1. 20

    Yeah, 72 is much more reasonable. We need hard limits, or at least ‘annnoying’ conventions to keep the horrors at bay. The human eye scans lines best at around 72 characters wide, and we should put human readability of our code before other concerns. I have worked on projects that had huge long lines and there is no excuse. If a language or tool or whatever can’t deal with human limits, find or make another tool. Linus’ current workstation should not be the standard.

    That being said, I think Racket has made a reasonable compromise:

    A line in a Racket file is at most 102 characters wide.

    If you prefer a narrower width than 102, and if you stick to this width “religiously,” add a note to the top of the file—right below the purpose statement—that nobody should violate your file-local rule.

    This number is a compromise. People used to recommend a line width of 80 or 72 column. The number is a historical artifact. It is also a good number for several different reasons: printing code in text mode, displaying code at reasonable font sizes, comparing several different pieces of code on a monitor, and possibly more. So age doesn’t make it incorrect. We regularly read code on monitors that accommodate close to 250 columns, and on occasion, our monitors are even wider. It is time to allow for somewhat more width in exchange for meaningful identifiers.

    https://docs.racket-lang.org/style/Textual_Matters.html

    1. 20

      The human eye scans lines best at around 72 characters wide

      I would like to have 72 chars wide line but with ignored indentation. It would make nested block readable on its own.

      Example with 40 chars width ignoring indentation white space

      Lorem ipsum dolor sit amet, consectetur
      adipiscing elit. Donec sit amet augue
      felis. Suspendisse a ipsum et sem auctor
      porttitor in ac lacus. 
      
          Curabitur condimentum augue diam, ut
          molestie nibh faucibus nec. Aliquam
          lacinia volutpat tellus, non
          sollicitudin nulla luctus sit amet.
      
              Aenean consequat ipsum sem, ac rutrum
              leo dictum at. Suspendisse purus dolor,
              condimentum in ultrices vel, egestas vel
              ipsum.
      

      Versus 40 chars width including indentation

      Lorem ipsum dolor sit amet, consectetur
      adipiscing elit. Donec sit amet augue
      felis. Suspendisse a ipsum et sem auctor
      porttitor in ac lacus. 
      
          Curabitur condimentum augue diam, ut
          molestie nibh faucibus nec. Aliquam
          lacinia volutpat tellus, non
          sollicitudin nulla luctus sit amet.
      
              Aenean consequat ipsum sem, ac
              rutrum leo dictum at.
              Suspendisse purus dolor,
              condimentum in ultrices vel,
              egestas vel ipsum.
      
      1. 13

        The human eye scans lines best at around 72 characters wide

        With monospace fonts? Or proportional ones? With large text or small?

        With English prose, poetry, or with C code? With hyphenation? Indentation?

        I’ve found that recommendation is pretty good for English text with a middle size proportional font. I do not find it works as well for code.

        1.  

          I agree. Reading written text involves repeatedly shifting your focus to the line below. A consistent and short line length in that case is very important. Code is not the same. It’s far more common reading code to study a single line or small block, and in that case, I find that arbitrarily wrapping a line to stay within 80 characters usually breaks consistency and harms readability. I used to subscribe to the 80 character limit until I realised this difference. We don’t read code like we read written text.

          Terminal/editor windows side by side is a fine point, but in general the vast majority of lines of code are short anyway, often well under 80 characters. If a few lines happen to wrap on your display, I hardly think that’s going to completely kill readability, and it’s certainly a trade-off I’m willing to make. If many lines are wrapping then yes, you probably have a problem with your code formatting (or your code in general). It’s the hard limit that I take issue with. Back when I wrote my own code like this, all too often I would find myself renaming identifiers (usually for the worse) among other arbitrary and unhelpful things, just to fit some code within a line without wrapping. I wouldn’t be surprised if more often than not this is the outcome for many others who attempt this, and it’s almost certainly a net negative for readability. Dropping the idea entirely has been a huge relief. One less thing to think about. Most of my code still consists of short lines, as it always did, and as most code naturally does. But when I need to, and it makes sense to write a longer line, I don’t spend a second agonising over whether it fits within some special number of characters, and instead focus entirely on whether it in itself is clear and understandable.

          1.  

            100% agreed. As I argued in the comments above, people don’t read code the same way that they read prose, and so I would not try to generalize a heuristic meant for prose to code.

          2. 10

            I want to reinforce your comment that

            The human eye scans lines best at around 72 characters wide, and we should put human readability of our code before other concerns.

            Recently, I have been trying to optimise my on-screen experience and I found a series of peer-reviewed articles with recommendations that improved my experience.

            In one of those, it is claimed, indeed, that more than 72 and less than 80 characters (precisely, 77) is the optimal number for clear readability.

            The study is for dyslexic people, and I was never diagnosed as so. But it works for me, and I tend to believe it works for most people as well.

            1.  

              Yeah what I’ve read confirms this, I think the width of the text column can vary based on the character width. For example in CSS I typically set something like:

               p { max-width: 32em; }
              
              1.  

                You can also use 72ch to set it based on width of the 0 character (which will approximate it)

          1. 13

            Whenever anyone asks “why?”, I find the answer of “because I want to” to be plenty good enough. I might think it is silly and never use their thing, but I see it as totally valid to do it however you want simply because you want to, regardless of what else exists or what anyone else thinks about it.

            1. 4

              I fundamentally agree with you, however there is also part of me that wonders if this is part of the reason we continue to flounder as an industry/profession. We “build” things, but have very little rigor, regulation or conformity across the industry. The industry is nascent in the grand scheme of things, but the insane growth of things powered by software is frightening if you look at it from the point of being the consumer of “because I want to” technology. Someone can just go and create their own language good or bad, and folks will just use it, and probably sell you a product using it. That’s very cool to part of me, but also unsettling?

              1. 3

                I think the fact that people can just go off and build something is great. There are many interesting design spaces to explore and who knows if/where they will be useful. If someone is able to build a successful product with a random piece of technology then good for them. As a consumer of that tech, it’s difficult to know if the supplier’s stack is on firm footing, but if you are worried you can always pick an established player.

                I do think that it’s mostly a moot point because most rank and file programmers are going to steer clear of niche languages and ecosystems. The average person doesn’t want to implement their own networking stack or SOAP connectors or FTP library and that’s great too. They’re probably off building something directly useful for the average person.

                But they are ultimately the people who are going to ask “why?” Why Zig? Or Nim? Or Elixir? If you like software for software’s sake then why might seem like a silly question, but if software is a means to an end then why is a pretty good question.

            1. 6

              I’ve been going kinda nuts with MIDI lately. Plugged in a piano keyboard with its usb port and was delighted to see it sent events, so I wrote a new little program to plot the notes on screen, record files, etc. I want to extend even further and then maybe play with the raspberry pi having the midi trigger lights or something too!

              I used to love midi a long time ago but haven’t worked with it much lately so it is tons of fun to get back into it.

