~~
pyre
I'm not sure if that really counts as 3D storage though. I'm pretty sure that
the commentator was referring to holographic storage, which would
theoretically have a higher information density, and actually _use_ the third
dimension for data storage.

Unless I'm reading those links wrong, they are just stacking flash memory on
top of each other. How is this different than finding a way to pack hard drive
platters closer together? You're just taking several 2D storage mechanisms and
stacking them on top of each other. You're not using the third dimension for
anything.

------
ten7
Nice article, great calculation. There's a much simpler argument for 128 bit
storage though: the observable universe has at minimum 10^79 atoms in it. Even
if you could use each and every one of those atoms as a bit to store data,
you'd still have more than 50 ORDERS OF MAGNITUDE left in ZFS for the rest of
the data. We're probably safe.

~~~
aw3c2
10^79 =
10000000000000000000000000000000000000000000000000000000000000000000000000000000

2^128= 340282366920938463463374607431768211456

~~~
ten7
Ahh shit, totally lame brained that.

------
mayank
Wouldn't a better calculation involve (2^64 + 1) bytes of storage, or even
2^65, instead of going for the upper bound at (2^128)? In other words, what's
the _minimum_ energy requirement for 64 bits to be insufficient?

A neat calculation for the wow-factor, but not really very informative.

------
jing
Yes, this is theoretically cool and all, but when I hear something like:

"Let's start with the easy one: how do we know it's necessary? Some customers
already have datasets on the order of a petabyte, or 250 bytes. Thus the
64-bit capacity limit of 264 bytes is only 14 doublings away."

It raises a huge red flag from a business point of view. In 2004 "some
customers" had datasets that would cause issues sometime around 2015 - a
problem that ZFS purported to solve (among admittedly much more relavant
features). In planning for a future that was possibly ten years away for "some
customers" instead of focusing on what was relevant to the larger customer
base, Sun managed to continue their slow profitability death march until
Oracle finally snatched them up this year.

Something to keep in mind when you decide to add "cool theoretical feature X"
or "unparalleled scalability" to your four month old startup...

~~~
nl
ZFS has been one of the biggest selling points for Solaris over the last 5
years. There are a huge number of places that use Solaris _only_ for ZFS
support. For example, the SmugMug people have written about it a number of
times.

~~~
jing
ZFS may have been, but not the 128 bit support. I mentioned that there are
"admittedly much more relevant features" which are in fact what smugmug likes:

"ZFS is the most amazing filesystem I’ve ever come across. Integrated volume
management. Copy-on-write. Transactional. End-to-end data integrity. On-the-
fly corruption detection and repair. Robust checksums. No RAID-5 write hole.
Snapshots. Clones (writable snapshots). Dynamic striping. Open source
software."

<http://bit.ly/bg2xlf>

I never disputed ZFS being a good file system. I claimed that 128 bit support
wasn't a key feature and was in fact a potential waste of time.


Is there a company that sells meal planning? - loorinm
I'm spending so much $ on Munchery, because I am not good at planning my shopping / cooking / eating. I have a small repertoire of cooking recipes, I don't know whats seasonal, etc. Also, planning just takes a lot of time.
Is there a service I can pay to just give me shopping lists and quick easy tasty recipes each week?
Then I can just put the shopping list into instacart and be ready to go.
I know there are a lot of shitty recipe websites and outdated cooking blogs but I'm looking for something quality and reliable, with an easy-to-use experience.
======
Rannath
The Ontario government has you covered:
[https://www.eatrightontario.ca/en/MenuPlanner.aspx](https://www.eatrightontario.ca/en/MenuPlanner.aspx)

~~~
loorinm
HAHAHA

------
retroafroman
Isn't that what Blue Apron is for?
[https://www.blueapron.com/](https://www.blueapron.com/)

Still kind of pricey at $10/meal.

~~~
loorinm
no but they sell you the food too. I want to just get the food from the cheap
mexican market near my house.

------
justsorneguy
[https://emeals.com/](https://emeals.com/)

~~~
loorinm
yeah that looks like the right idea but that site looks 20 years old. is it
even still working?

~~~
justsorneguy
Yes, it is. I use it (the featured meal this week is Cuban-Stuffed Pork
Tenderloin), and like it quite a bit. They have menus for restrictive diets as
well as menus to take advantage of sales at certain food retailers. Their menu
is better than their website (which actually is better than it used to be),
and they have a decent android app.. They have a free trial, check it out -
[https://emeals.com/account/trial.php](https://emeals.com/account/trial.php).


Ask HN: How hard would it be to allow 120 character titles? - curtis

Hacker News currently limits submission titles to 80 characters.  Brevity is often good, but I've found 80 characters painfully short more than a few times -- especially for science articles.  I can't imagine that it would be technically difficult and I don't think we're likely to see any major increase in title abuse (Reddit-style editorializing in the title, for example) since the HN community is pretty ruthless about flagging submissions if they see a problem.
======
chris_j
Do you have any examples of specific articles with titles that would benefit
from a longer limit?

~~~
curtis
Here's a couple of examples from my submission history. I've probably got
better examples if I search farther back.

      a) Isaac Asimov wrote a “paper” about a time-hopping compound called thiotimoline
      b) In 1947 Isaac Asimov wrote a hilarious spoof of scientific papers about a time-hopping compound called thiotimoline

The first version is the title I submitted under. The second title is the one
I would have liked to use. The first is 78 characters and the second is 115.

Here's another one (66 and 115 characters):

      a) Saroo’s Google-Earth Quest: How an Orphaned Boy Found His Way Home
      b) Years after getting lost at a train station, Saroo searched for his birth home using hazy memories and Google Earth

Another thing of note is that you can often squeeze a title down to 80
characters or less, but it really takes a lot of time.