              1. 11

                I really enjoy Andrei’s writing style, and the content here is very promising. He’s been spending a lot of time around the conference circuit lately trying to make the argument that traditional algorithm analysis needs to be reconsidered with newer hardware and this post makes a compelling show of a particular case study. “Measure, measure, measure” is a key concept and the techniques he touches upon in here are good to examine too.

                I also enjoy his code samples compiling as both C++ and D lol. I wish I could up vote it twice but this comment is the next best thing. Well worth the read.

                1. 6

                  Very much agreed. This is a really great piece of work.

                  There’s a sort of comic tragedy in the overall story, as I see it. Software people have, over the brief history of our field, built up so much infrastructure, both technical and intellectual, on a reified foundation of hardware design choices. These in turn rely on economics and historical happenstance at least as much as physics. The physics hasn’t changed, but manufacturing costs and similar constraints have sometimes changed drastically over the past decades. Nonetheless, our premature abstractions have proven quite durable, perhaps due to the immense weight of the systems, practices, and pedagogies which rest on them. Meanwhile, hardware people have been methodically squeezing as much parallel processing power as possible out of machines which emulate the old standard sequential abstractions enshrined in our programming models, using tricks like speculative execution. Hardware designers consider software fixed and optimize against it, just like software engineers optimize against the hardware we consider fixed. We’re chasing each others tails in a spiral of increasing complexity.

                1. 1

                  Is there a GeckoView for Linux? I imagine there would be but I’ve had no luck finding up-to-date docs on embedding gecko on desktop.

                  1. 2

                    AFAIK the gtk widget that provided that got abandonned several years ago. If I’m not mistaken, it also provided quite a lot more, namely XUL.

                    Webrender is probably might be usable for that however.

                  1. 15

                    I’m reminded of a conversation I had at work one day about scalable infrastructure. Co-worker was talking about “big data” and I asked: how big is a big database? He said “idk maybe gigabytes”.

                    I wonder how much of the big cloud company’s sales are based on misconceptions like this.

                    1. 13

                      The joke I always heard is that data is big when you can’t load it in Excel :-)

                      One of my coworkers got me with this early in my career. He was a senior developer and I the junior. I had a task to do very custom data transformation. He managed to stop me before I had a whole mapreduce cluster set up – then showed me how grep, awk, and a little Python glue would solve this on my laptop. I asked him what would happen if the data grew by a factor of 100? He told me to go type man split and learn something.

                      Since then I think a lot about Gunpei Yokoi, Nintendo, and their philosophy of “lateral thinking with withered technologies” – and how it often isn’t the tools we need to worry about.

                      1. 3

                        The joke I always heard is that data is big when you can’t load it in Excel :-)

                        I’ve heard the joke, but it dramatically underestimates the willingness of Excel users to find ways to scale… 😉

                        1. 1

                          Yeah, it’s getting really hard to find data big enough to actually need a distributed system for processing. But serving systems are a slightly different use-case because you want redundancy for availability even with very low traffic so you need at least 3 machines that are not all on the same network endpoint.

                      1. 7

                        I once signed on to a job where I was told “we’ll get you any environment and setup you wish” — which really meant ‘we’ll give you a 15” MacBook Pro, and hey, VirtualBox is free if you want to run Linux, and we’d rather you didn’t, but we won’t stop you.’

                        I didn’t leave because of this (I almost did), but I ended up leaving that job for isomorphic reasons, related to something else.

                        1. 6

                          Oh that reminds me of a job I had once where they offered Windows or Mac computers for devs. I despise Macs so I went with the Windows box.

                          Literally nothing worked right. What little documentation they had assumed the Mac. Every single one of the other programmers at the company used the Mac so none of them had anything helpful to say at all. Build scripts all assumed macisms.

                          It was awful and I didn’t stick around for very long. Basically the whole experience there - technical and otherwise - was “we offer these things up front but if you don’t choose the same as everyone else you’re a pariah.”

                        1. 6

                          I have only used one Linux distribution and it’s Slackware Linux. The reason I’m using it is because it works very well and it doesn’t require maintenance. Once you install it, you know it will work for years.

                          1. 3

                            What do you use your machine for? Are you able to get the software you need from slackware packages or do you wind up installing a lot of your own stuff outside the package system?

                            1. 1

                              I use Slackware on local development and production servers. I never use packages. They modify the global system state, which leads to a disaster sooner or later. My Slackware installs are 300MB in size and I have build scripts for software that each server should run. The built software gets installed to ~user/installs/.

                            2. 1

                              this is basically me too. I was still on a hand-me-down pentium 1 box in 2004 when I first tried Linux. Friend recommended Mandrake, but the experience on that computer was awful, so I went to Slackware out of necessity and just never looked back. Now that it is set it is all easy and I’ve customized it all pretty heavily over the years.

                              I see them putting wayland in the packages thing though… I did the pulseaudio thing finally last time and am not a fan. I might just never update again at the rate it is going.

                              1. 2

                                Are you both running the latest release or current? It seems that the latest release is almost four years old now?

                                1. 1

                                  I run the latest release only. Age is a good indicator of how good the software is. The older the software, the better it is. Anything new is a red flag for me. I only run software that I know has worked for years and that will work for years. This keeps my pager off at nights and I know there will be no hiccups in production when I deploy new servers as it’s been battle-tested for years decades.

                                  1. 1

                                    Mine was current when I most recently reinstalled last September. Before that, it was the 14.2 release for a long time. I update pretty rarely, usually when I have hardware trouble of some sort and need to make a change anyway.

                                    1. 2

                                      Does this keep you on an older web browser though? How do Slackers keep updated with new browsers?

                                      1. 2

                                        You can update individual packages at any time very easily. The slackware package itself is the ESR version of firefox and periodically emails you saying a security update is available to it. You can just update that and forget about the rest. Slackware also rarely modifies anything so you can compile from upstream (the original software devs, not the distro) easily enough if you really want to.

                                        For example, I also have a copy of new firefox in my home directory that used to auto-update on its own, I downloaded the tar.xz from firefox website and uncompressed in-place right there, so all independently of the rest of the system. All just worked out of the box with its built-in updater. (except the latest 75.0 was so bad I rolled it back and disabled future update checks to ensure it never does that again).

                                        1. 1

                                          I assume that’s because of the giant address bar in 75?

                                          Personally I’d have turned it off in about:config and left updates on; security patches are particularly important for open-source apps (where attackers can read the patch to figure out how to attack old versions) and particularly important for anything that talks to untrusted network services.

                                          1. 1

                                            Well, the giant address bar is part of it, but it was the on-click behavior that drove me so nuts I reverted. In my old version, single click places the cursor. That’s it. Double click selects all and sets the PRIMARY so i can middle-click paste it elsewhere. They changed all that in one swoop and the about:config thing only undoes the visual change, not the behavioral change.

                                            I might just switch browsers entirely if Mozilla don’t come to their senses soon. They’ve done a lot of WTF things lately and while I’ve undone many with about:config or userChrome.css and such, the smaller frustrations are piling up anyway.

                                            1. 1

                                              I feel ya. I just don’t have many good alternatives on linux that don’t involve an advertising company.

                                              Edge on windows / safari on macos are ideal on laptops where battery life is a consideration.

                                        2. 2

                                          While not using Slackware (any more) I do use a non-packaged version of Firefox, installed in /opt and kept up to date using a script:

                                          #!/bin/bash
                                          #
                                          # update_firefox - retreive the latest and possibly buggiest version
                                          # from the main distribution site and install it locally, changing
                                          # the binary and script name to match. This will break if Moz ever
                                          # changes its blah/blah-bin scheme...
                                          
                                          tmp_dir=/tmp
                                          ff_dir=/opt/APPfirefox
                                          ff_site=https://archive.mozilla.org/pub/firefox/nightly
                                          ff_site_dir=latest-mozilla-central
                                          ff_ver=linux-i686.tar.bz2
                                          ff_real_ver=$(w3m -dump $ff_site/$ff_site_dir/|grep $ff_ver|grep -v asc|tail -1|awk '{ print $2 }')
                                          ff_name=$(echo $ff_real_ver|sed -e 's/\.en-US.*$//')
                                          ff_bin_name=${ff_name}-bin
                                          
                                          rm -f $tmp_dir/$ff_real_ver
                                          wget -P $tmp_dir $ff_site/$ff_site_dir/$ff_real_ver
                                          sudo rm -rf $ff_dir/firefox.old
                                          sudo mv $ff_dir/firefox $ff_dir/firefox.old
                                          sudo tar -C $ff_dir -jxf $tmp_dir/$ff_real_ver
                                          sudo mv $ff_dir/firefox/firefox $ff_dir/firefox/$ff_name
                                          sudo ln -fs $ff_dir/firefox/$ff_name firefox-nightly
                                          sudo mv $ff_dir/firefox/firefox-bin $ff_dir/firefox/$ff_bin_name
                                          sudo ln -s $ff_dir/distribution $ff_dir/firefox
                                          

                                          (for 64-bit replace linux-i686.tar.bz2 with linux-x86_64.tar.bz2)

                                          This installs FF nightly in /opt/APPfirefox (keeping the last two versions) with a versioned name (current is firefox-77.0a1). It also installs a policy file (in /opt/APPfirefox/firefox/distribution/policies.json) which disables automatic updates since a) I want to manage these myself and b) they don’t work because the FF installation directory is not (nor should be) writeable by the current user. The contents of that file are:

                                          {
                                          "policies":
                                             {
                                               "DisableAppUpdate": true
                                              }
                                          }
                                          

                                          Ever since the dawn of time I’ve been adding a drop-in extension to /etc/profile or /etc/profile.d which scans /opt for certain directory names and adds these to PATH, LD_LIBRARY_PATH, PERL5LIB, PYTHON_PATH, CLASSPATH and MANPATH. The whole system is tailored to allow packages which are installed using configure --prefix=/opt/APPpackage_name (or /opt/LIBlibrary_name, /opt/SRVservice_name, etc) to be used seamlessly. Here’s the drop-in:

                                          # /etc/profile
                                          
                                          pathmunge () {
                                              if ! echo $PATH | /bin/egrep -q "(^|:)$1($|:)" ; then
                                                 if [ "$2" = "after" ] ; then
                                                    PATH=$PATH:$1
                                                 else
                                                    PATH=$1:$PATH
                                                 fi
                                              fi
                                          }
                                          
                                          unset CLASSPATH
                                          archname=`perl -V:archname|cut -d "'" -f 2`
                                          PERL5LIB="/usr/lib/perl5"
                                          
                                          unset LD_LIBRARY_PATH
                                          
                                          # Path manipulation
                                          if [ `id -u` = 0 ]; then
                                              pathmunge /sbin
                                              pathmunge /usr/sbin
                                              pathmunge /usr/local/sbin
                                          fi
                                          
                                          pathmunge /bin
                                          pathmunge /usr/bin
                                          pathmunge /sbin
                                          pathmunge /usr/sbin
                                          
                                          for dir in /opt/* /export/opt/*
                                          do
                                             if [ -d "$dir"/bin ]; then
                                                pathmunge "$dir"/bin after
                                             fi
                                             if [ `id -u` = 0 ]; then
                                                if [ -d "$dir"/sbin ]; then
                                                   pathmunge "$dir"/sbin after
                                                fi
                                             fi
                                             if [ -d "$dir"/man ]; then
                                                MANPATH=$MANPATH:"$dir"/man
                                             fi
                                             if [ -d "$dir"/lib -a -f "$dir"/.libpath ]; then
                                                LD_LIBRARY_PATH=$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}"$dir"/lib
                                             fi
                                             if [ -d "$dir"/lib/perl5 -a -f "$dir"/.perllibpath ]; then
                                                PERL5LIB="$PERL5LIB${PERL5LIB:+:}"$dir"/lib/perl5:"$dir"/lib/perl5/$archname"
                                                MANPATH=$MANPATH:"$dir"/lib/perl5/man
                                             fi
                                             if [ -d "$dir"/lib/python*/site-packages -a -f "$dir"/.pythonpath ]; then
                                                pythondir=$(find "$dir" -type d -name site-packages)
                                                PYTHONPATH="$PYTHONPATH${PYHTONPATH:+:}$pythondir"
                                             fi
                                             if [ -d "$dir"/lib -a -f "$dir"/.classpath ]; then
                                                CLASSPATH=$CLASSPATH:"$dir"/lib
                                                for jar in "$dir"/lib/*.jar "$dir"/lib/*.zip
                                                do
                                                   [ -f $jar ] && CLASSPATH=$CLASSPATH:$jar
                                                done
                                             fi
                                             if [ -x "$dir"/.pkgprofile ]; then
                                                . "$dir"/.pkgprofile
                                             fi
                                          done
                                          
                                          unset jar dir archname
                                          
                                          export PATH MANPATH LD_LIBRARY_PATH PERL5LIB PYTHONPATH CLASSPATH
                                          

                                          It sources any .pkgprofile files it finds in /opt/dirname to enable package-specific configurations which are not covered by this script. In recent distributions this can be dropped in /etc/profile.d, otherwise add it to /etc/profile. I removed some ancient cruft (e.g. a reference to non-existing X11R6 directory) m it, there might be other parts where its age shows but it still works after some 25 years.

                                1. 0

                                  For things like email, I cannot accept anything other than 99.999999…% up time. There cannot be any dropped emails ever….ever. Services like this and the other mentioned in the post just sketch me out and I guess I just don’t have enough experience outside the Google email realm. Bias warning I guess.

                                  I do see why people avoid services like Gmail and GSuite, but I just can’t see any of the reasons being big enough to warrant fully leaving Gmail or GSuite. The service is reliable and more or less bullet proof. And when your online life, and now more than ever, your physical life are tied to an email address, what more do you need other than a reliable service?

                                  Imagine missing a critical email related to your bank account because this vendor restarted the mail servers during maintenance. “Sorry for the inconvenience” doesn’t cut it in this case.

                                  When I dig around in the sites source and find a page like –> https://news.purelymail.com/posts/status/2020-03-04-planned-maintenance.html I get sketched out.