~~~
chris_j
For me, I don't think that the longer titles are any better than the shorter
ones, at least for the examples that you give above. Looking at the articles
themselves, they have completely different titles to the ones that you picked
(both the short and longer versions). This goes against the Hacker News
Guidelines [0] which state: "...Otherwise please use the original title,
unless it is misleading or linkbait." Indeed, a general rule on Hacker News is
not to editorialize headlines (ie make up headlines that look good in order to
attract people to click on the link).

This does of course raise the question of whether the Hacker News Guidelines
are a good idea or not and I am torn on this one. On the one hand, I suppose
there are occasions where a headline can be made clearer and more useful by
rewriting it. On the other hand, I see the current guidelines as a backlash
against the state of linkbait headlines on Reddit when Hacker News was first
created all those years ago.

[0]
[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

------
krapp
Or at the very least, add tooltips to the title links on the list views
(comments, new, etc) so we can read the entire title when they get truncated.

For example:

        	Ask HN: How hard would it be to allow 120 characte...

_why?_

------
cogburnd02
Well, this would be weird for those who use terminal clients that assume the
80 character limit,(if any exist) on 80-column-wide hardware terminals.

~~~
krapp
I know it's Hacker News and there are likely to be more such users than
average, and probably just enough to be worth worrying about.

But maybe they (kogir, dang, whomever) can add ?cols=n as a parameter or
something so they can adjust it to their heart's content. Most of us have room
for 80 characters and plenty to spare.


3rd Shellshock Vulnerability Found - propercoil
http://seclists.org/oss-sec/2014/q3/741

======
skuhn
This is not a vulnerability, it is intended functionality. Some scripts
undoubtedly depend on overloading a shell builtin command with a function
(even though it is gross).

The post's proposed exploit path is not possible on Linux and most OS's,
because you cannot have a setuid script.[1]

[1] [http://unix.stackexchange.com/questions/364/allow-setuid-
on-...](http://unix.stackexchange.com/questions/364/allow-setuid-on-shell-
scripts)

~~~
bodyfour
Even if you have a setuid script it appears that bash won't import functions
in that case.

However the fact that the script isn't setuid isn't really the concern for
these shellshock, since a setuid program could indirectly run /bin/sh.

Again, though, this doesn't seem to another shellshock problem. In shellshock
you only needed to control the value of an environment variable, not its name.
If you can control the name _and_ the value then there are plenty of other
ways you can attack programs.

~~~
kentonv
> However the fact that the script isn't setuid isn't really > the concern for
> these shellshock, since a setuid program > could indirectly run /bin/sh.

A setuid program which runs _any_ child process without having first cleared
the environment or authenticated the caller for root access is already broken
by means of LD_PRELOAD.

------
lambda
If you're vulnerable to this, then you're vulnerable to someone setting PATH
and changing all executables that you refer to.

That's not the "shock" part of "shellshock"; that's a long known issue.
Applications which pass arbitrary variables from the network through
environment variables already add a unique prefix to the variables, to prevent
this kind of problem. That unique prefix also prevents them from accidentally
conflicting with the name of an actual executable for this case.

Now, there are still going to be bugs with suid executables not sanitizing
their environment, but those apply in many other ways, such as via PATH and
LD_PRELOAD.

The "shock" part of shellshock was that it was possible to execute arbitrary
code, upon just loading a variable in Bash, regardless of what its name was,
depending only on the contents, which in many cases can be attacker
controlled.

~~~
kentonv
Exactly. If you are letting an attacker define not just the values of
environment variables, but also the _names_ , then you've already lost.

Forget bash. LD_PRELOAD by design lets you load arbitrary code into any child
process. Many other environment variables affect libc and other common
libraries in arbitrary ways. setuid programs must clear their environment at
startup to be safe. Programs like sudo can restore that environment once the
user is authorized for root access.

------
mzs
Wow this is getting out of hand, that's not really a security vulnerability
anymore. That's how bash passes exported functions, I'll get back to that.