                                  1. 7

                                    For things like email, I cannot accept anything other than 99.999999…% up time.

                                    E-mail was specifically designed to function in environments with like a 0.01% uptime. That’s why smtp has batching, relaying, and retrying in the specification - it was designed in the days of dial-up only connecting every now and then. Sometimes they come a couple hours late if you have an outrage, but they still come.

                                    1. 1

                                      The network is reliable THE NETWORK IS RELIABLE!

                                    2. 3

                                      Imagine missing a critical email related to your bank account because this vendor restarted the mail servers during maintenance. “Sorry for the inconvenience” doesn’t cut it in this case.

                                      The protocol was designed to be resilient to these kinds of faults. A compliant sending server will retry.

                                      99.999999%

                                      Are you sure even gmail commit to 8-nines service availability? Even to paying customers?

                                      1. 2

                                        Here’s some interesting reading to soothe your mail anxiety:

                                        RFC 5321: SMTP

                                        …and specifically the part on retry strategies starting at page 66.

                                        Email is, or used to be, defined by a relatively straight-forward set of RFC’s which sketched a fault-tolerant asynchronous store-and-forward system for moving textual content from one mailbox to another. The ‘straight-forwardness’ has been muddled by the addition of several access-control related facilities to deal with unsolicited mail, the ‘textual content’ has been replaced by HMTL and mime but the core protocols still stand.

                                        1. 1

                                          That’s true and all but for the second time now I’ve had mails not even reach my mail server, not sure how broken their setup must be.

                                          I was sitting there, tailing logfiles on my mail server, sending test mails - nothing (signup for a random web shop and kickstarter’s forgot password mails earlier). Then I redid it with a gmail address, arrived in seconds.

                                          So yeah, maybe it was SPF or anything else on the DNS level, or the route to my mail server was dead.. but it’s been working pretty consistently over the years…

                                        2. 1

                                          Imagine missing a critical email related to your bank account because this vendor restarted the mail servers during maintenance. “Sorry for the inconvenience” doesn’t cut it in this case.

                                          If a mail server isn’t available it should retry, or the sender will get a bounce back informing them delivery failed. It won’t just disappear into the ether.

                                        1. 10

                                          This is super cool from a hardware perspective, but I would find it wildly stressful to have the day’s news plastered on my wall all day.

                                          1. 7

                                            yeah, I can see that.

                                            but our phones do that anyway, and a static frontpage, with a few stories, wouldn’t be as bad (I think).

                                            Also that display is ~$1500 :/

                                            1. 3

                                              Yeah, I think e-ink is super cool, being able to use it in full sunlight is fun and the battery life is pretty cool too… but the cost is just yikes.

                                              I did get myself a used amazon kindle (the older model with physical buttons to turn the page. why anyone would actually want to chafe their fingers swiping is beyond me) and it is actually pretty decent. But I wouldn’t mind being able to use one as like a unix terminal too… just the price is yikes.

                                              1. 1

                                                You don’t swipe on the newer models. You just touch the screen on the left or right side to turn the page. It’s honestly a very nice experience.

                                              2. 1

                                                the display is $1500, and they won’t sell it to you unless you’ve got a certain amount of clout. I’m eagerly awaiting for someone to steal their manufacturing process and eat their lunch.

                                                1. 1

                                                  And you need the v5 board to use it (mandatory) that is another $500.

                                                2. 3

                                                  so the front page of a newspaper is designed to sell you the paper. The idea is you see a story you actually want to read when it is sitting on the stand and then buy it to read more on page A-5 or whatever.

                                                  I guess it might be an amusing art display but saying “the best user interface is none” strikes me as silly. If you actually see anything you care about, you are gonna want to read the whole article but there’s no way to actually do that without a UI of some sort!

                                                  1. 2

                                                    It would be cool to have a remote control that runs on your computer or phone (or even better, a dedicated actual handheld remote control with only two buttons: forward and backward). That way, the display can stay completely void of any buttons, which would ruin the aesthetic effect. It already has wifi, so it’s connected.

                                                    Also, does anyone find this really depressing?

                                                    E-Ink’s NDA prevents me from sharing the source code, but you get the idea.

                                                  2. 2

                                                    Cool idea: do this, but instead of displaying today’s news, display the front page from this day 50 years ago.

                                                    1. 2

                                                      I would too, but I would love it if I could have a thing like this displaying all the slow-to-refresh things that we rely on screens for: the weather, bus schedules, et cetera. This really needs to be scaled up so it doesn’t cost $2K a unit.

                                                    1. 1

                                                      I am not sure that instant evaluation thing is good. I usually ignore such things because they waste energy and distract with flashing stuff when I’m trying to transfer stuff from my brain to the computer.

                                                      But what continues to bug me in the firefox console is the tab-complete goes to the first full thing my alphabetical order. docu<tab> is sane. But then quer<tab> fills in queryCommandEnabled! Because I’m sure that’s what I want. I’d rather it did more like what bash does instead of spamming stuff I then have to delete. I find myself pretty consistently hating “smart” editors.

                                                      But form.requestSubmit omg finally.

                                                      1. 19

                                                        This is one of those neat cases where PLT is shaped by American keyboards. We wouldn’t have this problem if we had «», or ⟨ ⟩, or ⦃ ⦄, or 𓁝𓁜.

                                                        1. 3

                                                          Are there any keyboards with «»? Seems like everyone types them with copy-paste, smart quotes, Alt+code in Windows, and (for unix enthusiasts) the Compose key…

                                                          1. 4

                                                            Bet you a chocolate bar there’s an easy way to type them on French layouts. :)

                                                            Edit: I lose this bet! There are nice mechanisms for typing guillemets on X11 and OSX but it seems there’s nothing sensible on Windows!? I found a couple of French language forums with people saying your best bet on Windows with an azerty layout is still to type alt+174 / alt+175

                                                            1. 5

                                                              Yeah the French keyboard layout on Windows is truly awful. There is no way to type the half of the special characters you need in regular French without using terrible hacks like Alt+123, even for ubiquitous characters like ’ or É. The Linux default AZERTY layout for French is way better, and the “OSS” variant is miles ahead (you can type everything you need in French on this one).

                                                              Also, system-wide automatic substitutions that macOS and iOS do are pretty good for French. Software like Microsoft Word also substitutes some characters automatically but it’s not system-wide.

                                                              1. 2

                                                                Ahhu so that’s why people in French language chat channels are always skipping literally all the diacritic marks and stuff. Thank you.

                                                            2. 1

                                                              On Macs they’ve always been option-‘ and option-shift-‘.

                                                            3. 3

                                                              There were people in D who wanted to use «», but indeed it was shot down for being painful for Americans to type.

                                                              But I’m glad it did get shot down becase really, why would we use that? Is it just because C++ uses <> and «» looks kinda like it without the same technical problems…? Or is there some deeper meaning beyond that? Ditto with ⟨ ⟩.