There is some misunderstanding though regarding the suid shell script. I can't
think of any modern unix other than solaris that allows those by default any
more. It's just not a concern anymore unless an admin twiddles some sysctl or
what not. And in the case of solaris /bin/sh is not bash. Also /bin/sh does
it's own setuid after comparing to 100 (unless the -p option is passed) so
often if people are not adding users to a group or sudo, they would create a
ksh or perl script instead. Anyway that's just rambling, sorry, the short
answer is that I would be really surprised if there was any modern system that
used bash as /bin/sh and also allowed suid interpreter scripts.

~~~
mzs
Doh, forgot to get back to the first point, sorry.

My thinking is that at this point the whole exporting functions (and anything
else other that environment variables, like arrays) is just a bad idea in the
default case. I actually do do it, but for a stupid reason and can totally see
how I should just put those functions in bashrc for the same effect anyway.

So I really would like to see that all disabled by default in bash and a
shellopt added to enable it if anyone really needed it.

I've heard about other ideas like prefix, suffix the name, or add a
BASH_FOOBARBAZ that lists exported functions, but it's just not something most
people do, and it would be a pita for the people that do need it now needing
to change how they do it cause I can totally see people that made use of this
having done it in C and perl knowing that if they did added to ENV 'cat=() {
...' or what not it would change what they needed in the subshell after they
called system. That would really be annoying for those people to have all that
break in a way they would need to change all that baroque code instead of just
adding an option, something like system("exec /bin/bash --foobarbaz ... ")
now.

Plus there are other programs like sudo that already know how to deal with the
'() {' style env vars and clear them-out by default, people would have to
update all those (plus what ever ancient suid C launcher programs they already
had doing this kind of env var clean-up in their own broken ways from before
the time sudo became the way to do this stuff) now too.

~~~
joeyh
Debian has already released a batch patched to only treat BASH_FUNC_FOO() as
exported functions.

It's the second half of the security fix, so I recommend upgrading.

There is a small potential for breakage as you mention, but less than ripping
the feature entirely out.

~~~
mzs
I should not have replied until I had more time to respond clearly, sorry.

The BASH_FUNC_foo()=() { ... is nice, it's how it should have been from the
get go. Besides having a nice prefix that owns them all (what about arrays
though)it makes it hard to set an exported function from the shell using =
cause of the () suffix. That's clever, promotes the use of export -f basically
from bash itself.

Unfortunately it breaks how to do it from everything other than bash cause
it's not backwards compatible, and people like me had done that. Now I realize
that I had done it for not great reasons with other better ways to do what I
wanted. I think most everyone else that had exported functions would have felt
the same. So very few people actually need exported functions, most can come-
up with a work-around.

Taking that into account what is trying to be accomplished here with any
patch? Really it's to prevent a future vulnerability, that should be the goal.
Going back, the first vulnerability was that when the shell was initializing
more got executed than intended. Then the next (which I can't figure-out how
to exploit) was because of state from that initialization being kept around
(in this case from an error bailing) and then messing-up later execution.

It's sort of a hackish way to do all this, right? It only took a day for
someone to find another bug, I was able to get bash to seg fault left and
right when I was looking into it myself before the patches. What is the chance
that there is another bug in that parser say? Noby knows for sure.

The netbsd approach goes: Fix the current bugs, because there are so few
reasons to export functions, so few people do so, most people can find another
approach, and the way that they are implemented might be found vulnerable =>
do not ever export functions by default. As a courtesy to those that have and
that still must, provide an option to allow them and do not break backwards
compatibility so those with the most trouble need only add the option instead
of changing other complicated squirrelly things.

The redhat approach goes: Fix the current bugs, because there are people that
export functions, let us do it in a more sensible way. Now since we have a
prefix and suffix, we protect against an attacker being able to create
arbitrary function definitions. If an attacker could control BASH_FUNC_foo()=,
then they would go after lower hanging fruit anyway. As a courtesy, if the
people used export -f, it is compatible.

So it's a philosophical thing. The limitation of the redhat approach is there
are people like me that feel there will be more bugs in bash. The parser is
complicated, it is being called in this early place, state remains for later,
I expect that it will not be too much to get bash to segfault again, and then
it's careful analysis to see if payload can be crafted to get it to execute
instead of simply seg fault. So I would like a way to have it just not do any
of that by default. The redhat approach does not give me a way to do that. I
value that more, plus being backward compatible. The redhat approach values
having a safer way to pass functions, one that continues to allow that by
default, but breaks compatibility and does not allow me to disable it at all.

------
acqq
It's actually not "new" it's a "feature" that everybody became aware it
existed since long ago only once Shellshock bug became known.

Christos Zoulas from NetBsd has the arguments that I really like: it's a
"feature" that was widely unknown and that should be disabled by default:

[http://openwall.com/lists/oss-
security/2014/09/25/31](http://openwall.com/lists/oss-security/2014/09/25/31)

------
acdha
Can we go straight to the part where this is disabled behind a --insecure flag
and everyone can spend a release cycle migrating untrusted input handling to
languages which were designed for it?

~~~
derefr
> languages which were designed for [untrusted input handling ]