                                                              What I like so much about D’s decision to reuse plain () (with ! to indicate the presence of compile-time arguments) is that it questions that fundamental assumption that it should look different… notice instead of “generics” or “templates” or whatever, I just call it “compile-time arguments” - thanks to the syntax being so similar it lets us rethink how special the concept itself really needs to be.

                                                              1. 1

                                                                All these problems (can) go away if we’re not married to storage of programs as a disconnected pile of 1-dimensional strings.

                                                                1. 0

                                                                  ⦃ ⦄ is really pretty

                                                                1. 5

                                                                  The D language uses plain (). In the definition, you add a compile-time parameter list before the run-time parameter list, and they work very similarly. void foo(T)(T t); has a type T as a compile time param, then a runtime value param t of type T.

                                                                  To call it, well, many cases are implicit: foo(0); or foo("") bot just work, or you can explicitly call them by using the ! to indicate the presence of a compile-time parameter list: foo!(int)(5). (the parens around a compile time arg list can be omitted if the argument is a single, simple item, so you frequently see foo!int(5) in D code too.)

                                                                  It avoids all the <> ugliness and I really like the syntax similarity between CT and RT params; it is no longer a wholly separate concept and I think that semi-merging of compile time and run time code and concepts is one of D’s major strengths.

                                                                  as for their final thing about [] lol i like the array stuff but indeed it could just as well use () for that same stuff too, so eh i kinda get their point i just like D’s way

                                                                  1. 1

                                                                    I don’t think D’s approach is good. It feels like the basically understood the problem, but their solution is pretty much as ugly as the problem it tried to solve…

                                                                    1. 2

                                                                      Well, that’s extremely subjective so yeah. When the proposed the drop parens thing I at first was aghast and voted against it since I thought it was hideous at the time. But I came around pretty quickly and like it quite a lot now.

                                                                      I could probably get used to a foo[int](5) too though.

                                                                  1. 0

                                                                    Here’s the two ways to write a submit button in HTML:

                                                                    • <input type="submit" value="Submit this form">
                                                                    • <button type="submit">Submit this form</button>

                                                                    I prefer the <button type="submit">.

                                                                    Last I checked, the latter way doesn’t actually display the text “Submit this form”. I am, however, too busy to check right now. I hope someone proves me wrong, because I recall that irking me.

                                                                    1. 3

                                                                      It always has and still does. It is possible you had a css problem; something like white text on white background.

                                                                      1. 1

                                                                        Figured it out! I had tried <input type="submit">Submit this form</input>. Not sure whether that’s incorrect usage or just different behavior.

                                                                        1. 2

                                                                          Input elements can’t have child elements / content (that’s why select inputs use a different node name).

                                                                          1. 1

                                                                            Oh, that makes sense. Thank you!

                                                                    1. 3

                                                                      Trying to convince people to get out and actually vote for Bernie Sanders.

                                                                      In between that, I’m integrating my terminal user library with my terminal emulator library, to help existing terminal-based programs bridge over to becoming GUI applications. By integrating my own custom terminal emulator, they get the full features it provides (including inline images) anywhere, plus setting the default size and color (where in a normal terminal program you must use what is offered), while also giving a hook to get right into the gui and add stuff like custom menus.

                                                                      Recompiling for a gui does mean potential loss - now it requires X on Linux, isn’t as ssh friendly, etc., and if you already use my terminal emulator those special features are mostly already available anyway (and if not it gracefully degrades), so on Linux, it is probably more lost than gained…

                                                                      But on Windows, even if you are already using my TE not all features are available (the new conpty thing strips unrecognized sequences… so no magic extensions :( ), so integrating gains that plus a bit better, more customized UX, so there is a good amount to gain. And since win32 gui libs are always available and ssh isn’t as important, not as much to lose.

                                                                      So probably pretty niche in the end but not a huge amount of work since I already wrote all the pieces.

                                                                      1. 3

                                                                        Well, do we have hindsight doing it today, or hindsight doing it with the limitations back in the day?

                                                                        If I was doing it today in the same paradigm, I’d easily put structured message blocks for all communications on the wire. No more picking out escape sequences and hoping you get it right.

                                                                        But back in the day, they had limited bandwidth, and that message block framing would be significant overhead. You could still potentially make it work though by at least defining the escape sequences with some kind of consistent detection scheme… maybe something inspired by UTF-8 so you can notice if you were dropped in the middle of a scheme and bypass that to the next regular character to resync, and definitely DEFINITELY make sure the “escape” sequence is not the same character as the esc key on the keyboard! (If you want to manually input things, put more logic in the keyboard itself to send the new sequence, like an fn modifier on modern laptops)

                                                                        I think an unholy cross of UTF-8 and base64 could present arbitrary data with fairly small overhead for the typical case while providing stream correction capabilities and potential for unlimited expansion. My big worry would be how much the terminal hardware would cost and the processing power to decode on the mainframe… would be just my luck a competitor would offer a low-cost alternative that does it worse and they’d take over the market :(

                                                                        But still that’d be the big thing I’d like to fix that was probably doable back then and would solve a LOT of headaches we still have today.

                                                                        if totally redoing it though… well it probably wouldn’t even maintain the paradigm. There’s some bits of terminal UI I like, and bits of pipe i/o I like… but I probably wouldn’t combine them (even my terminal library I have today doesn’t let you actually combine - you must if(interactive) { do one thing } else { do another}) and each of those I’d do totally differently separately. Make the UI, well, a UI, and make the pipe system have more structure as well. Like using XML instead of plain text. Not even kidding.

                                                                        1. 4

                                                                          I used to pretty well agree with all this… but then I spent a good amount of time just trying to figure out how a library handled a more complex memory graph. The documentation wasn’t clear so I had to trace through the source and hope I didn’t misread. Sure, C++ had a solution… but it would have been so much simpler if it was just an automatic garbage collector.

                                                                          My view now is to use the GC by default for memory, RAII for other stuff, and then special case other memory strategies when it is proven necessary/appropriate. The cost of GC in most circumstances is pretty small in the real world and the benefits outweigh them; I’ve learned to love it.

                                                                          1. 56

                                                                            I’m not sure why Free Software was thrown into this. I fully agree with the author’s points regarding the severe lack of privacy associated with discord, BUT I disagree that Free Software can only be developed/supported using communication mechanisms that respect privacy.

                                                                            Email is an acceptable choice for Free Software projects, and has been for many decades. Same for IRC. None of those are inherently secure/privacy-friendly.

                                                                            Discord is a terrible choice for Free Software projects because it’s a proprietary walled garden, not because it’s ‘not private’.

                                                                            1. 21

                                                                              BUT I disagree that Free Software can only be developed/supported using communication mechanisms that respect privacy.

                                                                              Of course you can develop free software with proprietary tools and services.

                                                                              It’s just discriminatory and excludes those who need or want to maintain their privacy. I don’t think free software projects should be discriminatory or exclusionary.

                                                                              Email is an acceptable choice for Free Software projects, and has been for many decades. Same for IRC. None of those are inherently secure/privacy-friendly.

                                                                              Email and IRC are absolutely privacy-friendly, despite being unencrypted. You can create an entirely anonymous free account and use them, via Tor, just like any other participant and not be excluded.

                                                                              From the article:

                                                                              Discord is proprietary, non-free software, held closely by a for-profit company. How you personally feel about this is dependent upon your own philosophical views, but, objectively, it is not very consistent with the ideals of most groups dedicated to free software or open collaboration to produce and improve free software.

                                                                              It seems to me inappropriate for an organization that believes in free software to choose proprietary and privacy-disrespecting tools when free and private alternatives are readily available and can be hosted very inexpensively.

                                                                              1. 20

                                                                                Yes, I read the bit about it being proprietary in the article, but the main points being made in the article are not about it being a poor choice because it’s non-free, but because it’s “not private”.

                                                                                Anyways, I hope fewer projects choose this path (and slack, which i put squarely in the same boat as discord), and instead choose IRC, matrix, XMPP, and other similar protocols.

                                                                                1. 6

                                                                                  Well, the main reason it’s discriminatory and exclusionary is because of privacy. Not everyone can give up their privacy, so any project using it is discriminating against all of those people.

                                                                                  Also from the article:

                                                                                  If you have done so in the past, please stop recommending IRC as a replacement for Slack and Discord. It’s absolutely not. IRC is great, but it is not simply “open source Slack” (that’s Mattermost). They are both chat systems, but they are different tools for different jobs. I love IRC, but it’s simply not a useful tool for most groups.

                                                                                  Are there any good matrix implementations yet? I’ve been meaning to run one.

                                                                                  1. 7

                                                                                    If you have done so in the past, please stop recommending IRC as a replacement for Slack and Discord. It’s absolutely not. IRC is great, but it is not simply “open source Slack” (that’s Mattermost). They are both chat systems, but they are different tools for different jobs. I love IRC, but it’s simply not a useful tool for most groups.

                                                                                    Yeah.. I disagree with that bit too. All of the Mesa development happens over IRC, and mailing lists (with some moving to gitlab, e.g. patch review). It works really, really great for that. For a (long) while, Mozilla used it. But I guess it wasn’t ‘hip’ enough so they moved to something else (matrix I think?)

                                                                                    IRC is a very simple protocol, you can implement a client for it very easily, it has been ‘battle tested’ for decades. One of the big missing ‘features’ is accessing the backlog while you are away, and many folks (including myself) use a bouncer on some 24/7 system to fill that gap, but I understand that’s not for everyone.

                                                                                    Are there any good matrix implementations yet? I’ve been meaning to run one.

                                                                                    I’m also interested to know this. ~2yrs ago the (only?) homeserver implementation out there was hard to set up, and didn’t scale well at all (something about it being written in javascript? lol). Maybe that’s different now. I’ve yet to see any widespread adoption of E2EE in matrix, for any channels I’ve seen. People tout E2EE as the major reason to use matrix, but basically no one uses it, AFAIK.

                                                                                    1. 16

                                                                                      Yeah.. I disagree with that bit too. All of the Mesa development happens over IRC, and mailing lists (with some moving to gitlab, e.g. patch review). It works really, really great for that. For a (long) while, Mozilla used it. But I guess it wasn’t ‘hip’ enough so they moved to something else (matrix I think?)

                                                                                      Because it works well for some groups does not mean it works well for most groups.

                                                                                      Mozilla didn’t quit IRC because it wasn’t “hip” enough. They wrote about it when they did it: it wasn’t serving their needs.

                                                                                      For most groups, asynchronous mobile applications with native notifications and multiclient are hard requirements. Unless you pay for irccloud, you’re not getting any of that. IRC’s “very simple protocol” is actually a hindrance for the majority of users: it means that if you can’t maintain a TCP connection, you can’t maintain an active session. The vast majority of people these days only access social networking via mobile devices. That forces them onto a paid bouncer like irccloud, or into a bad UX. There’s a reason that Slack and Discord are so massively popular. IRC advocates entirely fail to understand those reasons.

                                                                                      Use of Discord discriminates against all the users who need privacy.

                                                                                      Use of IRC discriminates against all the users who don’t know screen, znc, and the command line, or users who primarily use mobile phones.

                                                                                      1. 7

                                                                                        Use of Discord discriminates against all the users who need privacy.

                                                                                        But in the context of publicly discussing open source development, I don’t see how you do? So frankly I don’t really see the objection here.

                                                                                        The other day someone on Reddit was complaining about a Google mailing list not being private. The privacy of what? Your public messages sent to a public mailing group?

                                                                                        I’m unconvinced by the “you need a telephone” argument; the fact is that spam and abuse are a serious problem, and it’s a reasonably effective at stopping it. I don’t buy the “complete privacy” argument, and I don’t think that they ask it “just to get more data about you”. That’s ignoring the very real problems people have to deal with.

                                                                                        The “human right” argument seems misplaced. I also have the “human right” to call anyone an asshole here (freedom of speech) or to proselytize my religion (freedom of religion), but that doesn’t mean this platform needs to accept that. Again, the context here is publicly discussing a public project.

                                                                                        In your article you wrote that “you should be able to use your communications tools to mock and ridicule people, if you so wish”. Seriously? If someone comes in a OSS project to “mock and ridicule people” then I’d kick them out faster than you can say “freedom of speech”.

                                                                                        The word “privacy” seems to be subject to quite some inflation these days. I think this is a serious distraction from actual privacy issues.

                                                                                        1. 6

                                                                                          The privacy of what? Your public messages sent to a public mailing group?

                                                                                          the connection between your web identity and your in-real-life identity. The messages are obviously public but you might not want, for example, your boss to know that “coder_742” is you.

                                                                                          1. 2

                                                                                            Do people not just make new email accounts for their “alt” identities? Virtually all online services use email as the primary proof of identity and it is trivial to create a new one. Discord requiring an email and an account are hardly barriers to privacy.

                                                                                            1. 5

                                                                                              They also require your physical location via your IP. If you use Tor or a VPN to preserve your personal privacy, the things that happen (dozens of captchas, frequent inability to log in, DMing links gets your account auto deleted) are huge barriers to entry.

                                                                                              1. 1

                                                                                                Hard disagree. Tor is very frequently used for spam (among other nefarious things), so it’s no surprise that IPs for exit nodes are blacklisted or put under more scrutiny. If you go out of your way to obfuscate your origin and you behave like a spambot, you’re going to get treated like one. These are good things, it makes the network better for the vast majority of people who use the service. That being said, I use Discord through a major VPN provider all the time and have never had any issues with retaining my session or logging in. Captchas are hardly an issue either, they’re just slightly annoying.

                                                                                        2. 4

                                                                                          Use of IRC discriminates against all the users who don’t know screen, znc, and the command line, or users who primarily use mobile phones.

                                                                                          FYI, there are some great IRC clients for Android.

                                                                                          Also, ‘discrimination’ is an intentional action, not accidental. When people set out to create IRC, they didn’t scheme in some dimly lit room and decide “we must prevent users who don’t know screen, znc, and command line from using this. Oh, and fuck mobile users too!”. They simply made a thing that lots and lots of people started using.