Which languages would those be? There are a few languages with a concept of
"taint" (Perl, Ruby), but I've never actually seen a language where everywhere
untrusted input could come from _actually_ starts tainted, and every secure
function _actually_ disallows tainted input. Especially where third-party-
native-FFI library calls are involved.

~~~
acdha
There's an argument that we should be making an effort to add something like
Perl's taint mode (which predates the web by half a decade!) or the stronger
variants in some academic languages everywhere but even that's overkill for
this class of bugs.

The problem here, as anon1385 pointed out is that shells in general, and Bash
in particular, were designed to execute things and maintained at best weak
separation between code and data – in no small part because the concept
originated 40 years ago when computing was a much more trusted place and
network connections were rare and not seen as a conduit for never-ending
attacks. As a class, makes shells a bad idea for anything which crosses a
privilege boundary; almost any normal language would avoid this particular
exploit.

------
schrodingersCat
I just tried this in zsh 5.0.6 (x86_64-apple-darwin13.3.0). It reports
vulnerable as well.

edit: Yes, this feature works when formatted correctly for zsh as "function ls
() { echo vulnerable }". However, I was wrong in that zsh -c will not run the
function (of course running "ls" in the same session will). I'm going to call
this not a problem.

edit: When trying this one-liner in zsh: "env x='() { :;}; echo vulnerable'
zsh -c 'echo hello'" (as suggested by
[https://superuser.com/questions/816622/does-the-
shellshock-b...](https://superuser.com/questions/816622/does-the-shellshock-
bug-affect-zsh)), the output indicates my shell is vulnerable. Could someone
please try and replicate?

~~~
Arkanosis
> I just tried this in zsh 5.0.6

Do you mean that you run bash -c in zsh, or that you run zsh -c ?

~~~
schrodingersCat
Good call. I posted an edit to my original comment. zsh -c won't run the
function outside of the current session. The "extra step" needed to add
functions to the environment variables seems to make zsh much more secure than
bash in the context of this discussion (perhaps?). This SE thread was really
helpful to me in clarifying:
[https://unix.stackexchange.com/questions/33255/how-to-
define...](https://unix.stackexchange.com/questions/33255/how-to-define-and-
load-your-own-shell-function-in-zsh)

------
rootbear
If this is how passing functions is supposed to work in bash, then why do I
get different results, depending on which system I'm on? I've been madly
patching my systems since yesterday and on a RHEL 6.5 system I get a different
result than from an Ubuntu 12.04 system:

        [RHEL-6.5 tmp]$ uname -a
        Linux hostname1 2.6.32-431.23.3.el6.x86_64 #1 SMP Wed Jul 16 06:12:23 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux
        [RHEL-6.5 tmp]$ bash --version
        GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)
        [RHEL-6.5 tmp]$ ls
        file1  file2  file3
        [RHEL-6.5 tmp]$ env ls='() { echo vulnerable; }' bash -c ls
        file1  file2  file3

        Linux hostname2 3.8.0-44-generic #66~precise1-Ubuntu SMP Tue Jul 15 04:01:04 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
        Ubuntu 12.04:~/tmp$ bash --version
        GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu)
        Ubuntu 12.04:~/tmp$ ls
        file1  file2  file3
        Ubuntu 12.04:~/tmp$ env ls='() { echo vulnerable; }' bash -c ls
        vulnerable

Is this a basic difference in the feature sets of Bash 4.1 and Bash 4.2? Like
several posters, I was unaware of this feature and have certainly never used
it. Perhaps it should be off by defaults? How big of a mess would that make? I
would also like to see more distributions use something other than bash as
/bin/sh, but that's another discussion, I guess.

~~~
mzs
You need to use export -f now, the specifics of how functions are exported
have changed in the redhat patch, ls='() { ... is not sufficient anymore.
Nothing has broken unless you had something calling bash that was not bash and
you used this internal to bash implementation hack-like knowledge that 'foo=()
{' is how those pre this redhat patch versions of bash did it.

~~~
rootbear
Thank you! I haven't had time to read the documentation for Red Hat's change.

------
dahjelle
If I'm looking at this correctly, it appears that the Red Hat patches aren't
vulnerable to this particular vulnerability. (I believe they patched bash
differently than upstream, as per
[https://securityblog.redhat.com/2014/09/26/frequently-
asked-...](https://securityblog.redhat.com/2014/09/26/frequently-asked-
questions-about-the-shellshock-bash-flaws/.))

EDIT: I tested on CentOS 6.5 and Fedora 18 (for which we'd manually backported
the Fedora 19 patches).

~~~
daveloyall
I've read the page you linked and it's not clear to me how to reach that
conclusion based on that information. Help?

~~~
dahjelle
Sorry! My conclusion (i.e. that RedHat was patched against this 3rd
vulnerability) was just by running

env ls='() { echo vulnerable; }' bash -c ls

on my recently patched CentOS box. If I'm reading that right, if I was
vulnerable, I'd get the output 'vulnerable'? But, instead, I got the correct
output of the `ls` command.

The linked article was pertinent because RedHat did patch bash in a different
way than upstream. Here's the relevant quote:

> Our patch addresses the CVE-2014-7169 issue in a much better way than the
> upstream patch, we wanted to make sure the issue was properly dealt with.

That help?

~~~
daveloyall
Yes, it helps, thanks!