                                                                                          1. 12

                                                                                            Also, ‘discrimination’ is an intentional action, not accidental.

                                                                                            Nah, you can absolutely discriminate accidentally. An app demanding only five digit US numeric zip codes or ten digit phone numbers that start with a +1 is discriminating against non-US users even if they didn’t intend to.

                                                                                            They simply made a thing that lots and lots of people started using.

                                                                                            Yeah, in like 1990, for 1990-style programs. Just because there are decent IRC clients for android doesn’t mean IRC’s protocol is good for modern communication. It doesn’t do multi-client, it needs a persistent TCP connection, it doesn’t do multiline or rich text or media, doesn’t have any sort of cryptography, et c. It’s a bad protocol, and it should be left in the past.

                                                                                            1. 10

                                                                                              You complain a lot, but most of the things you complain about are already solved, or being solved.

                                                                                              IRC isn’t dead, it’s a living, breathing protocol, improving every day.

                                                                                              And especially mobile usage isn’t that complicated to do right, especially if you treat IRC the way Matrix treats their protocol between homeservers, and have a separate protocol for clients (like e.g. IRCCloud or our own Quassel/Quasseldroid do: https://quasseldroid.info/).

                                                                                              It’s being worked on, and it has a major community still using it. Which is a massive improvement over the flavour-of-the-day Slack clone you see elsewhere.

                                                                                              Now to get into specifics:

                                                                                              it doesn’t do multiline

                                                                                              or rich text or media

                                                                                              it needs a persistent TCP connection

                                                                                              doesn’t have any sort of cryptography

                                                                                              1. 14

                                                                                                IRC isn’t dead, it’s a living, breathing protocol, improving every day.

                                                                                                As a long time IRC user who has monitored the progress of IRCv3 for years, and talks to many of its former developers, I find this hard to believe. Even with IRCv3 efforts, everything was stillborn and many of those developers are sad at how everything passed them by.

                                                                                                1. 4

                                                                                                  These are all open issues or PRs for the past couple of years. ‘These are being worked on’ does not make IRC a viable alternative for the required feature set of today.

                                                                                                2. 3

                                                                                                  it doesn’t do multiline or rich text or media

                                                                                                  Those are definitely features, IMHO. But I can see there’s no way we can agree here :)

                                                                                                  I look forward to something like Matrix (if Matrix doesn’t improve), that is FLOSS, lightweight, secure, federated, and easy for all to use.

                                                                                            2. 4

                                                                                              The official reference implementation, synapse, has been production-ready for a long time and also scales pretty well nowadays. It can be easily hosted on NixOS, there are Docker images and a Debian repository. I have been running my personal Matrix server for 1-2 years now and I never had problems. Just make sure presence is turned off for better performance.

                                                                                              E2EE adption has not been as widespread as it should because the UI/UX had been lacking. It’s not that easy to get right for a federated multi-device service. But a few weeks ago that last missing feature to make E2EE usable, cross-signing of devices, got implemented. It is now being integrated and tested and will soon go live. After that all new private rooms will be E2EE by default.

                                                                                              Much has happened on the Matrix project in the last years, I suggest you give it another try :)

                                                                                            3. 1

                                                                                              Are there any good matrix implementations yet? I’ve been meaning to run one.

                                                                                              See my comment below.

                                                                                          2. 8

                                                                                            It’s just discriminatory

                                                                                            I’d say it’s exclusionary, not discriminatory. Discriminatory heavily implies it’s on the basis of an immutable category. But project leaders have to dictate to some extent what software their employees will use, and their employees have the ability to use other tools for private communication.

                                                                                            You may say the bar to entry for those other tools is higher, but whose responsibility is that? The project leader’s? I think regardless of what you believe, your comment holds the wrong people to account—that is, if blame is even an apt paradigm here!

                                                                                            1. 5

                                                                                              Tools that spy on us are bad tools. If project leaders chose Discord, and Discord’s policies regarding privacy mean that people who need privacy are excluded from participating in that group, then I think it’s reasonable to say that group leaders should not make those sorts of choices.

                                                                                              It’s just the same as if you had a club meeting at a place with a specific dress code that excludes a cultural form of dress. The people who organized the meeting who chose that venue would be legitimately open to criticism (just as would the venue be) for discriminating against people who dress that way.

                                                                                              Free software and public benefit groups and projects should not be discriminatory or exclusionary, and they should not make tool choices that perpetuate discrimination.

                                                                                            2. 4

                                                                                              I care about privacy, but this definition of “exclusive” and “discrimination” is a bit silly. You could say any tool “discriminated against” or “excludes” anyone who doesn’t like it for any reason, and then wag your finger saying, “you don’t want to be discriminatory or exclusive, do you?”. It doesn’t exclude people who care about privacy, we just don’t like it. And as a maintainer, I’d probably elect for the usable tools over those that trade everything for privacy (or more likely, privacy theater).

                                                                                          1. 14

                                                                                            This list seems to be based on a super Frankenstein’d, incompletely applied threat model.

                                                                                            There is a very real privacy concern to be had giving google access to every detail of your life. Addressing that threat does not necessitate making choices based on whether the global intelligence community can achieve access into your data — and less than skillfully applied that probably makes your overall security posture worse.

                                                                                            1. 1

                                                                                              I agree that mentioning of the 5/9/14/howevermany eyes is unnecessary, and also not helpful. It’s not like if your data is stored on a server in a non-participating country that it somehow makes you more secure. All of that data still ends up traveling through the same routers on its way to you.

                                                                                              1. 1

                                                                                                If you’re going to put a whole lot of effort into switching away from Google, you might as well do it properly and move to actually secure services.

                                                                                                1. 11

                                                                                                  In a long list of ways, Google is the most secure service. For some things (i.e. privacy) they’re not ideal, but moving to other services almost certainly involves security compromises (to gain something you lose something).

                                                                                                  Again, it all goes back to what your threat model is.

                                                                                                  1. 3

                                                                                                    Google is only the most secure service if you are fully onboard with their business model. Their business model is privacy violating at the most fundamental level, in terms of behavioral surplus futures. Whatever your specific threat model it then becomes subject to the opacity of Google’s auction process.

                                                                                                    1. -1

                                                                                                      Running everything yourself is much more secure than Google, which happily hands over data to the NSA when asked.

                                                                                                      1. 6

                                                                                                        which happily hands over data to the NSA when asked.

                                                                                                        Emphasis mine.

                                                                                                        As someone who don’t like Google anymore I still think this is still plain wrong I think and I’ll give reasons why:

                                                                                                        • Google is known to have put serious effort into countermeasures against wiretaps.

                                                                                                        • Google is known to be challenging NSA and others where possible.

                                                                                                        • and for the best reason that exist in a capitalist society: it is bad for their business if people think they happily hand over data to the NSA.

                                                                                                        • (and FWIW I guess a number of Googlers took offense to the smiley in the leaked NSA slides)

                                                                                                        Also, for most people running their own services isn’t more secure, and can in many cases be even less secure, even against NSA. I’ll explain that as well:

                                                                                                        Things you get for free with Google and other big cloud providers:

                                                                                                        • physical security
                                                                                                        • patching
                                                                                                        • monitoring
                                                                                                        • legal (yep, for the selfish business reasons mentioned above they actually challenge requests for data)
                                                                                                        1. -8

                                                                                                          “Security” is not an absolute value; it is meaningless without a threat model.

                                                                                                          You have demonstrated that you are well out of your league here. Quiet down, listen and learn.

                                                                                                          1. 6

                                                                                                            You have demonstrated that you are well out of your league here. Quiet down, listen and learn.

                                                                                                            Wow, that seems an incredibly uncalled for level of incivility, even for lobsters.

                                                                                                            1. 9

                                                                                                              Yeah, that was definitely going off the deep end.

                                                                                                              There’s an appropriate level of criticism here, and this ain’t it.

                                                                                                              /u/friendly - I apologise unreservedly for that comment.

                                                                                                              1. 2

                                                                                                                Thankfully this attitude is not common here.

                                                                                                              2. -1

                                                                                                                You’re lucky I’m intentionally being very friendly on lobsters at the moment, or this reply would be a lot less polite.

                                                                                                                The idea that security is ‘meaningless without a threat model’ is just a meme: one of those ideas people read somewhere that sounds good and so they repeat it ad nauseum without stopping and thinking critically about what it means. It doesn’t matter whether it’s true or how true it is! It’s not actually relevant to what we’re discussing.

                                                                                                                Rather than repeating something you’ve read in an article that you think sounds good, without tying it to what I said in any way, and then making a totally unnecessary and very rude patronising remark, I suggest you actually respond to what I said directly.

                                                                                                                Running everything yourself (for example, running your own mail server) is for a start more secure than using Google’s services, given that we already know that Google inspects all the data you give them. Google reads your emails. What more do you actually need to know to judge whether Gmail is as secure as running your own mail server. If you run your own mail server, only you can read your emails. If you use Gmail, then you can read your emails and third parties can too. That’s less secure. This is actually quite a simple concept.

                                                                                                                1. 10

                                                                                                                  if I protect my house by getting the biggest strongest door out there, but the burglars turn up with a brick they throw though my window, then my “security” was useless as my threat model was way off. The concept of threat modelling is most certainly not a “meme”.

                                                                                                                  Lots of people get hacked when they self-host, because it requires quite some knowledge not everyone has and even if you do, it’s easy to make mistakes. Just self-hosting does not make anything automatically secure, and it also won’t protect you from “tne NSA”: you’ll still be obliged to follow laws etc. Besides, the distributed nature of email/SMTP makes it hard to protect from this anyway: chances are most of your emails will still be routes through a US server.

                                                                                                                  All services “read my emails” to some degree as that’s pretty much a requirement for processing them. This doesn’t necessarily say anything about security or privacy.

                                                                                                                  1. -2

                                                                                                                    if I protect my house by getting the biggest strongest door out there, but the burglars turn up with a brick they throw though my window, then my “security” was useless as my threat model was way off. The concept of threat modelling is most certainly not a “meme”.

                                                                                                                    No, it isn’t. But repeating the concept over and over again as an ‘argument’ without actually tying it to what you’re responding to is a meme. It’s not okay to just say “security is meaningless without a threat model” and expect the conversation to be over without justifying that it’s actually a response to what the person is saying. It’s just a stock phrase being repeated by someone that doesn’t really understand what it means or where it’s relevant, as far as I can tell.

                                                                                                                    I’m not even saying that it is necessarily irrelevant here. But just saying it doesn’t justify it being relevant. I don’t like this trend I see more and more of here of acting like this is reddit or HN where you can just drop pithy one-liners and people upvote you when you haven’t actually said anything meaningful.

                                                                                                                    1. 5

                                                                                                                      It’s not like your comment was especially detailed or overflowing with nuance. Short abrupt one-line comments with blanket statements tend to elicit the same kind of replies.

                                                                                                                  2. 8

                                                                                                                    yeah, but what does “more secure” mean? When people say threat model, they are just talking about what “more secure” means in a certain context. It’s not exactly infosec dogma…. There is no singular axis of more/less secure

                                                                                                                    1. 7

                                                                                                                      “Secure” is a vague term in this context. Giving google and their partners access to your e-mails is not a security issue, I would expect that all to be written down in their ToS and similar documents. It is bad for your privacy and anonymity, definitely.

                                                                                                                      But I suspect google would be better prepared for a 3rd party that is attempting to hack their servers and forcefully obtain your e-mails than you or any other single individual are. I think that’s also what @ec and others are referring to. Moving away from Google is definitely a good decision to get back (some of) your privacy. Security wise, it really depends on where you are moving to.

                                                                                                                      1. 3

                                                                                                                        Google hands over its users’ data to the American government and through the Five Eyes agreement and similar agreements to many of the governments of the western world. That is not a ‘privacy’ issue it’s a security issue.

                                                                                                                      2. 7

                                                                                                                        Running my own email is not more secure against data loss (unless you also have multi-point off-site backups, encrypted, with the crypto keys stored securely).

                                                                                                                        It’s also not more secure against email delivery failures causing you to lose business (a much bigger issue for me than google reading them).

                                                                                                                        Neither is it more secure against your abusive spouse accessing your emails (or destroying the hardware).

                                                                                                                        Finally, anytime you communicate with a gmail user, google is reading your emails anyways - so to improve your security you also need your mail client to check whether the recipients MX records resolve to a google-controlled IP range.

                                                                                                                        That’s what “irrelevant without a threat model” means.

                                                                                                                        I’ve nearly finished de-googling everything in my life. Doing it in a way that preserves the security properties I care about is very hard work.

                                                                                                                        1. 2

                                                                                                                          It’s also not more secure against email delivery failures causing you to lose business

                                                                                                                          Eh, I’ve run my own email and did gmail side by side for years. I lost more legitimate emails to google’s spam filter false positives than to server down.

                                                                                                                          Remember that email is designed to be resilient against delivery failures, designed in the days of temporary dial-up connections. If a server is down, it just queues the message and tries again later. If it still doesn’t work, it notifies the sender that the message failed. Not everyone will try to contact you another way when that happens…. but surely more than people whose messages just disappeared into a spam filter.

                                                                                                                          1. 1

                                                                                                                            I’ve been on Fastmail for years now. I regularly check my spam folder; in almost four years I have had one false positive.

                                                                                                                            When I briefly tried running my own, google randomly stopped accepting my mail after a little while (hence briefly).

                                                                                                                            I’m glad you have had a good experience with it; I haven’t found it as good a use of my recreational sysadmin time as other things (plex, vscode-over-http, youtube-dl automation, repo hosting etc).

                                                                                                            1. 2

                                                                                                              The backend that enables this is pretty cool - the pseudoconsole apis. I wrote a custom terminal emulator for myself and recently put it through that api… and old Windows programs just work on it! It really is pretty cool, now we not only have what Microsoft does, but what we do for ourselves too, now without weird screen scraping hacks.

                                                                                                              I’ll have to download this though to confirm my client terminal program api all still works in it though..