And the post below which shows the contents of the RH patches should help, if
I knew how to read it. :)

But... it seems to me that if this doesn't work:

        env ls='() { echo vulnerable; }' bash -c ls

...then some scripts are now broken. Sorry, I don't know which ones. Needless
to say, most bash scripts in existence don't take input from the wild wire. A
sad day for those innocuous scripts.

~~~
dahjelle
mzs had some info about this in a separate comment[1] if you missed it. I've
hit the edge of my knowledge about it. :-)

------
ufo
I know this is not really an issue but is there any use for this "function
exporting" feature in the first place? I had never heard about it before and
when I did it kind of sounded like an ugly hack.

------
Eclyps
I was not able to replicate this on Amazon's linux distro after the second
patch was applied. After only the first patch, though, the server was still
vulnerable.


HD Trade Services (YC S12) Lets Small Logistics Providers Track Shipments - dsugarman
http://techcrunch.com/2012/08/17/pics-or-it-didnt-happen-yc-backed-hd-trade-services-lets-small-logistics-providers-track-shipments-like-the-big-boys/

======
thesash
I wish I didn't have to read Techcrunch's hollow journalism to learn about the
latest YC class, because many of them seem like legitimate business cases
working on fairly ambitious ideas.

The problem is, every Techcrunch post about a YC startup reads like a press
release; completely devoid of any independent research, analysis, or, well,
journalism. This author's most insightful analysis about the market is that
"shipping and distribution" are "an essential part" of global trade. Wow! I
never thought about it that way!

What's the size of the "small logistics services providers" market, who are
the major potential customers and partners? How hard will it be to compete
with established players like UPS and FedEX? How much is the company charging
for the product? Isn't it ridiculous that the founder thinks he can pull a
viral coefficient of 50?

I know this is nothing new, but seriously Techcrunch: you can do better than
this.

~~~
rdl
The startups need TC to reach other publications, but maybe there's a market
for a YC (or all major accelerator) focused journalist who does in depth
interviews and analysis of each startup. I'd trust an entrepreneur or investor
in that role, rather than a journalist.


Profile: David A. Huffman (1991) - ehudla
https://www.huffmancoding.com/my-uncle/scientific-american
======
tankerdude
I had classes with him for the last few years that he taught at UCSC. He never
had a text book for his classes that I took (graph theory etc). He also almost
never used his computer in his office it seemed and enjoyed the theory quite a
bit more.

Fun classes but alas, he passed away a few years later from cancer.

------
ehudla
I loved these Scientific American profiles as a kid. I guess there's nothing
like it these days?


Lots of Ideas But Have Little Resource To Start Project - AngeloAnolin

I have a lot of ideas for projects which I believe has the potential to hit big on the market.  The only thing I lack is the resources and the drive to actually starting them off. Would anyone be willing enough to collaborate with me in turning some of these ideas into reality?
======
mindcrime
Are your ideas software related? If so, what resources do you need? Your
profile says you're a software developer, so presumably you have coding
skills. You're logged onto HN, so I think we can safely assume you own a
computer. Compilers, editors, IDEs, VCSs, databases, frameworks and libraries
galore are freely available as open source... Cheap VPS servers can be had for
something like, what, 10, 20 bucks per month; and Amazon AWS makes ridiculous
amounts of computing power available "on demand" in affordable increments.

I think you'd get more mileage out of posting a request like this on HN if you
at least started building something and then got to a point of maybe saying
"Hey, I've got this prototype, but to take it to the next level I need
somebody with expertise in $WHATEVER, would anybody like to jump onboard?"

Now if you're talking about an idea for a fusion reactor or a new hardware
product or something, then OK... but you'll probably still get a more
enthusiastic response if you post more about what you have in mind.

------
amock
Almost everyone here has lots of ideas that have the potential to make it big,
so unless you have something special to offer it will difficult to find
someone willing to work with you. If you have the skills to get started so you
can show people an at least partially working product that would greatly
increase your chance of attracting a collaborator.

------
timrosenblatt
Without putting too fine a point on it -- if you don't have the drive to start
it, why should someone else have more drive than you?

Here's some things you can do since it sounds like you've got more time than
money (like most entrepreneurs): break your idea down into a few simple
components and see if you can build any aspect of them. I know people who have
started companies with sketches on napkins -- you can too.

Go find 10 people who would be ideal customers. Talk to them about what your
idea is going to do for them. Do they really have a need? How much is it worth
to them? Would they _actually_ pay for it?

------
AngeloAnolin
Thanks to all those who replied. I think I may need to draw up something more
_relevant_ so that I would be able to convey more clearly what I am trying to
get across.


Top Product Management Books? - skotzko
Recommendations for top product management books? Either "how to" books or just ones that will make me better.<p>Current favorite is "Inspired" by Marty Cagan.
======
bdickason
I've been 'product managing' for 4 years now in NYC and haven't found very
many books useful. Here are a few:

-Getting Real / Rework (37 signals) - Build a lean product

-Don't Make Me Think - Usability 101

-Web Analytics 2.0 - Metrics are your best friend

-Viral Loop - Great companies and how they did it

-Delivering Happiness - Last 50 pages are phenomenal for building your company's "culture"

~~~
skotzko
Awesome, thanks! Really appreciate the suggestions here and below.

------
Shimrit
Check out Blackblot's new book on Product Management "The Product Manager’s
Toolkit". In adition You'll find some good reading in this field on the
following resource page <http://bit.ly/9qOjwB>

------
jamesshamenski
"the art of project management", Scott Berkun. From O'reilly media.

This book is gold. but when berkun said that the job is essentially just
creating/updating lists for people, i liked my job less and the book more.


Traits Of Stellar Managers, Defined By Googlers - amirmc
http://www.businessinsider.com/8-traits-of-stellar-managers-defined-by-googlers-2011-3?op=1

======
citizenkeys
What's interesting from the article is the internal Google survey revealed
"Technical skill" was the absolute least important trait that Googlers sought
in a manager.

This is not unlike the brief failed experiment years ago where Google tried to
get rid of managers entirely and have teams report directly to engineers. The
lesson from that was engineers are best left to do engineering and managers
are best left to manage.


How to add a brain to your smart phone - syswsi
http://petewarden.com/2014/04/08/how-to-add-a-brain-to-your-smart-phone/

======
dekhn
I think most people aren't aware of how significant these kinds of
technologies will be, in mobile and embedded computing.


Will Planned Obsolescence Kill Silicon Valley? [video] - sappapp
http://breakoutroom.co/#/webinar/498
======
varelse
Isn't it great that we can outsource our toxic e-waste?

[http://www.theguardian.com/global-
development/2013/dec/14/to...](http://www.theguardian.com/global-
development/2013/dec/14/toxic-ewaste-illegal-dumping-developing-countries)

But besides the 800 lb gorilla in the room, what worries me more than planned
obsolescence is an entire ecosystem primarily composed of glorified MVPs
rather than refined products. And that is doing more to disenchant me with
technology and applications than any other force, one crash to the desktop at
a time.

------
analog31
_However, unlike the decisions that eventually led to Detroit’s downfall,
planned obsolescence is a good thing for both consumers and hardware vendors
alike._

As I understand it, the original academic paper introducing the concept of
planned obsolescence, described it as an economic boon -- essentially a form
of stimulus. At the time, the intent was not to sabotage the lifetime of
products, but to keep introducing desirable new features.

Now, anecdotally, I think that I've witnessed planned obsolescence of a sort,
in some kinds of products. I remember the home appliances in my house when I
was a kid, being much more reliable than those sold today. I've had to repair
literally every appliance in my house over the past decade, in some cases two
or even three times. We're already on our second fridge. The cause may simply
be due to relentlessly driving the cost out of those products while keeping an
eye on the one-year warranty.

~~~
brunoqc
How can you tell that it was planned obsolescence and not just lowering the
quality to lower prices?

~~~
analog31
Don't know. I agree that your hypothesis is probably the best one. But
lowering quality is a conscious decision.

------
kenrikm
Apple has actually been doing really well on the software side of this iOS9
will support the iPhone 4S (released in 2011) through to the upcoming 6s.
That's 5 generations of devices that will be on the latest version of the OS.
To put it into perspective, how many other cell phones out there are able to
run the latest version of the OS 5 years after their release date?

~~~
hn9780470248775
How many other ~$1000 devices are obsolete after four years?

~~~
qq66
Electronic devices don't get "obsolete" as much as they get better so fast
that the old device seems lame in comparison. A four-year-old PC is as fast as
when it was new, but modern PCs are 10 times as powerful for the same price,
so the old PC seems obsolete. My 9-year-old Canon 5D camera takes incredibly
good photos, but the modern cameras are so insane (shoot a full movie in
moonlight) that the 5D seems like an amateur in comparison.

An iPhone 4S is a great phone compared to everything except newer phones.

~~~
tsotha
>Electronic devices don't get "obsolete" as much as they get better so fast
that the old device seems lame in comparison.

Which would be fine if the device still did what you want it to do. But in
fact connected electronic devices _do_ go obsolete as soon as vendors stop
providing security updates.

~~~
cortesoft
I am a bit confused as to how they stop doing 'what you want it to do' when
they stop getting security patches. Sure, they won't have the latest security,
but you can still 'use' the device in every way you did before... they might
be vulnerable, but they were vulnerable before and you still used it.

~~~
nsxwolf
Let's not forget about the reliance on services. My second generation Apple TV
can no longer view YouTube because it will not be updated to Google's new
authentication scheme. So I have a product that does less today than the day I
bought it.

~~~
Silhouette
This is one of the reasons I have no interest in a "smart TV".

I want a good quality screen, a good quality sound system, and enough
connectivity to get signals to them at the highest quality they can use.
Updates to where those signals come from should not require physically
swapping large and extremely expensive equipment. That is just crazy.

And yet today my TV can hang while showing broadcast TV because someone
changed a compression algorithm and caused the decoding software to glitch,
and when I put a Blu-Ray in my player often the first thing I see is a warning
that I might have to update the firmware in the device just to watch the
movie.

This is not progress, and the sooner we go back to separating communications
devices/protocols/software from the main hardware in this sort of situation
and then using appropriate safeguards and updates on the things that actually
need them with everything else properly isolated, the better the world will
be.

------
TodPunk
Planned obsolescence through sabotaging a product (or at least its quality) is
a universally bad thing in my opinion. Planned transition to an upgrade is
not. Terms are probably going to muddy the conversation around the importance
of these topics, I think. Maybe we shouldn't borrow the term of planned
obsolescence at all.

~~~
cbhl
Planned obsolescence can be looked at another way: using less expensive
components because you know you don't need them to last longer than (say) 5
years, which results in cheaper, faster, smaller products.

~~~
vezzy-fnord
Cheaper is evident, but I don't know why "faster" and "smaller" are being
taken for granted here.

~~~
toufka
Mechanically, this tends to be true. I don't know about for electronics. The
vehicle engine is a good example - a diesel John Deere from the 70s has a
massive block that will last through my grandchildrens' lifetimes. The newer
engine blocks are not designed to last as long, and thus have tighter
tolerances allowing them to build smaller, lighter, more powerful engines for
less money - given, again, that they are not intended to last for as long.

------
swozey
Can't we deter planned obsolescence by having stronger consumer protection
laws? The USA is so far behind in consumer protection it's crazy. If a company
had to warranty up to 5 years maybe they'd be more concerned with keeping the
product as good as it can get.

~~~
Adams472
Is Apple a monopoly? In a normal market, competition and market forces should
take care of this.

~~~
analog31
In my view, the idea of market forces taking care of things depends on
assumptions about public access to information, that probably can't be met. It
may be prohibitively hard for consumers to get information on a reasonable
expected life span of something like a refrigerator.

~~~
sokoloff
My strong belief is that all of them are "more than 10 years". Beyond that,
does it really matter? That's a couple dimes to a dollar a day for convenient
and safe food preservation in your house.

What would be the basis for predicting the life span of a new design anyway?

~~~
analog31
My anecdotal experience is that fridges last a few years before requiring
repair. In the space of 10 years, my home fridge failed once, ran for a few
more years, and then just stopped cooling. Over that time period, I've
repaired nearly every appliance in the house. They were all new when we moved
in, because we bought a house that was empty of appliances.

Dehumidifier: Defective potentiometer. Repaired, then it ultimately wore out
and stopped cooling. Folklore is that the seals in the compressors are short
lived, system loses the ability to compress the refrigerant sufficiently. This
also causes a gradually rising power consumption until it can no longer hold
temperature.

Chest freezer: Starting relay / capacitor failed. Replaced with unit bought
online. Currently idle, as we have nothing to freeze.

Microwave: Failed, tried to repair, to no avail.

Cooking range: Loose connection in heating element caused wiring to burn up.
Repaired by silver-brazing new wire to Nichrome element material.

Dryer: Repaired twice. First time was an over-temperature sensor. Second time,
the motor bearings failed, and the unit was squeaking like crazy.

Waffle iron: Repaired once due to heating of loose connection, second time it
was unrepairable.

I've also repaired the furnace, but it was a pretty old unit.

One basis for predicting life span of new design is to base it on known
performance of old design. Of course this can't happen if cost reduction
results in multiple, radical design changes, including use of lower cost
materials.

On the plus side, the Internet has opened up a bonanza of repair information
and spare parts, so I have saved a boat load of money by being self sufficient
for repairs.

~~~
sokoloff
I agree on the "Youtube repair manual" aspect and I've saved a ton of money as
well. We've been in our place for 8 years, and in that time, I can only recall
fixing the fridge (bad defrost element-$20 or so), throwing out a slow cooker,
replacing the igniter on the gas stove, and replacing a working dishwasher and
a not working washer (bad bearing seal on a front loader and the bearing was
too seized to remove before I damaged it irreparably).

That's in a place with two kitchens, plus a chest freezer, two washer/dryers,
and numerous small appliances, plus most of the items were old when we bought
the place. I'm sure I'm averaging less than a repair per major appliance per
decade.

I don't doubt your contrary experience, but it seems to skew on the unlucky
side IME.

------
ffk
This becomes more troublesome when modification of the device is made illegal.
_Forced obsolescence_ with legal lockout when attempting to "repair" the
device.

Perhaps we should call obsolescence over time as the market changes as
_natural obsolescence_?

~~~
asift
>This becomes more troublesome when modification of the device is made illegal

Is this just a theoretical consideration or is there good reason to believe
legislation is moving in this direction?

~~~
jdmichal
It already has. This is why DMCA exemptions [1] exist.

[1]
[https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...](https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act#Anti-
circumvention_exemptions)

------
rm_-rf_slash
I imagine in the future manufacturing and supply chain tech - augmented by 3D
printers - will put hardware products into a recycled lifecycle, wherein you
would trade in your old iPhone 27 to be stripped of its component materials in
order to get a discount on your 27S.

------
sliken
Expensive phones with epoxied batteries drIves me nuts.

------
jxramos
I do a lot of amateur repair of various things around the house, washing
machines, TV, etc. I remember being really struck by the commentary of this
repair book I read:How to Diagnose and Fix Everything Electronic by Michael
Geier. He has some insight into this arena in terms of labor costs, and
growing complexity of components...

"When I was a kid, there were radio and TV servicers in many neighborhoods. If
something broke, you dropped it off at your local electronics repair shop,
which was as much a part of ordinary life as the corner automotive service
garage. These days, those shops have all but disappeared as rising labor costs
and device complexity have driven consumer electronics into the age of the
disposable machine. When it stops working, you toss it out and get a new one."

He makes some other points too from a deep technician perspective citing how
companies began to view and deal with complexity and liability of having their
products be user servicable...

"..."No user-serviceable parts inside. Refer service to qualified personnel,"
replaced the [repair/service] diagrams. Is it any wonder they call today's
gadgetry "consumer electronics"? Service manuals were cheap and plentiful, and
shops kept huge rows of filing cabinets bursting with them. In addition to
manuals generated by the products' makers, the Howard W Sams company produced
its own comprehensive line of Photofact schematics for just about everything
out there. If you couldn't get a schematic from Zenith, you could get a Sams
easily enough for a buck or two. As products got still more complex, manuals
grew from a few pages to a few hundred, with large, fold-out schematics and
very detailed, color pictorials. Producing these big books became quite
expensive, so their prices skyrocketed. Shops continue to buy them--they had
little choice--but no consumer would spend more for a manual than the product
cost in the first place! Companies gradually reduced and finally abandoned the
infrastructure for selling manuals to the public, and today's age of "use it,
wear it out and toss it" was in full swing. Many manufacturers will no longer
sell schematics or service manuals to consumers, thanks in part to fear of
potential lawsuits by injured tinkerers. Some companies won't even sell
manuals to service shops unless they're factory-authorized warranty service
providers. And, believe it or not, some even refuse to provide diagrams to
those facilities! Secretive computer makers, in particular, only let
authorized servicers swap boards; the techs work on their machines for years
without ever seeing a schematic of one."

~~~
jxramos
His books is solidly amazing,
[http://www.amazon.com/dp/0071744223/ref=rdr_ext_tmb](http://www.amazon.com/dp/0071744223/ref=rdr_ext_tmb),
definitely valuable reading if you're into that sort of thing. Another thing
to keep in mind with what may be confused as planned obsolescence can be tied
to the well done story about the One Horse
Shay..[https://en.wikisource.org/wiki/The_Deacon%27s_Masterpiece](https://en.wikisource.org/wiki/The_Deacon%27s_Masterpiece)

Give it a read, you'll come to realize that for any failure something has to
break, some component, otherwise for a failure to occur every single component
has to go at once simultaneously. I realized this concretely when I had
repaired our garage door opener. I could see the designer using substandard
material on the teeth of this horizontal slider cog that allowed it to fail
first, and it happened to be an easy part to replace, rather than say having
the corkscrew fail, which would be much more complicated to replace. I
remember reading about the part in amazon reviews where people criticized it,
but I felt it was a good choice and had a reasonable lifetime to it. If
something has to break, let it be the more serviceable part!

------
spiralpolitik
Planned Obsolescence is common lots of other industries. Your washing machine
for example is now only designed to last 5 years before replacement is needed.
While repair is possible, a lot of non-computing products are now designed to
be taken away and recycled and replaced with new because its easier and
cheaper to do so.

------
rasz_pl
You can at least try to fight it

[http://www.digitalrighttorepair.org/](http://www.digitalrighttorepair.org/)

[https://www.youtube.com/watch?v=YcuAF3OJIoU](https://www.youtube.com/watch?v=YcuAF3OJIoU)

------
Fando
Planed obsolescence and similar repulsive concepts are products of shallow
minds and unchecked human flaws. I hate it.

------
thetrb
Easy:
[https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

~~~
jxramos
Good one! Makes me think about those crazy reality shows where they're on the
hunt for some sea beast/monster crazy thing. The scale of the lore of the
objects they hunt would be so huge that you wouldn't be hearing about such
breaking news first by watching the next 30 minutes of characters bumbling
around in dark forests and deep seas, etc.


Most people are bad at arguing. These 2 techniques will make you better (2016) - pella
https://www.vox.com/2016/11/23/13708996/argue-better-science
======
larnmar
If you are arguing with the goal of changing your opponent’s mind, you’re
already doing argument wrong. These techniques will not make you better.


Tour of a real toy Haskell program - ihodes
http://mainisusuallyafunction.blogspot.com/2010/10/tour-of-real-toy-haskell-program-part-1.html

======
kwantam
My transition to "real" Haskell programming happened with some parallel signal
processing stuff, but my best example toy is my two-player tetris clone,
triHs: <http://web.jfet.org/~kwantam/TriHs.tar.gz>

Note the "bastard" key, where you can swap your opponent's next piece. >:)

------
djhworld
Interesting article, some of it went a little over my head but I'm pleased to
see articles like this as I've always wondered how people make that transition
in Haskell from writing fibonacci sequence generators and one-line FizzBuzz
functions.

Would be interested to see if this thread becomes popular and has the
incentive for people to post their Haskell projects and how they did them

------
zaphar
This is great. One of the barriers to entry for me into haskell hacking was
finding a useful app to look at. Yi the editor was what finally got me over
the hump. It's great that more people are recognizing this need and meeting
it.

~~~
happy4crazy
Is Yi still being developed? I've also encountered the fibonacci gap with
Haskell, so looking at Yi would be pretty fun, but I was unable to install it
via cabal the last time I tried.

~~~
zaphar
The development had slowed but I've started submitting patches now so at least
one new developer has joined the ranks there :-) There are at least three
other developers who are are responsive on the development list so you can
probably get your questions answered.


Advice for the young scientist (by John Baez) - gtsnexp
http://math.ucr.edu/home/baez/advice.html
======
gtsnexp
And in Portuguese: [https://logic-forall.blogspot.com/2020/05/telling-stuff-
as-i...](https://logic-forall.blogspot.com/2020/05/telling-stuff-as-it-
is.html)